New Worm Spoofs Google

The P2Load.A threat copies itself onto the shared directory of the P2P software as an executable file named after a Star Wars-themed video game, Knights of the Old Republic 2, and lures end users into launching the virus on their machines using a faked error message. Once the virus has been sprung, it immediately modifies the computer's start page, launches the adware and spoofs Google.

"Security researchers at Panda Software say they have discovered a new worm that generates a spoofed version of Google, the Web's most popular search engine.
The company's PandaLabs unit reported late Friday that it had identified a worm it has labeled as P2Load.A that creates a fake Google site, and launches adware on infected computers."

When a system infected with P2Load.A runs a query on the faked Google page, they are presented with results that closely mirror the links that the actual search engine would offer. However, the site presents different advertisements than the real Google search site, including links to the same companies being touted in the threat's malware element.

The virus' design could allow P2Load.A to be altered to spoof other Web pages, in that it modifies the Hosts file by replacing the original with a remote site download. Unlike attacks that merely look to cause trouble, the Google spoof is aimed directly at making money.

Its aims are none other than to increase visits to the pages linked by the creator of this malware or earn an income from companies that want to appear in the first few results in computer where the identity of Google has been spoofed: In both cases, the motivation of the author of this malware is purely financial.

New Worm Spoofs Google [via eWEEK]

Die Dulci Fruere