Adware called PremiumSearch is redirecting Google, Yahoo
and MSN users to spoofed searched engines in an attempt to raise
cash from their site visits, according to security software company
Panda.
Panda says the adware installs a fake Google toolbar on the
user’s machine and sets the victim's browser home page to the
PremiumSearch search engine, regardless of the setting displayed in
the browser.
The adware also uses a DNS poisoning technique to rewrite the
Hosts file on the infected user’s computer to redirect requests for
Google.com, MSN.com and Yahoo.com to an IP address hosting spoofed
versions of these search engines.
Panda says users' machines become infected with the adware if
they are redirected to a web page after visiting pirate software or
porn sites.
Panda said the spoofed search engines were probably being hosted
by infected bot computers without their owners’ knowledge.
