Google's search engine has started warning users that they've
installed certain malware. "Your computer appears to be
infected," a banner will proclaim across the top of every Google
search whenever the malware is detected. Clicking a link in the
banner leads to instructions on how to find an appropriate anti-
virus program to remove the software. The malware that Google is
detecting routes certain Web requests through proxy servers
controlled by the criminals behind the malware. Any search made
through one of these proxies will receive the warning message.
Use of the proxies is generally transparent to users; typically,
the malware modifies the user's hosts file. The hosts file is
used to map domain names to IP addresses, so that domain names
can be looked up without having to use a DNS server. It's likely
that the malware authors will respond to this measure soon
enough, however. The malicious proxy servers are already used to
rewriting pages to include ads and interfere with access to
anti-virus software; t