Slashdot Mirror
Google Warns Users About Active Malware Infection
dinscott writes "Google has begun notifying its users that a particular piece of malware is installed on their computers by showing a big yellow notification above their search results. The warning begun popping up yesterday, and does so only for users whose computers have been infected by a particular strain of malware that hijacks search results in order to drive users towards websites that use pay-per-click schemes."
The malware works by redirecting search queries through a proxy. It should be easy for the proxy to just remove the warning or reroute it so Google can't identify the malware.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Nothing seemed to detect it or get rid of it, so she ended up reinstalling the whole OS. It doesn't sound like a particularly new idea, redirecting search, but the proxy aspect might be I suppose.
I bet Malware authors are already copying these messages in order to trick people into installing scareware.
Flashback, man.
This is almost 100% the same as the last piece of malware I was asked to remove from three peoples' machines over the course of a couple of months.
It was such a pain in the butt because I spent an hour manually cleaning the registry while using a live CD, looking for the newest modified-time files on the machine, looking for installed "Oh-I'm-so-cool" applications, browser extensions, system libs, etc etc etc.....
In the end, I find out that it was cleaned off after my first registry run key deletion session, but the damn proxy was set in both Mozilla and IE to a remote IP. Now, Proxy is one of the first things I check with there's ad-based or redirectional malware reported.
What's next?
I have to say this may be the arrogant fuck up that makes us look at blocking Google completely.
No, you're wrong. You will be the arrogant fuck up that blocks Google from your 'users.'
Just sayin'.
I got a virus when I was in France and it took three shots of penicillin to clean one that up.
Now that I think about it, the girl who gave me the virus had hairier than average legs, so she might have been Italian... I'm not saying she had hairy legs, but she had dandruff on her shoes.
You are welcome on my lawn.
What in the heck does this complaint you have about Google have to do with the issue at hand?
Google opted to notify people when requests to them are coming from a malware-based proxy server as a nice tip to let people know when they should check their machine out.
They're not selling anything, they're not pushing you toward anything. They're just notifying you that something known-to-be-bad is happening.
Clicking on the message to close it (clicking at all) is usually going to deliver the same payload as clicking "OK" --- them being simple image links to sites that will install something via an exploit, hell even seeing the fake warning could mean you're already infected (this stuff gets injected into pages via compromised ad providers, they can just as well embed a pdf/flash zero day and skip the 'clicking' step entirely).
What in the heck does this complaint you have about Google have to do with the issue at hand?
That currently the Malware creators use very similar tactics to infect users (Popups advising the user is infected, Pages that look exactly like a Windows desktop with an infection popup etc). Users are told to close anything saying they have an infection for this reason.
That they didn't ask anyone if they even wanted this new "feature" like all the feature's they force down people throats (Preview, iGoogle Sidebar etc).
The message we try to give to users is close it, if you're not comfortable then call us (we do helpdesk support) and we'll jump on remotely and check for any infection.
Yes you're right, they're are plenty of times an infection can't be avoided, but there are time when it can be simply by hitting the X in the top right corner.
Shared PCs used by Nurses (We support primarily aged care computer systems) to enter data into whatever software or browser based solution the customer use. There's definitely a need for control of what software is installed. But due to other users that require more access (Lifestyle, Managers) and a few lazy customers that refuse to move to individual accounts we have to basically allow most content through and block installation of any software (Yes we should be using a solution like SteadyState or DeepFreeze but that hasn't happened for various reasons) using policy.
You think viruses can be eradicated with antibiotics. That explains a lot about the quality of your posts.
Gamingmuseum.com: Give your 3D accelerator a rest.
What I'm not talking about is what's the better browser. I use Chrome half the time, I love it. But for a corporate environment with many users sharing PCs and you require management of hundred's of PCs you use IE.
I picked up that strain on my desktop PC Friday night. Weirdest thing. It started out by popping up a window (that I thought was Windows Defender) indicating I had a trojan. Might have even have been from Defender, it would close right away... Anyway, I started with safe-mode boot, Ad-Aware and Spybot, no dice. I ended up installing Norton Network Security, and it couldn't find it. I had to run Norton Power Eraser. Crazy. A commercial virus scanner that can't find viruses.
It installs itself in the MBR as a root kit, the proxy may even be local on the pc, downloaded on start-up.
Ahhhh... Poor notification. Gotcha.
First thing that hits me is:
1. If you don't tell the proxy malware asses about it, people will get a nifty notification and it will open the eyes of a few not-so-smart ones.
2. If you DO tell people you're doing it, the proxy malware idiots will craft new malware and work around it using new IPs -or- just come up with a new method.
In the end, it's better that Google do nothing and let nature run its course on this. It will anyway. :)
Well playing devil's advocate here, you could be infected by a lesser payload. Say a virus is in 2 parts, 1. weak part that installs at user level, with user access rights, installs itself simply by loading an infected page etc... but lacks the ability to take admin rights on a system, Part 2. Master rootkit, requires user to grant admin rights for it to get in and dig deep. even with no admin rights, part 1 still has the power to run your browser through a proxy, and inject itself onto webpages as well as block filter and control what pages you go to. In other words part 1 could inject an advertisement onto the version of google you see, give you a link to a "trusted" provider, even make that "trusted" provider show up as norton, microsoft, google or whatever they feel like in the address bar for you, and 95% of users would give whatever program they are getting admin rights to install.
Simply don't return any valid URLs in the results if Google detects a poison proxy.
Even better, have all the URLs be http://www.microsoft.com/security/default.aspx or even better http://en.wikipedia.org/wiki/Linux or to be slightly evil^H^H^H^H self-serving http://www.google.com/chromebook/ .
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I knew there had to be some explanation.
So, does that mean that gonorrhea is not caused by a virus? Or is it syphilis? Gee, the things you learn on Slashdot. Amazing the level of sexual knowledge among a segment of the population that has only had sex with plush wookie dolls.
You are welcome on my lawn.
When I click on a Google search result I usually don't get there anymore, and my antivirus software (malware bytes) reports that it blocked an outgoing request to a website and gives the IP address. Sometimes I'm redirected without malwarebytes blocking the request and end up in another search engine. Once it was Bing!
Malwarebytes can't seem to remove WTF is going on. Oh and I don't get a Google popup either.
The whole point is that the proxy removes Google's results entirely.
A link to a tool or instructions on how to remove the darn thing! I have been hit by some form of google re-direct twice and the last time I just gave up an re-formatted the hard-drive (it was due for a clean Windowz install anyway).
Easy administration
Deploy Chrome across your organization using the MSI installer. Control updates and customize your Chrome deployment with support for managed group policy and authentication protocols.
When you find yourself in a hole, first you must stop digging. BTW... I'm married.
Gamingmuseum.com: Give your 3D accelerator a rest.