Trojan bumps Google ads from Web pages

A Trojan horse program is infecting PCs that replaces Google text advertisements on Web pages with its own, depriving Google of revenue.

A security company has identified a Trojan horse program that replaces Google text advertisements on Web pages with ads from another source, depriving Google of revenue and potentially causing problems for end users.

Google may be powerless to stop the trick since it involves the modification of an internal PC file, called the hosts file, that is used to match domain names of Web sites with IP (Internet protocol) addresses, said Romanian security company BitDefender.

When a person visits a Web site, the browser checks the hosts file to see if it has an IP address for a particular domain name. If the hosts file is corrupted or hijacked, the browser can be directed to fetch a different Web page than the one the user intended to.

Modifying the hosts file can be done for legitimate reasons. For example, PC users can change the hosts to block banner ads served from known ad networks. When a Web page tries to contact an ad server, the request is diverted by the hosts file and no ad appears.

BitDefender said in an advisory this particular malware directs a browser to download advertisements from a different server than Google's ad server.

BitDefender named the malware Trojan.Qhost.WU and said it is not spreading fast and poses a "medium" risk of damage. It did not say how the Trojan is being circulated, and company representatives did not return a call for comment.

Besides costing Google ad revenue, there is a danger that those replacement advertisements could contain links to sites with malicious software, BitDefender said. Web site owners who buy ads through Google, as well as Google itself, can lose out on both Web traffic and revenue if people are diverted from its ads.

There is not much that Google can do for those who download the malware. However, security products such as BitDefender's can detect and remove it.

Without commenting on the Trojan specifically, Google said it removes Web sites from its search index that contain malware.

"We have canceled customer accounts that display ads re-directing users to malicious sites or that advertise a product violating our software principles," the company said in a statement.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Bang and Olufsen Beosound Stage - Dolby Atmos Soundbar

Learn more >

Toys for Boys

ASUS ROG, ACRONYM partner for Special Edition Zephyrus G14

Learn more >

Sony WF-1000XM3 Wireless Noise Cancelling Headphones

Learn more >

Nakamichi Delta 100 3-Way Hi Fi Speaker System

Learn more >

Family Friendly

Philips Sonicare Diamond Clean 9000 Toothbrush

Learn more >

Mario Kart Live: Home Circuit for Nintendo Switch

Learn more >

Stocking Stuffer

Teac 7 inch Swivel Screen Portable DVD Player

Learn more >

SunnyBunny Snowflakes 20 LED Solar Powered Fairy String

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?