homepage Welcome to WebmasterWorld Guest from 54.204.182.118
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member

Home / Forums Index / Google / Google News Archive
Forum Library, Charter, Moderator: open

Google News Archive Forum

This 33 message thread spans 2 pages: 33 ( [1] 2 > >     
Searches at Google.com redirect to www2.google.com
Is it just me?
AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 8:17 am on Sep 29, 2003 (gmt 0)

Is this normal and I've never noticed before? Also, when I clicked on the Google logo, it took me to www-sj - funky, man.

 

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 7:17 pm on Sep 29, 2003 (gmt 0)

This is still happening to me, but it doesn't happen when I go through AOL. So, this isn't happening to anyone else?

seeber01

10+ Year Member



 
Msg#: 17288 posted 8:57 pm on Sep 29, 2003 (gmt 0)

Have you scanned for parasites on your computer?

Debs

HitProf

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 9:47 pm on Sep 29, 2003 (gmt 0)

Don't see any of this.

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 9:53 pm on Sep 29, 2003 (gmt 0)

Why would a parasite redirect me to www2.google v www.google? The information goes to Google, not to anyone else.

GoogleGuy

WebmasterWorld Senior Member googleguy us a WebmasterWorld Top Contributor of All Time 10+ Year Member



 
Msg#: 17288 posted 11:26 pm on Sep 29, 2003 (gmt 0)

I think you have scumware, AAnnAArchy. Check your hosts file and see if you have a hardwired address for www.google.com or other reputable sites.

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 3:14 am on Sep 30, 2003 (gmt 0)

I ran Spybot and found the normal stuff, like Doubleclick, but I also found Bargain Buddy. Where that came from, I dunno. Still, after I cleaned everything up, it still kept happening.

I went to check my hosts file (I try not to get involved in my computer's innards, so this was something new for me :) )

My only file called "hosts" just has this in it -
# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy

I also have three backup hosts files

The first backup -
66.40.16.218 auto.search.msn.com
66.40.16.218 auto.search.msn.com
66.40.16.218 auto.search.msn.com
------------------
The second -
66.40.16.218 auto.search.msn.com
66.40.16.218 auto.search.msn.com

# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
--------------------------------------
The third -
66.40.16.218 auto.search.msn.com
# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
------------------------------

So far, nothing weird, right? Also, why would scumware want to change what Google datacenter I was using?

Hmm, I just checked a search on MSN, which I never do and it changes the url there too. It doesn't change when I use a proxy or AOL though.

I'll run Ad-Aware too and see if it catches anything Spybot missed.

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 3:45 am on Sep 30, 2003 (gmt 0)

Grrr, ran both Spybot and Ad-aware and it's still happening.

Mods, feel free to move this to a non-Google forum if you'd like. I had no idea that it wasn't Google related when it started.

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 6:23 am on Sep 30, 2003 (gmt 0)

Okay, I've run Ad-aware, Spybot, deleted all my cookies, all my temp files, changed my hosts file, shut my computer down, unplugged from my router...and it's still happening. Arrrrrrrrrgggggggggggghhhhhhh!

mattur

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 6:36 pm on Sep 30, 2003 (gmt 0)

It's happening to me too! If I find the cause I'll post - just starting a trawl thru my computer now...

GoogleGuy

WebmasterWorld Senior Member googleguy us a WebmasterWorld Top Contributor of All Time 10+ Year Member



 
Msg#: 17288 posted 6:40 pm on Sep 30, 2003 (gmt 0)

Hmm. Spybot can show browser helper objects (BHO)--that might help.

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 8:28 pm on Sep 30, 2003 (gmt 0)

Gah, nothing helps. I ran both Spybot & Ad-aware *and* changed my hosts file to make it the same as another computer in the house that isn't having the problem. On the positive side, I've learned all kinds of interesting things that can be done with a hosts file; well, when yours works, that is.

Could there be something in the cache of my ISP that won't let the problem go for a while? I don't get the redirect while using a proxy or AOL.

It's making me all paranoid that there's something else amiss in my computer that I'm not seeing though. A search engine redirect by itself isn't such a big deal in the grand scheme of things. I have a firewall, a virus program and Spybot running all the time. What more can I do?

mattur

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 8:40 pm on Sep 30, 2003 (gmt 0)

Me too. Spybot and adaware don't pick anything up but if try a google url like www.google.com/search?* it picks up a javascript file from somewhere, attempts to open a 10px window with url www.find-now.info/exit.php then redirects to www2.google.com

This happens in any browser I try on this PC which suggests an OS-level problem. Gah!

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 8:59 pm on Sep 30, 2003 (gmt 0)

Phew, well at least you know more than I do. No offense, but I'm glad someone else is seeing this...and someone more capable of figuring out what it is than I am.

redrum

10+ Year Member



 
Msg#: 17288 posted 9:35 pm on Sep 30, 2003 (gmt 0)
Hi people!

I'm new to this board and thought I would come with a suggestion. Have you tried "Hijackthis"
http://www.spywareinfo.com/~merijn/

Maybe it works, maybe it donít. Im not affiliated with the program my self, but in the forums it seems to make good publicity. And its free. :)

robho

10+ Year Member



 
Msg#: 17288 posted 9:38 pm on Sep 30, 2003 (gmt 0)

Possibly the "Trojan.BAT.Startpage.a " virus - search for it.

Maybe caught from a webpage with the ActiveX exploit (the one where there is no working patch).

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 9:49 pm on Sep 30, 2003 (gmt 0)

Tried HackThis! and didn't find anything unusual. Also, I don't have the virus mentioned because my start page doesn't change, it just redirects to a different Google or MSN when I search. It doesn't redirect to any other site. The Google search results that I see are normal too, just from another datacenter.

redrum

10+ Year Member



 
Msg#: 17288 posted 10:05 pm on Sep 30, 2003 (gmt 0)

I did a search on "www2.google.com" at [forums.spywareinfo.com...] and there were some results. You might want to check out that your self. Im not posting the (long) direct URL here because it seriously breaks up the layout of this board. And Im an esthetic freak heeh ;)

redrum

10+ Year Member



 
Msg#: 17288 posted 10:12 pm on Sep 30, 2003 (gmt 0)

I thought I would circumvent anyone pointing out the special forum code one can use .. I just realized it.

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 10:39 pm on Sep 30, 2003 (gmt 0)

I read about it at the forum, but I don't seem to be having the problems that most are. I can access Google just fine and I don't get any strange popups. Hmmm.

eduardo

10+ Year Member



 
Msg#: 17288 posted 6:11 am on Oct 1, 2003 (gmt 0)

Its happening to me too. Dont ever let your mother use Internet Explorer for 5 minutes without supervision. I will uninstall it.

I found another hosts file under c:\windows\help\

Still trying to figure this out.

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 6:29 am on Oct 1, 2003 (gmt 0)

I had another hosts file there too. That one had all of the different Google datacenters in it. Why? I don't know.

I feel like a gremlin has gotten into my computer and just moved things around, but hasn't destroyed anything...yet.

eduardo

10+ Year Member



 
Msg#: 17288 posted 6:33 am on Oct 1, 2003 (gmt 0)

Seems to be a compiled batch file that its taking advantage of a vulnerability of IE that was supposed to be patched by Microsoft, but the patch didn't really fix the problem.

eduardo

10+ Year Member



 
Msg#: 17288 posted 6:33 am on Oct 1, 2003 (gmt 0)

More info here:
[imilly.com...]

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 7:38 am on Oct 1, 2003 (gmt 0)

More info here:
[imilly.com...]

That's not the problem I'm having. I can get to Google just fine, it just redirects to www2.google.com.

mattur

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 11:09 am on Oct 1, 2003 (gmt 0)

I had a hosts file in windows\help - deleting it and restarting networking has cleared it for now...

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 7:03 pm on Oct 1, 2003 (gmt 0)

I found another hosts file under c:\windows\help\

Getting rid of this hosts file and rebooting fixed the problem. Thanks, Eduardo!

swerve

10+ Year Member



 
Msg#: 17288 posted 7:25 pm on Oct 1, 2003 (gmt 0)

AAnnAArchy, I'm glad you fixed the problem.

To answer one of your questions, there is a good reason that scumware might send you to www2.google.com for search results. The smarter hacks do this in order to make you think that nothing is wrong. If you are going to Google, and you are getting real Google search results, you are less likely to cry foul. 99.9% of searchers would see nothing strange about seeing the www2 subdomain. Scumware hijacks the home page, but then serves real Google results. To begin with, the scumware may even present an exact replica of the Google home page (seems like this might have been the case here). Over time, they may start to add text ads, banners, and pop-ups. The average web user might just think that Google has changed their home page - and continue this way for months.

chadlerh

10+ Year Member



 
Msg#: 17288 posted 7:31 pm on Oct 1, 2003 (gmt 0)

I'm having the same problem and I have no idea how this got on my computer... That [find-now.info...] site seems to be running this crap. I just wonder how they got it on my computer.

AAnnAArchy

WebmasterWorld Senior Member 10+ Year Member



 
Msg#: 17288 posted 9:11 pm on Oct 1, 2003 (gmt 0)

swerve
To begin with, the scumware may even present an exact replica of the Google home page (seems like this might have been the case here). Over time, they may start to add text ads, banners, and pop-ups. The average web user might just think that Google has changed their home page - and continue this way for months.

Ah, that makes sense. Clever...and nasty. I'm glad they could educate me on hosts files though, even if it wasted almost a whole evening of doing all kinds of useless things to my computer.

This 33 message thread spans 2 pages: 33 ( [1] 2 > >
Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Google / Google News Archive
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved