Uhhh... I've seen this for a *long* time - Months and months back at least...

Like you, I verified that it was sending back fake results, but in my case, I just did a search for "gfgdgfdgfds" and got gfgdgfdgfds.exe as a result.

My worry now is that push requests (to firewalled hosts) might be intercepted and responded too. Check the file sizes on any exe's you download, and always virus scan them, and always run them first on a test machine you don't mind trashing/re-ghosting.