According to Computerworld, some malware distributors have acted in a concerted effort to get their sites to the top of seemingly harmless search results. By using bots to spam comments of blogs and even blogs themselves along with other methods, they have abused the pageranking systems utilized by many search engines, such as Google, Live Search, and Yahoo! Search. These pages, though seemingly harmless, may try to trick users into installing fake codecs. Others may not be so upfront about it, installing malware if the user so much as clicks on the page. Most of these attacks use more than one method.

Computerworld interviewed several employees of Sunbelt Software (a security software development company) including Alex Eckelberry, the CEO:

"This is huge," said Alex Eckelberry, Sunbelt Software‘s CEO. "So far we’ve found 27 different domains, each with up to 1,499 [malicious] pages. That’s 40,000 possible pages."

Another employee, malware researcher Adam Thomas identified the core of the threat to users:

"[The page’s IFRAME] is what’s doing the most damage," he said. "It’s loaded with every piece of malware you can think of, including fake toolbars, rogue software and scareware."

According to them, most of these rogue results will have odd URLs, which consist mostly of a jumble of characters attached to China’s .cn domain.

As is the case most of the time, users who keep their computers up to date are least likely to be affected. Additionally, using a modern web browser is a good idea where possible. Of course, when your first result for "dogs" is at lfieafhdksal.cn, it’s probably not a benevolent result.

Deep Thought’s Take: I was unable to reproduce the screenshots shown on the blog, so the threat may be on the downswing. That does not mean, however, that you shouldn’t keep your system up to date. There’s a reason why most update systems download automatically then bug you to install.