::Trend Micro Threat Resource Center::

16 February 2010

Various Olympics Related Dangerous Google Searches

2010 marks the year for Winter Olympics @ Vancouver. We have received reports about the (sadly expected by now) search engine poisoning for various Olympics related terms.

For example the name of the killed Georgian luge athlete is used to redirect unsuspecting users to fake anti virus and other malicious content. The redirect is browser dependent. Firefox is usually redirected to "qooglesearch.com" (note the 'q' as first letter instead of a 'g').

It is probably advisable to watch out for DNS requests for this domain to spot possible infections. Internet explorer is redirected to a wide range of different domains which apparently are picked at random.

Take a look at the following video to gain a better understanding how the attack works: