Google expunges malware sites from search results

Not that it's admitting there was ever a problem, mind you

Google has purged its index of the thousands of malware sites that wormed their way into results lists for hundreds of legitimate search phrases, researchers confirmed Wednesday.

"They look gone to us," said Alex Eckelberry, the CEO of Sunbelt Software Distribution, the company that broke the news Monday of a massive, coordinated campaign by attackers to spread malware through search results on Google, Yahoo, Microsoft Live Search and other sites.

"Google did confirm yesterday with us that they were working the case, and they are good about nailing this stuff," Eckelberry added in an e-mail late Wednesday afternoon. Sunbelt had notified Google of its findings on Monday.

Earlier Wednesday, Sunbelt malware researcher Adam Thomas said his spot searches on Google the night before had come up sans malware URLs. "They appeared to be zapped," Thomas had said.

Ironically, Google itself refused to confirm or deny that it had cleansed its index of the more than 40,000 malware hosting sites, or even that they had existed. "Google takes the security of our users very seriously, especially when it comes to malware," a company spokeswoman said Wednesday in an e-mail. "In our search results, we try to warn users of potentially dangerous sites when we know of them. Sites that clearly exploit browser security holes to install software, such as malware, spyware, viruses, adware and Trojan horses, are in violation of the Google quality guidelines and may be removed from Google's index."

She did not, however, answer questions about how long it takes Google to purge its search index or whether it has countermeasures that are supposed to keep sites from gaming its ranking system. According to Thomas, the group who created and stocked the sites with Trojan horses, rootkits and password-stealers drove up those sites' search-result rankings by spamming blogs and site-comment sections with their links.

Microsoft Corp., meanwhile, would only say that it was on the case. "We are aware of the issues and are working to rectify the situation," said Justin Osmer, a senior product manager for Live Search, in an e-mail sent by the company's public relations firm.

Yahoo Inc. did not respond to a similar request for comment Wednesday.

Sunbelt first noticed the huge number of infected sites, and their appearance in results lists for a bewildering array of searches, on Sunday. Thomas explained how the attackers managed to beat the search system. "For months now, our research team has monitored a network of bots whose sole purpose is to post spam links and relevant keywords into online forms, typically comment forms and bulletin board forums," he said. "This network, combined with thousands of pages such as the two seen above, have given the attackers very good, if not top, search-engine position for various search terms." Among the hundreds of search terms he had spotted being used were "infinity" and "hospice."

"Pretty sick," Thomas said.

Users with PCs not completely up-to-date on their patches, he continued, were attacked by what Sunbelt has dubbed "Scam.Iwin," which turns the compromised computer into a pay-per-click zombie that generates revenue for the attacker. "Scam.Iwin is also used to load malware for other groups," claimed Thomas. "In this case, one of those malware groups is known to have been associated with the infamous RBN [Russian Business Network]."

Join the PC World newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?