Who has hijacked Google?

December 25, 2003 | Me

[Bon mots]

Who has hijacked Google? Is it just my browser, or has someone managed to sneak malicious code into Google's servers?

When using Google recently, I've noticed that I don't get immediately directed to the proper URLs when I click on them. Instead, I am directed (at random intervals ranging from the 4th to the 8th click), to some idiotic rival's search engine page where I am offered breast enlargement pills and other such nonsense. This is a huge waste of my time, and I'm sure that others have also been affected by this virus which has clear commercial intent.

I am suspicious that malicious code has somehow been inserted into my machine (my wife and kids are allowed to use this notebook).

For example:
Today, I was looking up information on Hammurabi and his code of laws. I found this result on Google: http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=hammurabi

When I clicked on the second entry, I got hijacked and redirected here: http://www.umaxsearch.com/search.php?aid=14&q=hammurabi&r=14905
or
Here: http://www.coolwebsearch.com/search.php?aff=4472&qq=hammurabi&r=30929

Repeatedly clicking on the same link, demonstrated the fact that at random intervals, my clicks on links at Google are redirected to these clowns.

I will have to install SpyBot Search & Destroy on this machine to see if it finds something, however I'm curious if many of you have also seen this bug? Any ideas? Solutions?

[Bon mots]

Thanks for any help.

[sigSEGV]

Sounds like you have Qhosts.

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html

Make sure you download patches when they come out. Even if you kept your browser up to date, there was a period of about 2 weeks where Microsoft didn't have a patch and people were getting infected. I would use another browser like Mozilla.

[Brett66]

You have spyware, this will clean it off:

Ad-aware

Spybot

[InterceptPoint]

Run Spybot and that should fix it. If I click on the second entry (The Code of Hammurabi) I get the correct website so it is nothing that Google is doing.

[Kurt Nicklas]

Forget this clown. He simply wants you to click on the search engine links so he can make a little crazy money. What a pathetic fool.

[DB]

I'd guess you managed to install some spyware on your computer.

You need to check your computer using one of the many spyware removal tools available.

[ovrtaxt]

Try housecall.trendmicro.com . They have a free scan called House Call. It will find stuff if you have it. All they ask you is what country you are scanning from, and I think that's optional.

[Brett66]

And using the Mozilla browser is a good way to prevent this nonsense in the future.

Mozilla

[Restorer]

Had same problem. Purchased McAfee anti-virus software. Fixed it right away. Also discovered I had two other apparently non-virulent viruses.

[TheBattman]

I tried the same said links - and did not get re-directed.

I have noticed when I use a Windows based machine that I often don't get the pages/links I expect. Quite often, Internet Explorer gives up too quickly and redirects to msn search.

Now, in your case, the only thing I can figure is that in fact, you do have some sort of spyware or adware....

Either that or my old addage that "Windows Sucks" is just true...

MacOS X....my friend.

[HighWheeler]

Someone has been doing the job on Google. I was looking up JFK, Kennedy assasination, etc, on Google, and the 9 of the top three results did similar things.

Look at the address in the result to see where it is going.

If the site name is strange, don't go there.

these bazturds are so clever that even using the "cached" version to spy around the corner doesn't get past these link and pop-ups.

I clear my spyware out several times per day, which BTW is in your cookies file. to get there from MS Explorer, go to Tools ---> Internet Options ---> and halfway down or so Delete Cookies.

[Bon mots]

You have spyware, this will clean it off:

Thanks. No cigar. Ran Spybot and was checking the link again, still gets hijacked. I'm installing the windows updates now... but I'll have to put in an anti-virus.

I just reconfigured this notebook for browsing at home, but once my wife and kids find it, anything can happen. They are under strict instructions not to ever install anything, but for some bugs, it's enough to visit a site... especially a gaming site.

Spybot did find a lot of other things that I removed though.

[umgud]

My daughter's pc was attacked two days ago. Here is the result; I type a url and hit go....up pops hugesearch.net. No matter what url I type, it takes me to the same place. I can use this search engine to find a site, but have to open that site thru the hugesearch.net window. It even lodged itself as my homepage, which I fixed, but am still directed to this site. I can get directly to a url thru favorites. This thing is insidious and I want it gone.

I want to squeeze the life out of the jerk(s) who write the programs that do this.

[HighWheeler]

Thats the one!

all the links have either "www.fortunecity.com" or a new one I found being "www.focusonmexico.com" on the redirected links.

bazturds should fry.

[Brett66]

If your home page is being reset, then you have a browser hijacker and ad-aware and spybot don't see these. You can download this and run a scan to see what's on your system:

hijackthis

[Brett66]

Here's a great forum that can guide you through your problems. Browser hijackers are the most insidious of all of these scumware programs. They're difficult to track down sometimes and they put an executable in you system folder that will reset your browser everytime you reboot. You have to scan your system and delete the executables.

Spyware info support forum

[Jeff Chandler]

This is probably unrelated, but Google reconfigured its algorithms in November, creating great consternation among search engine optimization experts.

[demlosers]

I've had more than a few hijacking redirects on my system:

If running Adaware or Spybot ect.. and they do not find the the Trojan, do this:

1) press CTRL ALT DELETE keys simultanously to bring up Windows Task Manager and select Task Manager.
2) Click the 'processes' tab.
3)Now, examine the 'Image Name'(s) [processes] that are running in the background. Check each process to see if they are legit.
4) When you find the Trojan, do a search by name so you can delete it from your system.
5) Right click the trojan process and select 'End Process' You'll get a warning saying ending the process may bring down your system - ignore it...if you are sure it's the trojan.

There maybe 20 to 30 processes running on your system. If you are unsure what the process does use 'Google' to find out.

[Bon mots]

Thanks for your advice Brett, but it didn't work on the beast infecting my machine. I did, however find a cure. Strangely enough it came from Umax... one of the parties I assumed was guilty. They responded and gave me a link to a cure. It seems they pay people for links, and some of these people have thought up sneaky tricks to get paid more...

Here is what they wrote to me:

It looks like you got exploited IE settings.
Anything that was done to your computer was unrelated to us. 
We are a Search Engine company that buys traffic. 
However we know that some people try to exploit IE settings
and illegally get internet traffic that way. Just for the
reference - all these sites are free pornographic or warez sites.
Please notify us if that happened to you as soon as possible.
We strongly advice you to install latest patches for Windows 
and Internet Explorer along with antivirus software. 
Here is a script that will clean up your Internet Explorer settings.
http://www.umaxsearch.com/cleanIE.reg

Also try this script that was provided to disable this evil software:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip
alternative link:
http://216.180.252.218/~spywareinfo.com/downloads/tools/cwshredder.zip

UmaxSearch.com Support Team

Anyway, I tried the first solution they proposed... no cigar...
Then I tried the CW Shredder, and it worked like a charm! Hooray!! No more trouble with Google search.

My kids were looking for a serial number, and probably were scouting the warez sites... didn't see porn in the history... :-/ (darn kids!)

[Lazamataz]

You have a virus/trojan horse.