Yahoo!, MSN, and Google, cloned again!

9/30/2005. - A new, financially-motivated threat interferes with these search engines, displaying false results and redirecting users to other web pages
- Panda Software’s TruPreventTM Technologies blocked this threat without prior identification, ensuring users with this protection have been safe from the outset

Panda Labs has identified Adware/PremiumSearch a new malicious code that takes advantage of some of the most popular Internet search engines. This attack would seem to mimic the actions of the worm detected last week that altered the sponsored links in Google searches.

In this case the infection originates from visits to a certain web page, when users are redirected from other pages containing warez (illegal software versions) or pornography. In addition to PremiumSearch, this page also installs Application/WorldAntiSpy on victims’ computers, along with a variant of Smitfraud, leading users to believe they have been infected by a series of threats and will have to pay to disinfect them.

PremiumSearch exploits some of the vulnerabilities most frequently used by spyware such as ByteVerify, LoadImage, and Mhtredir to install a malicious BHO (Browser Helper Object) on the computer. It then installs a ‘Google’ toolbar (which does not come from Google but has been created by a third party), and modifies the HOSTS file. The BHO also changes the browser home page to the PremiumSearch search engine, even if a user specifies another in the browser settings.

The modifications to the HOSTS file and the action taken by the BHO direct users that request MSN, Yahoo! and Google (in versions for more than 60 countries) to spoof versions which are indistinguishable from the original versions other than the fact that the first results displayed have been altered (the remaining results are the same as for the genuine web pages). The same occurs with searches launched through the spoof Google toolbar. This malicious code can also affect the Alexa search again, although it has failed to operate correctly on test systems. The web page from which the spoof versions are obtained are hosted in the USA.

“These actions are financially motivated and aim to exploit the popularity of these search engines to increase visits to the pages with the altered results”, explains Luis Corrons, director of Panda Labs. “To avoid this kind of attack, it is vital that users have reliable antivirus protection and keep their systems up-to-date, as the vulnerabilities used have often been in existence for some time.”

In order to neutralize this threat, Panda Software has already contacted the ISP where the pages used in this attack are hosted.

More information about these and other threats at Panda Software’s Encyclopedia.

About PandaLabs
Since 1990, PandaLabs’ mission has been to analyze new threats as soon as possible to ensure that our clients are safe. Several teams specialized in each specific type of malware (viruses, worms, Trojans, spyware, phishing, spam, etc.) work 24x7 to offer global coverage. To do this they are supported by TruPrevent™ Technologies, a truly global early warning system made up of sensors that are strategically distributed and neutralize new threats and send them to PandaLabs for in-depth analysis. According to AV-Test.org, PandaLabs is the fastest in the industry to offer complete updates (more information at www.pandasoftware.com/pandalabs.asp).

Oxygen3 24h-365d
by Panda Software

2005-10-02 12:03

Back

IT News: