More on the massive SEO poisoning -- it was targeted at Google. And it was more crafty than we thought.

As a follow-up to our recent posts, here�s some additional information.

First, we can ring the all-clear bell. Google took action on these domains and you won�t find them anymore in Google.

However, check out this javascript:

(source: cxsjrkelgvjs(dot)cn/gopnikovnet(dot)js << malware site)

So. if you use search terms like �inurl� and �site�, you won�t see these malware pages in your results. Clever, since that�s one way for malware researchers to find stuff (I recently wrote an article on this subject for VirusBulletin). And, it only cares if you�re coming from Google.

Quite interesting.

Alex Eckelberry
(Thanks to Sunbelt researchers Adam Thomas and Francesco Benedini)