Trojan bumps Google ads from Web pages
A security company has identified a Trojan horse program that replaces Google
text advertisements on Web pages with ads from another source, depriving Google
of revenue and potentially causing problems for end users.
Google may be powerless to stop the trick since it involves the modification
of an internal PC file, called the hosts file, that is used to match domain
names of Web sites with IP (Internet protocol) addresses, said Romanian security
company BitDefender.
When a person visits a Web site, the browser checks the hosts file to see if
it has an IP address for a particular domain name. If the hosts file is corrupted
or hijacked, the browser can be directed to fetch a different Web page than
the one the user intended to.
Modifying the hosts file can be done for legitimate reasons. For example, PC
users can change the hosts to block banner ads served from known ad networks.
When a Web page tries to contact an ad server, the request is diverted by the
hosts file and no ad appears.
BitDefender said in
an advisory this particular malware directs a browser to download advertisements
from a different server than Google's ad server.
BitDefender named the malware Trojan.Qhost.WU and said it is not spreading
fast and poses a "medium" risk of damage. It did not say how the Trojan
is being circulated, and company representatives did not return a call for comment.
Besides costing Google ad revenue, there is a danger that those replacement
advertisements could contain links to sites with malicious software, BitDefender
said. Web site owners who buy ads through Google, as well as Google itself,
can lose out on both Web traffic and revenue if people are diverted from its
ads.
There is not much that Google can do for those who download the malware. However,
security products such as BitDefender's can detect and remove it.
Without commenting on the Trojan specifically, Google said it removes Web sites
from its search index that contain malware.
"We have canceled customer accounts that display ads re-directing users
to malicious sites or that advertise a product violating our software principles,"
the company said in a statement.
IDG News Service
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
