Quantcast
Subscribe to magazine

Security Vendor Warns of Google-spoofing Worm

Masquerades as a free version of a Lucasfilm game.

Robert McMillan, IDG News Service

  • 0 Yes
  • 0 No

Downloaders looking for a free Star Wars game may instead find themselves installing a new worm that gives them dodgy Google search results.

The worm, called P2Load.A, is being spread on P-to-P (peer-to-peer) programs like Shareaza and Imesh, masquerading as a free version of the Lucasfilm game Knights of the Old Republic II, says Forrest Clark, senior manager of consumer product marketing with antivirus vendor Panda Software.

P2Load.A first began spreading on Wednesday and is most widely spread in the United States and Chile, Clark says.

When the software is installed, it makes changes to the computer's browser so that any user trying to access Google's search engine is instead presented with a Google look-alike page, hosted on a server in Germany.

The page appears to be a working copy of the Google search engine that gives nearly identical search results. But the sponsored links are different, Clark says. "What they're doing is replacing all of the AdWords ads with fake ads, and they're selectively changing some of the search results," he explains.

Even users who mistype the www.google.com address are redirected to the fake site, which also supports the same range of languages as Google.com. This redirection is achieved by modifying the hosts file in the infected computer's operating system, which is a kind of address book used to quickly connect the browser to Web sites.

By changing this file, the worm's authors could spoof other popular Web sites and possibly modify this attack for phishing, Clark says.

Money Maker

The P2Load.A worm seems to have been written to make money for its authors by increasing the number of visitors directed to the sites listed in the phony sponsored links results, Clark says.

Users infected with the worm will notice one other side effect: Their browser's start page will be modified to display what appears to be a shopping site.

P2Load.A affects Windows computers running either the Firefox or the Internet Explorer browsers, according to Panda.

  • Recommend this story?
  • 0 Yes
    0 No

"Security Vendor Warns of Google-spoofing Worm" Comments

Print 65% more pages than with refilled inks. Trust Original HP Inks. Hit Print Reliably.

Featured APC Accessories For Your System
10% Off Entire Cart at Online Store

  • APC Back-UPS ES Safeguards your equipment from damaging surges and spikes that travel along your utility & data lines.
  • APC SurgeArrest Performance Highest level of protection for your professional computers, electronics and connected devices, as well as provides surge protection.

People who read this also read:

  • 2007 Microsoft Office Suites Comparison This paper compares and contrasts four suites of the 2007 Microsoft Office system: Microsoft Office Standard 2007, Microsoft Office Professional Plus 2007, Microsoft Office Enterprise 2007 and Microsoft Office Ultimate 2007. This paper is intended to help organizations understand the applications and capabilities offered, and to identify the suite that best fits their needs.
  • Windows Vista Migration: The Business Proposition It's not so much a matter of "if" but "when" for most organizations regarding migration to Windows Vista. Laying the groundwork now for this migration can yield higher ROI than waiting until later. This Computerworld Technology Briefing explains it all.

PC World's Marketplace