Hijacked Google SERPs

[activeco]

Recently, I noticed some strange Google results on one of my Windows machines.
All of them carry some big name URL and titles such as Yahoo, Metacrawler, ebay, Cnet, Altavista, etc.

They looked very genuine, but knowing that they couldn't belong there I checked the link properties and sure, they all pointed to the same (range) IP #s.
I have tried the same searches on Linux machines (Mozilla) in the same (small) network, even on one with G Toolbar installed and couldn't find anything suspicious.

I guess it is a kind of virus on that particular PC, but there is a slight chance that some part of outside network and maybe even Google could be infected.
Not sure if toolbar has something to do with this.

Does anyone know anything more about this or at least see same parasitic results?

[cbp]

You downloaded some spyware/adware

Run:
Adaware
Spybot
CWShredder

They should get it.

CBP

[activeco]

Originally Posted by cbp

You downloaded some spyware/adware

Probably, despite all the measures. I'll have to deal with it tommorow.
Note that the "implanted" result never comes as first, it is always below third position and even not always there.
Someone made it very clever, I would have never noticed it if the link(s) belonged to some ordinary names.

[timcrafton]

Yep, I had this exact same issue, the whole first page of results on gooogle were rubbish... Ad-Aware fixed it for me! Pretty clever ad-ware I must admit! BTW, I switched to Mozilla Firefox after this, I only use IE for chekcing my Google PR.

[wednesday]

Originally Posted by timcrafton

I only use IE for chekcing my Google PR.

http://pagerankstatus.mozdev.org/

[timcrafton]

Originally Posted by mar's

http://pagerankstatus.mozdev.org/

Very Nice! I was not aware of that plug-in.
Thx for the nfo...

[DrTandem1]

I agree, you have spyware on your computer. I have not had any problems with IE and spyware, however, I am very quick to upload all of their service packs, have a firewall, McAfee anti-virus and AdAware.

I also have Firefox, but as most view sites with IE, you still need it. There is nothing magic about Firefox and spyware. It is simply that most use IE, so it is exploited more often. If Firefox was more popular, it too would be under attack.

[google junky]

Originally Posted by DrTandem1

I also have Firefox, but as most view sites with IE, you still need it. There is nothing magic about Firefox and spyware. It is simply that most use IE, so it is exploited more often. If Firefox was more popular, it too would be under attack.

How often do you hear of Netscape having troubles like Internet Explorere does? Firefox is pretty much the same browser Netscape is. I doubt very much any real threat will happen to Firefox. Firefox is ver popular lately and driving people away from IE.

[mikmik]

I doubt very much any real threat will happen to Firefox. Firefox is ver popular lately and driving people away from IE

That is very dangerous thinking. Dr. Tandem is 100% correct. IE has over 85% merket share, and I imagine it will be that way for quite a while.

Malware writers, who program the adware, get big money for reaching lots of people, and therefore target the most popular browsers and operating systems.

Firefox and Gecko based browsers have all sorts off vulnerabilities and holes, they have more alerts on Secuna for Mozilla than any others:
http://secunia.com/advisories/11978/...ated=1#related

Found: 85 Related Secunia Security Advisories

- KDE Konqueror Java Sandbox Security Bypass Vulnerabilities
- Opera Default Application "kfmclient exec" Security Issue
- Netscape Window Injection Vulnerability
- Konqueror FTP Command Injection Vulnerability
- Internet Explorer for Mac Window Injection Vulnerability
- Netscape PNG Image Handling Vulnerabilities
- Opera "sun.*" System Information Disclosure Weakness
- Konqueror Window Injection Vulnerability
- Opera Window Injection Vulnerability
- Safari Window Injection Vulnerability
- Mozilla Firefox Multiple Vulnerabilities
- Mozilla / Mozilla Firefox Window Injection Vulnerability
- Safari "Javascript Disabled" Status Bar Spoofing
- Opera Download Dialog Spoofing Vulnerability
- Mozilla / Firefox / Thunderbird Downloaded File Content Disclosure Vulnerability

That would be their last 15 advisories.