PandaLabs has identified Adware/PremiumSearch a new malicious code that takes advantage of some of the most popular Internet search engines. This cybercrime attack would seem to mimic the actions of the worm detected last week that altered the sponsored links in Google searches.
In this case the infection originates from visits to a certain web page, when users are redirected from other pages containing warez (illegal software versions) or pornography. In addition to PremiumSearch, this page also installs Application/WorldAntiSpy on victims’ computers, along with a variant of Smitfraud, leading users to believe they have been infected by a series of threats and will have to pay to disinfect them.
PremiumSearch exploits some of the vulnerabilities most frequently used by spyware such as ByteVerify, LoadImage, and Mhtredir to install a malicious BHO (Browser Helper Object) on the computer. It then installs a ‘Google’ toolbar (which does not come from Google but has been created by a third party), and modifies the HOSTS file. The BHO also changes the browser home page to the PremiumSearch search engine, even if a user specifies another in the browser settings.
The modifications to the HOSTS file and the action taken by the BHO direct users that request MSN, Yahoo! and Google (in versions for more than 60 countries) to spoof versions which are indistinguishable from the original versions other than the fact that the first results displayed have been altered (the remaining results are the same as for the genuine web pages). The same occurs with searches launched through the spoof Google toolbar. This malicious code can also affect the Alexa search again, although it has failed to operate correctly on test systems. The web page from which the spoof versions are obtained are hosted in the USA.
“These actions are financially motivated and aim to exploit the popularity of these search engines to increase visits to the pages with the altered results,” explains Luis Corrons, director of PandaLabs. “To avoid this kind of attack, it is vital that users have reliable antivirus protection and keep their systems up-to-date, as the vulnerabilities used have often been in existence for some time.”
In order to neutralize this threat, Panda Software has already contacted the ISP where the pages used in this attack are hosted.
