Google has purged its index of the thousands of malware sites that wormed their way into results lists for hundreds of legitimate search phrases, researchers confirmed Wednesday.

"They look gone to us," said Alex Eckelberry, the CEO of Sunbelt Software Distribution, the company that broke the news Monday of a massive, coordinated campaign by attackers to spread malware through search results on Google, Yahoo, Microsoft Live Search, and other sites.

"Google did confirm yesterday with us that they were working the case, and they are good about nailing this stuff," Eckelberry added in an e-mail late Wednesday afternoon. Sunbelt had notified Google of its findings on Monday.

Earlier Wednesday, Sunbelt malware researcher Adam Thomas said his spot searches on Google the night before had come up sans malware URLs. "They appeared to be zapped," Thomas had said.

Ironically, Google itself refused to confirm or deny that it had cleansed its index of the more than 40,000 malware hosting sites, or even that they had existed.

"Google takes the security of our users very seriously, especially when it comes to malware," a company spokeswoman said Wednesday in an e-mail. "In our search results, we try to warn users of potentially dangerous sites when we know of them. Sites that clearly exploit browser security holes to install software, such as malware, spyware, viruses, adware and Trojan horses, are in violation of the Google quality guidelines and may be removed from Google's index."

She did not, however, answer questions about how long it takes Google to purge its search index or whether it has countermeasures that are supposed to keep sites from gaming its ranking system. According to Thomas, the group who created and stocked the sites with Trojan horses, rootkits, and password-stealers drove up those sites' search-result rankings by spamming blogs and site-comment sections with their links.