Google search hijacked

The machines we love to hate

Moderator: Wiz Feinberg

winston
Posts: 1488
Joined: 4 Aug 1998 11:00 pm
Location: Frankfort, Kentucky 40601
State/Province: Kentucky
Country: United States

Google search hijacked

Post by winston »

My google search has been hijacked. It redirects the search hits to where ever it wants to. I have ran Malwarebytes and AVG with no luck. I cannot research the problem as the search is redirected. I have tried changing search engines with the same results. I am running XP Pro. I have had hijack problems before but cannot remember how I corrected it. Will the Restore back do anything? thanks Winston May
User avatar
Allan Jirik
Posts: 391
Joined: 16 Feb 2010 3:45 pm
Location: Wichita Falls TX
State/Province: -
Country: United States

Post by Allan Jirik »

I was just heading over here to ask the same question. It happens on Yahoo also. None of my security software recognizes the problem. It is REALLY annoying, I'd like to strangle the morons who set that up. What can be done, help!!!
Mitch Drumm
Posts: 2663
Joined: 4 Aug 1998 11:00 pm
Location: Frostbite Falls, hard by Veronica Lake
State/Province: -
Country: United States

Post by Mitch Drumm »

Can you restart in safe mode and then get to Google or your favorite search engine and then research?

Look here for a discussion of hijacked Google searches:

http://www.bleepingcomputer.com/forums/topic338939.html

I'm thinking you might want to find and install "Hijack This", an application designed to sniff this stuff out.

There may be a quicker fix such as System Restore, if you have an old enough restore point available.

You should be able to get into safe mode by pressing F8 when you restart.

Wiz will probably have more suggestions.

You can get Hijack This here:

http://download.cnet.com/Trend-Micro-Hi ... 27353.html
User avatar
Wiz Feinberg
Posts: 6117
Joined: 8 Jan 1999 1:01 am
Location: Mid-Michigan, USA
State/Province: Michigan
Country: United States

Post by Wiz Feinberg »

HijackThis is of no use to end users. It is meant to be used under the guidance of a trained malware removal expert. This forum is not a malware removal forum. If I see a HijackThis log posted here I will delete it.

I suggest you go to the Malwarebytes Malware Removal forum and sign up, then post a new topic about your search hijacking problem.

Alternately, go to the Bleeping Computer Malware Removal Forum, sign up and post your request.

Read the rules at the top of the forum pages before you post your request for help.

Do not post a request for help on more than one forum at a time. It is considered cross-posting and bad netiquette and may get you cut off. Some of the volunteers work on both forums.

DO NOT post any replies in anybody else's topics. Do not interject that you have the same problem. You absolutely must stay within your own topic, that you started.

Check back until somebody responds, then follow his or her advice, to the letter. Do not use your own initiative while under the care of the expert. Stay with the expert until the system has been proven to be cleaned.

Your solution will be unique for your computer. It may not work on anybody else's computer. You will be given a list of tools to download, in a particular sequence. You will be told when to open each one and what to do once they are opened. You will be required to post logs from these tools, so that the expert can analyze them and offer the next step in the removal process.

When you are through with the removal process, let us know what was found and which tools were required to carry on the fight.
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog
winston
Posts: 1488
Joined: 4 Aug 1998 11:00 pm
Location: Frankfort, Kentucky 40601
State/Province: Kentucky
Country: United States

Post by winston »

I went here, downloaded the program, ran it, it seems the hijacker is gone. thanks Winston

http://support.kaspersky.com/viruses/so ... =208280684