homepage Welcome to WebmasterWorld Guest from 54.205.254.108
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member

Visit PubCon.com
Home / Forums Index / Google / Google News Archive
Forum Library, Charter, Moderator: open

Google News Archive Forum

This 33 message thread spans 2 pages: 33 ( [1] 2 > >     
Searches at Google.com redirect to www2.google.com
Is it just me?
AAnnAArchy




msg:53123
 8:17 am on Sep 29, 2003 (gmt 0)

Is this normal and I've never noticed before? Also, when I clicked on the Google logo, it took me to www-sj - funky, man.

 

AAnnAArchy




msg:53124
 7:17 pm on Sep 29, 2003 (gmt 0)

This is still happening to me, but it doesn't happen when I go through AOL. So, this isn't happening to anyone else?

seeber01




msg:53125
 8:57 pm on Sep 29, 2003 (gmt 0)

Have you scanned for parasites on your computer?

Debs

HitProf




msg:53126
 9:47 pm on Sep 29, 2003 (gmt 0)

Don't see any of this.

AAnnAArchy




msg:53127
 9:53 pm on Sep 29, 2003 (gmt 0)

Why would a parasite redirect me to www2.google v www.google? The information goes to Google, not to anyone else.

GoogleGuy




msg:53128
 11:26 pm on Sep 29, 2003 (gmt 0)

I think you have scumware, AAnnAArchy. Check your hosts file and see if you have a hardwired address for www.google.com or other reputable sites.

AAnnAArchy




msg:53129
 3:14 am on Sep 30, 2003 (gmt 0)

I ran Spybot and found the normal stuff, like Doubleclick, but I also found Bargain Buddy. Where that came from, I dunno. Still, after I cleaned everything up, it still kept happening.

I went to check my hosts file (I try not to get involved in my computer's innards, so this was something new for me :) )

My only file called "hosts" just has this in it -
# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy

I also have three backup hosts files

The first backup -
66.40.16.218 auto.search.msn.com
66.40.16.218 auto.search.msn.com
66.40.16.218 auto.search.msn.com
------------------
The second -
66.40.16.218 auto.search.msn.com
66.40.16.218 auto.search.msn.com

# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
--------------------------------------
The third -
66.40.16.218 auto.search.msn.com
# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
------------------------------

So far, nothing weird, right? Also, why would scumware want to change what Google datacenter I was using?

Hmm, I just checked a search on MSN, which I never do and it changes the url there too. It doesn't change when I use a proxy or AOL though.

I'll run Ad-Aware too and see if it catches anything Spybot missed.

AAnnAArchy




msg:53130
 3:45 am on Sep 30, 2003 (gmt 0)

Grrr, ran both Spybot and Ad-aware and it's still happening.

Mods, feel free to move this to a non-Google forum if you'd like. I had no idea that it wasn't Google related when it started.

AAnnAArchy




msg:53131
 6:23 am on Sep 30, 2003 (gmt 0)

Okay, I've run Ad-aware, Spybot, deleted all my cookies, all my temp files, changed my hosts file, shut my computer down, unplugged from my router...and it's still happening. Arrrrrrrrrgggggggggggghhhhhhh!

mattur




msg:53132
 6:36 pm on Sep 30, 2003 (gmt 0)

It's happening to me too! If I find the cause I'll post - just starting a trawl thru my computer now...

GoogleGuy




msg:53133
 6:40 pm on Sep 30, 2003 (gmt 0)

Hmm. Spybot can show browser helper objects (BHO)--that might help.

AAnnAArchy




msg:53134
 8:28 pm on Sep 30, 2003 (gmt 0)

Gah, nothing helps. I ran both Spybot & Ad-aware *and* changed my hosts file to make it the same as another computer in the house that isn't having the problem. On the positive side, I've learned all kinds of interesting things that can be done with a hosts file; well, when yours works, that is.

Could there be something in the cache of my ISP that won't let the problem go for a while? I don't get the redirect while using a proxy or AOL.

It's making me all paranoid that there's something else amiss in my computer that I'm not seeing though. A search engine redirect by itself isn't such a big deal in the grand scheme of things. I have a firewall, a virus program and Spybot running all the time. What more can I do?

mattur




msg:53135
 8:40 pm on Sep 30, 2003 (gmt 0)

Me too. Spybot and adaware don't pick anything up but if try a google url like www.google.com/search?* it picks up a javascript file from somewhere, attempts to open a 10px window with url www.find-now.info/exit.php then redirects to www2.google.com

This happens in any browser I try on this PC which suggests an OS-level problem. Gah!

AAnnAArchy




msg:53136
 8:59 pm on Sep 30, 2003 (gmt 0)

Phew, well at least you know more than I do. No offense, but I'm glad someone else is seeing this...and someone more capable of figuring out what it is than I am.

redrum




msg:53137
 9:35 pm on Sep 30, 2003 (gmt 0)
Hi people!

I'm new to this board and thought I would come with a suggestion. Have you tried "Hijackthis"
http://www.spywareinfo.com/~merijn/

Maybe it works, maybe it donít. Im not affiliated with the program my self, but in the forums it seems to make good publicity. And its free. :)

robho




msg:53138
 9:38 pm on Sep 30, 2003 (gmt 0)

Possibly the "Trojan.BAT.Startpage.a " virus - search for it.

Maybe caught from a webpage with the ActiveX exploit (the one where there is no working patch).

AAnnAArchy




msg:53139
 9:49 pm on Sep 30, 2003 (gmt 0)

Tried HackThis! and didn't find anything unusual. Also, I don't have the virus mentioned because my start page doesn't change, it just redirects to a different Google or MSN when I search. It doesn't redirect to any other site. The Google search results that I see are normal too, just from another datacenter.

redrum




msg:53140
 10:05 pm on Sep 30, 2003 (gmt 0)

I did a search on "www2.google.com" at [forums.spywareinfo.com...] and there were some results. You might want to check out that your self. Im not posting the (long) direct URL here because it seriously breaks up the layout of this board. And Im an esthetic freak heeh ;)

redrum




msg:53141
 10:12 pm on Sep 30, 2003 (gmt 0)

I thought I would circumvent anyone pointing out the special forum code one can use .. I just realized it.

AAnnAArchy




msg:53142
 10:39 pm on Sep 30, 2003 (gmt 0)

I read about it at the forum, but I don't seem to be having the problems that most are. I can access Google just fine and I don't get any strange popups. Hmmm.

eduardo




msg:53143
 6:11 am on Oct 1, 2003 (gmt 0)

Its happening to me too. Dont ever let your mother use Internet Explorer for 5 minutes without supervision. I will uninstall it.

I found another hosts file under c:\windows\help\

Still trying to figure this out.

AAnnAArchy




msg:53144
 6:29 am on Oct 1, 2003 (gmt 0)

I had another hosts file there too. That one had all of the different Google datacenters in it. Why? I don't know.

I feel like a gremlin has gotten into my computer and just moved things around, but hasn't destroyed anything...yet.

eduardo




msg:53145
 6:33 am on Oct 1, 2003 (gmt 0)

Seems to be a compiled batch file that its taking advantage of a vulnerability of IE that was supposed to be patched by Microsoft, but the patch didn't really fix the problem.

eduardo




msg:53146
 6:33 am on Oct 1, 2003 (gmt 0)

More info here:
[imilly.com...]

AAnnAArchy




msg:53147
 7:38 am on Oct 1, 2003 (gmt 0)

More info here:
[imilly.com...]

That's not the problem I'm having. I can get to Google just fine, it just redirects to www2.google.com.

mattur




msg:53148
 11:09 am on Oct 1, 2003 (gmt 0)

I had a hosts file in windows\help - deleting it and restarting networking has cleared it for now...

AAnnAArchy




msg:53149
 7:03 pm on Oct 1, 2003 (gmt 0)

I found another hosts file under c:\windows\help\

Getting rid of this hosts file and rebooting fixed the problem. Thanks, Eduardo!

swerve




msg:53150
 7:25 pm on Oct 1, 2003 (gmt 0)

AAnnAArchy, I'm glad you fixed the problem.

To answer one of your questions, there is a good reason that scumware might send you to www2.google.com for search results. The smarter hacks do this in order to make you think that nothing is wrong. If you are going to Google, and you are getting real Google search results, you are less likely to cry foul. 99.9% of searchers would see nothing strange about seeing the www2 subdomain. Scumware hijacks the home page, but then serves real Google results. To begin with, the scumware may even present an exact replica of the Google home page (seems like this might have been the case here). Over time, they may start to add text ads, banners, and pop-ups. The average web user might just think that Google has changed their home page - and continue this way for months.

chadlerh




msg:53151
 7:31 pm on Oct 1, 2003 (gmt 0)

I'm having the same problem and I have no idea how this got on my computer... That [find-now.info...] site seems to be running this crap. I just wonder how they got it on my computer.

AAnnAArchy




msg:53152
 9:11 pm on Oct 1, 2003 (gmt 0)

swerve
To begin with, the scumware may even present an exact replica of the Google home page (seems like this might have been the case here). Over time, they may start to add text ads, banners, and pop-ups. The average web user might just think that Google has changed their home page - and continue this way for months.

Ah, that makes sense. Clever...and nasty. I'm glad they could educate me on hosts files though, even if it wasted almost a whole evening of doing all kinds of useless things to my computer.

This 33 message thread spans 2 pages: 33 ( [1] 2 > >
Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Google / Google News Archive
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved