Google pulls nefarious sponsored links

Google has removed paid links that advertised seemingly legitimate websites but actually tried to install nefarious programs on PCs.

The links were displayed as "sponsored links" after visitors entered specific queries into Google's search service. Clicking the links would ultimately go to a legitimate site but by way of another site that attempted a "drive-by installation" of password-stealing software. Miscreants placed the links using Google's AdWords service for advertisers.

According to a company representative writing on a corporate blog: "Google identified and cancelled AdWords accounts displaying ads that redirected users to malicious sites."

The malicious links appeared after people searched for terms related to the Better Business Bureau and cars, according to Exploit Prevention Labs, a security company. All the paid-for links masqueraded as legitimate sites and redirected Google users to the actual sites after sending them to smarttrack.org, which served up the malicious code, Exploit Prevention Labs said.

Roger Thompson, CTO of Exploit Prevention Labs, added: "We detected about 20 different search strings that resulted in links to smarttrack.org. There were multiple ads linking to a single site, a high level of planning, and cunning by the bad guys."

Google is looking at its AdWords practices to prevent similar incidents in the future, the company said. "This is an issue we've taken very seriously and will continue to monitor," it said. "We are also evaluating our systems to ensure that the appropriate measures are in place to block future attempts."

Joris Evers writes for CNET News.com