Hey, have any of you guys seen this email or know if there's anything to this "warning"?
------------
Beware How You Google
By Ryan Naraine
April 27, 2005

Updated: Security researchers warn that a one-letter typo in Google's
domain name could lead to a massive virus- and spyware-infection attack.

A simple misspelling of Google's domain name could lead to a Web surfer's
worst nightmare.

In a new twist to the old practice of "typosquatting," virus writers have
registered a slight variation of Google Inc.'s popular search-engine site
to take advantage of any users who botch the spelling of the google.com
URL. ADVERTISEMENT

The malicious site, googkle.com, is infested with Trojan droppers,
downloaders, backdoors and spyware, and an unsuspecting user only has to
visit the page to be at risk of computer hijack attacks, according to a
warning from Finnish anti-virus vendor F-Secure Corp.

When googkle.com is opened in a browser, two pop-up windows are immediately
launched with redirects to third-party sites loaded with scripts. One of
the sites, ntsearch.com, downloads and runs a "pop.chm" file, and the
other, toolbarpartner.com, downloads and runs a "ddfs.chm" file, F-Secure
said.

"Both files are downloaded using exploits and they contain exploits
themselves to run embedded executable files. One of the Web pages of the
'toolbarpartner.com' website downloads a file named 'pic10.jpg' using an
exploit. This JPG file is actually an executable that replaces [the]
Windows Media Player application," the warning reads.

eWEEK.com Special Report: Exploiting Google

PointerClick here to read about how Google dealt with the Santy worm.

The typosquatters also launch a steady stream of pop-up Web pages with
different .exe files.

One batch of exploits loads a malware package that includes two backdoors,
two Trojan droppers, a proxy Trojan, a spying Trojan and a Trojan
downloader.

eWEEK.com Special Report: Spyware

The exploits appear to be targeting users of Microsoft Corp.'s Internet
Explorer browser. A spokeswoman for Microsoft told Ziff Davis Internet News
that the rogue site was attempting to exploit some vulnerabilities that
were fixed in past security updates.

"[Users running] Windows XP SP2 are protected from this. Also, users who
are up to date on supported platforms are protected," the spokeswoman said.

PointerRead details here about recent "cloaking" accusations against
Google.

According to F-Secure's alert, the attack scenario also includes a separate
Trojan dropper that copies itself to the Windows System folder with a
random name and drops a DLL that modifies the HOSTS file to block
connection to several anti-virus Web sites.

Another executable also drops a DLL file into the Windows System folder and
prompts a fake virus alert on a desktop. The fake alert warns the user
about a computer infection and prompts the user to yet another malicious
site promising virus protection.

The Web site offers links to several different sites offering anti-virus
and spyware cleaners for download. Those downloads all turn out to be a
"toolbar.exe" file that is actually an adware installer, which installs a
spyware toolbar known as "Perez," F-Secure said.

The practice of typosquatting was first spotted in the late 1990s and was a
common tactic for pornography sites, used to generate traffic from
misspelled Internet addresses.

See Bedstor's post here.

Thanks, jusork -- it looks like this is a real McCoy!