A new Trojan that hijacks Google text ads and replaces them with ads from a different provider has been picked up by BitDefender.The antivirus company has identified the threat as Trojan.Qhost.WU which modifies the infected computer's host file, a local storage for domain name/IP address mappings.
The infected machine's browser then reads advertisements from a server at the replacement address rather than from Google.
Trojan Will Hijack Google Ads [vnunet.com]
Would be interesting to find out what ads are running through that false IP, whether Google ads but for another account, or something else.
Perhaps this thread should be in Google Adsense not Google Adwords as it is the former which will be negatively affected to the great extent
I have to wonder how much Google loses in revenue given the fact that this stuff has been around for a while now. I also have to wonder what would happen if a mass infection really happened? All of Google revenue grinds to a halt? Would you be able to sell off stock fast enough before it tanked?
JAG
Anyone get a screen capture of the replacement ads? That would really put a bee in Google's bonnet!
p/g
And sue the living daylights out of the perpetrators!
Sue for what exactly? One persons virus is another persons tool. In my case I installed the toolbar that bypasses the ads and as far as I know I'm allowed to control what I see on my screen after it gets to me.
I do not agree with scumware, viruses and such that is installed without permission though. The folks who do that are indeed lower than whale crap.
JAG
It didn't cause any other problems that I noticed, it just replaced the Google ads with some others.
Avast 4 home edition didn't detect it at that time.
I started to check my browser when I saw on my own sites ads that I knew Google would not approve (vibrating errors kind of ads: "you won", "visitor number zzz", etc.).
Somebody probably became really rich with this smarty virus :)
Read my whole story here:
[forum.kaspersky.com...]
I tried everything, when someone in the kaspersky forum finally asked me to publish my host file and identified that it was the cause.
I even contacted google adsense, they confirmed I had a problem, said I was infected by "something" but didn't care much to investigate about it, although this type of bug could have cost them millions of dollars with lots of people seing other ads.
Brakkar
I even contacted google adsense, they confirmed I had a problem, said I was infected by "something" but didn't care much to investigate about it, although this type of bug could have cost them millions of dollars with lots of people seing other ads.
They'd lose much more if the public knew how much their revenue stream is at risk from something as simple as a kidde hack. Perhaps it was safer to ignore and not admit the severity then but maybe it'll be addressed soon.
If a major network, that understood this, picked this thread up today and put it on the evening news the stock might be worth half what it is right now.
JAG
I've been trying to find out the IP address or addresses it adds to the HOSTS file. Does anyone have more useful information about this as it would be good to block as a sysadmin. All we're told is that it starts with a 9.
I'm assuming the IP shouldn't be posted publicly in the forum, so I sent you a sticky with some info.
You can find the IP in my message over at the kaspersky forum.
