Ryan Naraine
“A simple misspelling of Google's domain name could lead to a Web surfer's worst nightmare.
In a new twist to the old practice of "typosquatting," virus writers have registered a slight variation of Google Inc.'s popular search-engine site to take advantage of any users who botch the spelling of the google.com URL.
The malicious site, googkle.com, is infested with Trojan droppers, downloaders, backdoors and spyware, and an unsuspecting user only has to visit the page to be at risk of computer hijack attacks, according to a warning from Finnish anti-virus vendor F-Secure Corp.
When googkle.com is opened in a browser, two pop-up windows are immediately launched with redirects to third-party sites loaded with scripts. One of the sites, ntsearch.com, downloads and runs a "pop.chm" file, and the other, toolbarpartner.com, downloads and runs a "ddfs.chm" file, F-Secure said.
"Both files are downloaded using exploits and they contain exploits themselves to run embedded executable files. One of the Web pages of the 'toolbarpartner.com' website downloads a file named 'pic10.jpg' using an exploit. This JPG file is actually an executable that replaces [the] Windows Media Player application," the warning reads.
The typosquatters also launch a steady stream of pop-up Web pages with different .exe files.
One batch of exploits loads a malware package that includes two backdoors, two Trojan droppers, a proxy Trojan, a spying Trojan and a Trojan downloader.
The exploits appear to be targeting users of Microsoft Corp.'s Internet Explorer browser. A spokeswoman for Microsoft told Ziff Davis Internet News that the rogue site was attempting to exploit some vulnerabilities that were fixed in past security updates.
"[Users running] Windows XP SP2 are protected from this. Also, users who are up to date on supported platforms are protected," the spokeswoman said.…”
http://www.eweek.com/article2/0,1759,1790348,00.asp?kc=ewnws042805dtx1k0000599
Posts
