NWA-PCUG Newsletter Article, December 2012
The Google Redirect Virus
By Penny Cano,
member and instructor for the Dumb & Dumber Workshops,
Cajun Clickers Computer Club, LA July 2012 issue,
Cajun Clickers Computer News


ccnewsletter (at) cox.net (click to email author)

You search Google for something that interests you and get a series of Google web pages with links to websites with pertinent information. But this time, no matter which link you click on, it takes you to a website selling something that has absolutely nothing to do with the topic of your search. Suspecting something, you do a full scan with your virus program and don't find any infection. Then you may try some of the other malware-removal programs like Malwarebytes, Spybot, or SuperAntiSpyware; they don't find anything either. But you know something is wrong. I ran into this when one of our club members became infected and came to me seeking help. Since most of us use Google search with some frequency, I thought it a good time to discuss how this Trojan and other similar Trojans work.

Incentive for Infection
Some of the other names for this Trojan are Bac-door.Tidserv, Win32.TDSS, and Alureon. It’s not new; it was first discovered in 2008 and additional variations have been created since then. Its purpose is primarily profit-making. The person or enterprise that infects your computer actually gets paid for doing so. To go undetected, it hides itself using stealth techniques, including a rootkit. Once it is on the computer, it installs itself where it cannot be detected, then deletes the original files to eliminate traces of itself. The payload then causes the user to be redirected to web sites associated with malicious schemes or ones that download and install software that is not needed or wanted. So the infector gets a kickback for each user that succumbs.

How You Get Infected
Social networking opens up a myriad of opportunities for these attackers. It can be spread by means of the KoobFace Trojan specific to FaceBook. Forums and Blogs are another source. A typical scenario involves some sensational topic with an associated link to what appears to be a video or pictures. When the user clicks one of these links, the attacker has the opportunity to deliver the infection. The same attacker may place these links on many sites on the Web. Links in e-mail provide another opportunity. When people see something they think is funny or interesting on the Internet, they feel compelled to forward the website or link to all their friends. This in turn gets forwarded and re-search forwarded. You may not know the original sender or many of the other people it was sent to. (Of course you've never received these – right?). And then there's spam with all sorts of links. If the link points to an infected site, the infection gets spread to anyone clicking on it.

Peer-to-Peer networking for the downloading of pirated software (music, movies, and programs) and shared files is another source of infection. The supplier of the illegal software (or files) is often anonymous. Who's to say the name of the malware file was not changed to that of a popular song, for example. When the pirated “song” is downloaded the user is really downloading the Trojan. It is much safer to pay for legitimate content.

Hacked websites can actually be legitimate or well-known sites that have malicious software unknowingly installed on them. Web forms are particularly vulnerable if the system they are on is not properly secured. Those crazy looking letters that you are asked to type into the box below (don't you just hate them?) are a security measure to keep attackers from gaining access to the forms.

Avoiding Infection
Be careful about clicking on links on Web sites and in e-mail. Sometimes, if you pause your cursor on a link, you can see where the link actually leads. Be cautious clicking on links in e-mail, particularly spam and those that have been forwarded multiple times to multiple people. Some virus programs have link-checking as a built-in function and rate links on Web pages. This is particularly useful when following search engine results. If advertisements occur in pop-ups, do not click on them or follow the links they offer. Buy your downloaded software from known sources. Pirated software is often booby-trapped with malware. Keep your Windows Operating System up-to-date. Windows Update provides patches that can lessen the risk of the system being compromised.

I found three removal tools online: * Symantec: go to http://symantec.com/security_response and search the site for “Tidserv”
* Kaspersky provides TDSSKiller.exe http://bit.ly/h4FjC8
* McAfee offers Stinger.exe http://bit.ly/dJTzpJ

However, since this Trojan hides in areas outside the operating system and makes itself undetectable by normal means, I highly recommend that you take your computer to someone familiar with its removal if you experience these symptoms.

Click here to return to top