Tech Watch | InfoWorld Staff » Worm poses as Google

September 19, 2005 | Comments: (0)

Worm poses as Google

TAGS: None

A new worm has been discovered that apes Google's search site and tunes the results to benefit hackers, not Web surfers.

The P2Load.A virus modifies the HOSTS file on a PC so that when users try to access Google, they are redirected to a page that looks exactly the same as Google, but is not controlled by the company. Instead, the exact copy of Google even supports the 17 languages that Google does and redirects typos such as www.googel.com or www.gogle.com, in such a fashion that users are not aware of the change, according to security firm PandaLabs.

Once users inadvertently download P2Load.A, the next time they go to Google, the spoofed page comes up. Some of the search results are selectively changed, and the fake ads are swapped in place of Google's AdWords.

The Register quotes a Panda executive saying that the motivation of P2Load.A's creator is purely financial -- in the form of increased visits to untrusted Web pages.

PCWorld reports that users looking for a free Star Wars game may, instead, install the worm.

P2Load.A strikes both IE and Firefox, Panda said.

Some sites are calling for Google to offer a bounty on the virus writers, much the way Microsoft has done.

Full disclosure: PCWorld is owned by IDG, the parent company of InfoWorld.

Posted by Tom Sullivan on September 19, 2005 08:52 AM

RATE THIS ARTICLE: