WebProNews

Another worm that modifies the hosts file redirects queries sent to Google, MSN, or Yahoo to spoofed versions of those pages.

Panda Software reports a new piece of adware called PremiumSearch exploits systems vulnerable to similar spyware threats. PremiumSearch installs a Browser Helper Object (BHO), and then places a fake Google toolbar on the system.

The BHO changes the users default home page, and modifies the hosts file to redirect search requests for Yahoo, Google, and MSN to spoofed versions. The first results displayed on those search pages will have been altered to funnel users to certain sites; the remaining results come from the actual search engine spoofed.

"These actions are financially motivated and aim to exploit the popularity of these search engines to increase visits to the pages with the altered results," explains Luis Corrons, director of PandaLabs, in the press release. Panda Software claims the web page delivering those spoofed pages is located in the United States.

The attack takes place when users visit certain web pages and are redirected to the malicious page. Panda states the site installs PremiumSearch and "also installs Application/WorldAntiSpy on victims' computers, along with a variant of Smitfraud, leading users to believe they have been infected by a series of threats and will have to pay to disinfect them."

David Utter is a staff writer for WebProNews covering technology and business. Email him here.