Google ads attacked by trojan virus

Google Ads were recently attacked by a Trojan which would replace the Google Ad with an ad from a different provider. BitDefender said in a statement ” ADVERTISEMENTS placed by Google in web pages are being hijacked by trojan software that replaces the intended text with ads from a different provider ”

The threat, which is identified by BitDefender as Trojan.Qhost.WU, modifies the infected computers’ Hosts file (a local storage for domain name / IP address mappings, which is consulted before domain name servers and is considered authoritative).

The modified file contains a line redirecting the host “page2.googlesyndication.com” which should point to an IP of the form 6x.xxx.xxx.xxx to a different address, of the form 9x.xxx.xxx.xxx, so that the infected machines’ browsers read ads from server at the replacement address rather than from Google.

“This is a serious situation that damages users and webmasters alike,” said Attila-Mihaly Balazs, a BitDefender virus analyst. “Users are affected because the advertisements and/or the linked sites may contain malicious code, which is a very likely situation, given that they are promoted using malware in the first place. Webmasters are affected because the trojan takes away viewers and thus a possible money source from their websites.”

BitDefender’s website describes the trojan, which it identifies as Trojan.Qhost.WU, as spreading at a “low” level and causing “medium” damage.