Security researchers have identified a Trojan that hijacks Google text advertisements, replacing them with "ads" from a different provider that are likely to be laced with spyware.

The Qhost-WU modifies an infected computer's hosts file, thereby poisoning systems with bogus DNS lookup records. The hosts file matches domain names of websites with corresponding IP addresses. By corrupting the file hackers can redirect surfers to domains controlled by hackers even when users visit a trusted location.

In this case, the modified file contains a line redirecting the host "page2.googlesyndication.com" from a server run by Google to an imposter, potentially depriving web masters of revenue while leaving infected punters in a pickle.

"This is a serious situation that damages users and webmasters alike," said Attila-Mihaly Balazs, a virus analyst at Romanian security firm BitDefender. "Users are affected because the advertisements or the linked sites may contain malicious code, which is a very likely situation, given that they are promoted using malware in the first place. Webmasters are affected because the Trojan takes away viewers and thus a possible money source from their websites."

Although damaging, the Qhost-WU Trojan hasn't spread particularly widely. BitDefender rates it as a medium risk pathogen.

Without commenting on Qhost-WU specifically, Google said it purges entries for sites containing malware from its search index. "We have cancelled customer accounts that display ads re-directing users to malicious sites or that advertise a product violating our software principles," the ad trafficking giant told (http://news.yahoo.com/s/infoworld/20071220/tc_infoworld/94154) Reuters. ®

Related stories

Hackers find clever new way to hose Google users (6 March 2008)
http://www.theregister.co.uk/2008/03/06/googe_iframe_piggybacking/
Spotted in the wild: Home router attack serves up counterfeit pages (23 January 2008)
http://www.theregister.co.uk/2008/01/23/pharming_attack_in_the_wild/
Hackers turn Cleveland into malware server (8 January 2008)
http://www.theregister.co.uk/2008/01/08/malicious_website_redirectors/
Google to reinvent UK newspaper biz (2 January 2008)
http://www.theregister.co.uk/2008/01/02/google_print_ads_on_way_to_uk/
Google suffers patent blow (27 December 2007)
http://www.theregister.co.uk/2007/12/27/google_hyperphrase_patent_row/
S&M blogger outs web host malware attack (14 December 2007)
http://www.theregister.co.uk/2007/12/14/latest_ipower_breach/
Webmail-creating Trojan targets Gmail (15 August 2007)
http://www.theregister.co.uk/2007/08/15/webmail_trojan_update/
Worm automates Google AdSense fraud (6 October 2006)
http://www.theregister.co.uk/2006/10/06/google_adsense_worm/
Trojan poses as Google Toolbar (20 July 2006)
http://www.theregister.co.uk/2006/07/20/google_toolbar_trojan/
Botnet implicated in click fraud scam (15 May 2006)
http://www.theregister.co.uk/2006/05/15/google_adword_scam/
Google AdSense Trojan prowls cyberspace (30 December 2005)
http://www.theregister.co.uk/2005/12/30/google_adsense_trojan/
Google DNS glitch sparks hacking fears (9 May 2005)
http://www.theregister.co.uk/2005/05/09/google_dns_glitch/