Google redirection problems

Whiteicewind

Dunno if this would have more success in G&T but i shall try in the correct forum first :P

Just got myself a shiny new computer from pcspecialists. Got in, set it all up and tis all shiny and running.

However, i've noticed that when i do a google search there's a good chance that when i click one of the search results i get redirected to a random website. If i go back and click it goes to the right webpage. (Disturbingly i have gotten redicrected to stripclick.com once when goggleing for trees (test search) :S)

I have barely done anything with the computer as of yet and am a little worried. Installed avg and spybot and done relevant searches which hasn't picked up anything. I am connected to the home network which has 3/4 other computers running on it.

Any idea what's causing this?


On a possibly related and disturbing note i noticed a while ago on my brother's computer that some adverts were particularly viagra related. MY other brother has noted that these are popping up on quite a few websites he visits. I can see them on my computer on gametrailers.com. What have i unleashed my poor pc onto?

TyrantCow

Whiteicewind wrote: »

However, i've noticed that when i do a google search there's a good chance that when i click one of the search results i get redirected to a random website. If i go back and click it goes to the right webpage.

I...

What...

Either you are not using google as you think you are; many times I've dealt with users who think they're putting an address in their browser's address bar, when in fact they're using some search bar that's been added to the browser (Yahoo! toolbar, etc.).

Or, either your router or computer has been owned; and every port 80 request is being redirected... which is quite unlikely if the sites you are getting are really random. If it takes you to the same site every time you try to surf, this may be an issue... still kinda far fetched. Are you "borrowing" WiFi from your "neighbors"? They could be redirecting your traffic through the router...

AtomBomb

There are plenty of viruses that will redirect your search results. My guess is that you have one.

Whiteicewind

I type 'www.google.com' into the web address bar.

Not 'borrowing' wifi from neighbours or anything similar. Using our own wired broadband connection.

An example: i type 'trees' into goole. The first reply is the wiki entry so i click it. I've noticed the address line changes from a google search to 'copy-book.com/tree' or something along those lines and i get redirected to http://www.1stcalltrees.com/.

Another thing, if i click back and click on the wiki search result it actually takes me there.

The redirect thing is pretty consistent now and i'm having to search, click a link, click back and click the link again.

Not every search comes back as something malicious though. It's really weird. I have no idea who copy-book are/is. :S

AtomBomb

What do you have for AV? My guess is that you have a browser redirect virus that is sending you to sites that pay the person who created the virus for ad referrals. These things can also be a pain in the ass because they will redirect you when you try to download AV software or run online scanners. You can download something on another computer (make sure to download updates as well) and try to run it. I have also seen ones that blacklist processes for most of the popular AV products. When that happens I usually just nuke it and start fresh.

1stcalltrees isn't even in the first 5 pages of google results for trees.

Fallingman

I'm an idiot - ignore

Whiteicewind

I have AVG. It works pretty well and has done a full scan only seeing a few tracking cookies.

vvildcard

An unprotected computer will get a virus within 14 minutes of being on the internet.


Don't remember where I heard it, but I wouldn't doubt if it's true.

Being behind a router helps dramatically... but there are still hundreds of threats out there just spamming themselves around, looking for unprotected victims.

What happens if you use Firefox or Opera?
Do you ever get redirected when typing a URL manually?
Or is it only from searching with Google?
What about searching from Yahoo? Microsoft? CNN?

Distram

Okay, I had the same problem.

Download:

AVG Free Antivirus
Spybot Search & Destroy
AdAware
The Crap Cleaner
HijackThis

Update them all. Run them all.

I don't have an exact walk through of how to use HijackThis but it boils down to giving you the ability to find and destroy hidden processes.

There is another program that helped me get rid of this problem but I have to find the name. I will post again when I find it.

Now, if you're still getting redirected AFTER you've run all this stuff then get a plug-in for Firefox called NoScript. This will block the hidden script in your browser that is redirecting you. It will also keep malicious websites from auto-downloading this kind of shit onto your machine in the future.

Lastly, once you have NoScript up and running, google search for AVG Anti-Rootkit. It is incorporated in the paid version of AVG anti-virus but you can still track down the Anti-Rootkit tool for free on some sites. That program was the final nail in the coffin for this whole google-redirect thing for me.

I will post more stuff if I think of anything.

Distram

Also, basically what you have is a really shitty virus/rootkit and one anti-virus program isn't going to cut it by itself. Download the tools I listed and you should be cool. This thing was a real bitch for me to get rid of.

oaklore

If its a brand new computer, often times it will come packed with all sort of "helpful" additional tools and programs.

If its a brand new computer, it probly wouldnt bother you to completely reformat the hard drive to zeros and reinstall your operating system.

I use Heron Boot disk for reformating, it's a boot disk that installs a linux operating system, but formats the remaining hard drive space. Then use your windows disk to reinstall your windows to the bare bones. Just make sure you have your registration key somewhere.

After the reformat/reinstall. Update windows repeatedly til its done. Then reinstall AVG, have it set to run at a good time for you every couple of days.

Using a program for formatting to zeros if better than just using your windows disks for a reinstall, since you start fresh with a brand new registry, where evil programs and virus's lurk.

ApexMirage

Honestly a format is your best option, considering both the fact that your AV and spybot picked up nothing, and you've only recently acquired the computer and have little to lose. Put all the necessary apps on a CD, with proper updates, and install those before you plug into the net.

Distram

Well, format if you want. That's the computer equivalent of: "Nuke the site from orbit, it's the only way to be sure." It'll fix the problem but I chalk it up as a loss. Yes, I'm the sort of guy who is concerned about losing to an inanimate piece of malicious software. Still, if you can fix the problem without formatting you'll be better prepared for future problems that occur at times when formatting isn't a good option or even a possibility. I frequently fix other people's machines, friends and coworkers, so I like to know how to fix without formatting.

Anyway, as I said, you have a rootkit. It is fucking google up and likely doing other nasty things like sending information from your machine to another person's machine. How do I know? That's what mine was doing when I had this very same problem.

AdAware, AVG, and Spybot won't pick this up. You need to track down HiJackThis and AVG Anti-Rootkit and run them. Then, just for good measure, go on a deleting spree in your registry if you know what you're doing.

If you don't know what the hell I'm talking about or you don't feel using these programs then put in our Windows CD and format away, it's the only way to be sure.

japan

Distram wrote: »

Well, format if you want. That's the computer equivalent of: "Nuke the site from orbit, it's the only way to be sure." It'll fix the problem but I chalk it up as a loss.

Honestly, it's relatively easy for a Windows install to get sufficiently screwed up that even if you find and remove whatever malware is causing the problem, it'll never work properly thereafter.

Nuke and Pave is presented as an option so often for these problems precisely because it's the most efficient way of dealing with them in terms of time and effort. The OP has now had this problem for a couple of days, and could have fixed it in a couple of hours with a reinstall.

Distram

japan wrote: »

Distram wrote: »

Well, format if you want. That's the computer equivalent of: "Nuke the site from orbit, it's the only way to be sure." It'll fix the problem but I chalk it up as a loss.

Honestly, it's relatively easy for a Windows install to get sufficiently screwed up that even if you find and remove whatever malware is causing the problem, it'll never work properly thereafter.

Nuke and Pave is presented as an option so often for these problems precisely because it's the most efficient way of dealing with them in terms of time and effort. The OP has now had this problem for a couple of days, and could have fixed it in a couple of hours with a reinstall.

Like I said, I frequently fix other people's computers and sometimes they don't want me to format. So, I like to know how to fix and not format, when needed. Also, if the guy were to follow my advice and run those programs he would have this fixed in 15-20 mins as opposed to needing an entire day to reinstall windows and his programs, and get his machine set up the way he prefers.

DeShadowC

vvildcard wrote: »

An unprotected computer will get a virus within 14 minutes of being on the internet.

This is completely untrue.

Infidel

Not if you're installing Windows XP sans service packs.

You can get a worm before it even finishes installing.

It was soon after this that I slipstreamed in SP2. 8-)