The Channel logo


By | John Leyden 21st December 2007 13:57

Ad hijacking Trojan targets Google

Misdirection ruse

Security researchers have identified a Trojan that hijacks Google text advertisements, replacing them with "ads" from a different provider that are likely to be laced with spyware.

The Qhost-WU modifies an infected computer's hosts file, thereby poisoning systems with bogus DNS lookup records. The hosts file matches domain names of websites with corresponding IP addresses. By corrupting the file hackers can redirect surfers to domains controlled by hackers even when users visit a trusted location.

In this case, the modified file contains a line redirecting the host "" from a server run by Google to an imposter, potentially depriving web masters of revenue while leaving infected punters in a pickle.

"This is a serious situation that damages users and webmasters alike," said Attila-Mihaly Balazs, a virus analyst at Romanian security firm BitDefender. "Users are affected because the advertisements or the linked sites may contain malicious code, which is a very likely situation, given that they are promoted using malware in the first place. Webmasters are affected because the Trojan takes away viewers and thus a possible money source from their websites."

Although damaging, the Qhost-WU Trojan hasn't spread particularly widely. BitDefender rates it as a medium risk pathogen.

Without commenting on Qhost-WU specifically, Google said it purges entries for sites containing malware from its search index. "We have cancelled customer accounts that display ads re-directing users to malicious sites or that advertise a product violating our software principles," the ad trafficking giant told Reuters. ®

comment icon Read 5 comments on this article alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


Suit-and-tie-wearing man tries to meditate, take deep breaths in faux yoga pose. Photo by Shutterstock
Emotional intelligence, not tech skills, is the way to woo suits
League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe