Trojan hijacks Google Ads

happygeek 0 261 Views

According to security researchers at BitDefender a new Trojan has been discovered which hijacks text based Google adverts and replaces them with ads from a totally different provider. Trojan.Qhost.WU acts by modifying the infected computers' Hosts file to include a line which redirects the web browser from the expected .googlesyndication.com IP address to another which ensures that the browser gets its ads served from a completely different place instead of Google.

"This is a serious situation that damages users and webmasters alike," said Attila-Mihaly Balazs, a BitDefender virus analyst. “Users are affected because the advertisements and/or the linked sites may contain malicious code, which is a very likely situation, given that they are promoted using malware in the first place. Webmasters are affected because the Trojan takes away viewers and thus a possible money source from their websites.”

Google has acted to cancel customer accounts that display ads which redirect users to malicious sites or which violate Google software principles within advertising, but this Trojan would seem to criminalise victims twice: they get the double whammy of serving up potentially malicious adverts and face being booted off of Google as a result.

A Google spokesperson has stated that it works hard to detects and remove sites which serve malware in the ad network, adding “we have manual and automated processes in place to detect and enforce these policies."

Dani AI

Generated

A concise follow-up to with practical next steps and recovery notes.

This family of “Qhost” detections works by changing the local hosts file so browsers fetch ad slots from attacker-controlled IPs instead of the real ad network — that both replaces publisher revenue and can expose visitors to malvertising. Publishers can be affected by Google policy enforcement if their pages or ads serve malicious content, so rapid cleanup matters. F-Secure analysis of Qhost variants · . (f-secure.com)

Quick detection checklist (Windows):

  • Open %WinDir%\System32\drivers\etc and view hosts with an editor run as Administrator.
  • Look for unfamiliar entries mapping ad-hostnames or Google/ads domains to odd IPs (non-Google addresses).
  • Backup the file before changing it. Microsoft documents how to reset hosts safely. How to reset the hosts file. (support.microsoft.com)

Immediate remediation (order matters):

  1. Run an up-to-date antimalware scan (Malwarebytes, your AV) and remove detected items — removing hosts entries without killing the trojan will let it reapply them.
  2. After removal, restore a minimal hosts file (keep at least 127.0.0.1 localhost and ::1 localhost) or follow Microsoft’s reset steps.
  3. Check for persistent autoruns, scheduled tasks, proxy settings, and rogue browser extensions; repeat scans in Safe Mode if needed. Malwarebytes Qhost guidance. (malwarebytes.com)

For site owners/publishers: confirm the problem is client-side (hosts edits) vs. server-side (site compromise or malvertising). If your site or ads were flagged, clean affected systems, then use Search Console / publisher policy tools to request a review and explain the cleanup actions you took. Google’s webmaster guidance on hacked/malicious content and remediation is the right next step. . (developers.google.com)

Short cautions: do not simply edit hosts on one machine and ignore other endpoints; attackers often re-infect via removable drives, shared admin credentials, or poisoned installers. Back up before edits and document the cleanup if you need to appeal to your ad network.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview