Worm creates fake Google site

[news=http://img338.imageshack.us/img338/3187/google7yk.gif]A worm that modifies a user's HOSTS file to redirect visitors of Google.com to a spoof website has been discovered. The worm was found by Panda Labs and is currently circulating on P2P networks Shareaza and Imesh. It is masquerading as an executable of popular Star Wars game Knights Of The Old Republic 2.

If infected, several Google domain names will be redirected to an unofficial German version of the search engine. Although the site looks identical to the original, the results have been modified in such a way that certain companies will gain an unfair higher ranking, and therefore will appear at the top of search results.

Luis Corrons, director of Panda Labs said: "Its aims are to increase visits to the pages linked by the creator of this malware, or to earn an income from companies that want to appear in the first few results in computer where the identity of Google has been spoofed. In both cases, the motivation of the author of this malware is purely financial."

:source: Source: vnunet.com[/news]

gosh.

i even have my homepage as google :lol:

Quote:

---

Originally Posted by oxygenuk

gosh.

i even have my homepage as google :lol:

---

:P

Well,

How to make sure your Hosts file hasn't been hijacked

Open the file c:\windows\system32\drivers\etc\hosts (no file extension)
Search through the file to find google.com or other google entries
If there are any post what the line with it says, and also remove the entry (unless you added it yourself, then there's no problems :P).

How to prevent the Hosts file from being hijacked

Go to c:\windows\system32\drivers\etc\
Right click the file called hosts (no file extension)
Set to 'read only' and click OK