Welcome to WebmasterWorld Guest from 54.146.221.231

Forum Moderators: open

Message Too Old, No Replies

Searches at Google.com redirect to www2.google.com

Is it just me?

     
8:17 am on Sep 29, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


Is this normal and I've never noticed before? Also, when I clicked on the Google logo, it took me to www-sj - funky, man.
7:17 pm on Sept 29, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


This is still happening to me, but it doesn't happen when I go through AOL. So, this isn't happening to anyone else?
8:57 pm on Sept 29, 2003 (gmt 0)

Junior Member

10+ Year Member

joined:Aug 8, 2003
posts:96
votes: 0


Have you scanned for parasites on your computer?

Debs

9:47 pm on Sept 29, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 30, 2002
posts:1377
votes: 0


Don't see any of this.
9:53 pm on Sept 29, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


Why would a parasite redirect me to www2.google v www.google? The information goes to Google, not to anyone else.
11:26 pm on Sept 29, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member googleguy is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Oct 8, 2001
posts:2882
votes: 0


I think you have scumware, AAnnAArchy. Check your hosts file and see if you have a hardwired address for www.google.com or other reputable sites.
3:14 am on Sept 30, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


I ran Spybot and found the normal stuff, like Doubleclick, but I also found Bargain Buddy. Where that came from, I dunno. Still, after I cleaned everything up, it still kept happening.

I went to check my hosts file (I try not to get involved in my computer's innards, so this was something new for me :) )

My only file called "hosts" just has this in it -
# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy

I also have three backup hosts files

The first backup -
66.40.16.218 auto.search.msn.com
66.40.16.218 auto.search.msn.com
66.40.16.218 auto.search.msn.com
------------------
The second -
66.40.16.218 auto.search.msn.com
66.40.16.218 auto.search.msn.com

# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
--------------------------------------
The third -
66.40.16.218 auto.search.msn.com
# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy
------------------------------

So far, nothing weird, right? Also, why would scumware want to change what Google datacenter I was using?

Hmm, I just checked a search on MSN, which I never do and it changes the url there too. It doesn't change when I use a proxy or AOL though.

I'll run Ad-Aware too and see if it catches anything Spybot missed.

3:45 am on Sept 30, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


Grrr, ran both Spybot and Ad-aware and it's still happening.

Mods, feel free to move this to a non-Google forum if you'd like. I had no idea that it wasn't Google related when it started.

6:23 am on Sept 30, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


Okay, I've run Ad-aware, Spybot, deleted all my cookies, all my temp files, changed my hosts file, shut my computer down, unplugged from my router...and it's still happening. Arrrrrrrrrgggggggggggghhhhhhh!
6:36 pm on Sept 30, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Jan 29, 2002
posts:980
votes: 0


It's happening to me too! If I find the cause I'll post - just starting a trawl thru my computer now...
6:40 pm on Sept 30, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member googleguy is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Oct 8, 2001
posts:2882
votes: 0


Hmm. Spybot can show browser helper objects (BHO)--that might help.
8:28 pm on Sept 30, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


Gah, nothing helps. I ran both Spybot & Ad-aware *and* changed my hosts file to make it the same as another computer in the house that isn't having the problem. On the positive side, I've learned all kinds of interesting things that can be done with a hosts file; well, when yours works, that is.

Could there be something in the cache of my ISP that won't let the problem go for a while? I don't get the redirect while using a proxy or AOL.

It's making me all paranoid that there's something else amiss in my computer that I'm not seeing though. A search engine redirect by itself isn't such a big deal in the grand scheme of things. I have a firewall, a virus program and Spybot running all the time. What more can I do?

8:40 pm on Sept 30, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Jan 29, 2002
posts:980
votes: 0


Me too. Spybot and adaware don't pick anything up but if try a google url like www.google.com/search?* it picks up a javascript file from somewhere, attempts to open a 10px window with url www.find-now.info/exit.php then redirects to www2.google.com

This happens in any browser I try on this PC which suggests an OS-level problem. Gah!

8:59 pm on Sept 30, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


Phew, well at least you know more than I do. No offense, but I'm glad someone else is seeing this...and someone more capable of figuring out what it is than I am.
9:35 pm on Sept 30, 2003 (gmt 0)

New User

10+ Year Member

joined:Sept 8, 2003
posts:3
votes: 0

Hi people!

I'm new to this board and thought I would come with a suggestion. Have you tried "Hijackthis"
http://www.spywareinfo.com/~merijn/

Maybe it works, maybe it donít. Im not affiliated with the program my self, but in the forums it seems to make good publicity. And its free. :)

9:38 pm on Sept 30, 2003 (gmt 0)

Preferred Member

10+ Year Member

joined:Aug 1, 2003
posts:392
votes: 0


Possibly the "Trojan.BAT.Startpage.a " virus - search for it.

Maybe caught from a webpage with the ActiveX exploit (the one where there is no working patch).

9:49 pm on Sept 30, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


Tried HackThis! and didn't find anything unusual. Also, I don't have the virus mentioned because my start page doesn't change, it just redirects to a different Google or MSN when I search. It doesn't redirect to any other site. The Google search results that I see are normal too, just from another datacenter.
10:05 pm on Sept 30, 2003 (gmt 0)

New User

10+ Year Member

joined:Sept 8, 2003
posts:3
votes: 0


I did a search on "www2.google.com" at [forums.spywareinfo.com...] and there were some results. You might want to check out that your self. Im not posting the (long) direct URL here because it seriously breaks up the layout of this board. And Im an esthetic freak heeh ;)
10:12 pm on Sept 30, 2003 (gmt 0)

New User

10+ Year Member

joined:Sept 8, 2003
posts:3
votes: 0


I thought I would circumvent anyone pointing out the special forum code one can use .. I just realized it.
10:39 pm on Sept 30, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


I read about it at the forum, but I don't seem to be having the problems that most are. I can access Google just fine and I don't get any strange popups. Hmmm.
6:11 am on Oct 1, 2003 (gmt 0)

New User

10+ Year Member

joined:Aug 6, 2003
posts:17
votes: 0


Its happening to me too. Dont ever let your mother use Internet Explorer for 5 minutes without supervision. I will uninstall it.

I found another hosts file under c:\windows\help\

Still trying to figure this out.

6:29 am on Oct 1, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


I had another hosts file there too. That one had all of the different Google datacenters in it. Why? I don't know.

I feel like a gremlin has gotten into my computer and just moved things around, but hasn't destroyed anything...yet.

6:33 am on Oct 1, 2003 (gmt 0)

New User

10+ Year Member

joined:Aug 6, 2003
posts:17
votes: 0


Seems to be a compiled batch file that its taking advantage of a vulnerability of IE that was supposed to be patched by Microsoft, but the patch didn't really fix the problem.
6:33 am on Oct 1, 2003 (gmt 0)

New User

10+ Year Member

joined:Aug 6, 2003
posts:17
votes: 0


More info here:
[imilly.com...]
7:38 am on Oct 1, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


More info here:
[imilly.com...]

That's not the problem I'm having. I can get to Google just fine, it just redirects to www2.google.com.

11:09 am on Oct 1, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Jan 29, 2002
posts:980
votes: 0


I had a hosts file in windows\help - deleting it and restarting networking has cleared it for now...
7:03 pm on Oct 1, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


I found another hosts file under c:\windows\help\

Getting rid of this hosts file and rebooting fixed the problem. Thanks, Eduardo!

7:25 pm on Oct 1, 2003 (gmt 0)

Junior Member

10+ Year Member

joined:Feb 13, 2003
posts:103
votes: 0


AAnnAArchy, I'm glad you fixed the problem.

To answer one of your questions, there is a good reason that scumware might send you to www2.google.com for search results. The smarter hacks do this in order to make you think that nothing is wrong. If you are going to Google, and you are getting real Google search results, you are less likely to cry foul. 99.9% of searchers would see nothing strange about seeing the www2 subdomain. Scumware hijacks the home page, but then serves real Google results. To begin with, the scumware may even present an exact replica of the Google home page (seems like this might have been the case here). Over time, they may start to add text ads, banners, and pop-ups. The average web user might just think that Google has changed their home page - and continue this way for months.

7:31 pm on Oct 1, 2003 (gmt 0)

Junior Member

10+ Year Member

joined:Apr 25, 2001
posts:110
votes: 0


I'm having the same problem and I have no idea how this got on my computer... That [find-now.info...] site seems to be running this crap. I just wonder how they got it on my computer.
9:11 pm on Oct 1, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Aug 22, 2002
posts:681
votes: 0


swerve
To begin with, the scumware may even present an exact replica of the Google home page (seems like this might have been the case here). Over time, they may start to add text ads, banners, and pop-ups. The average web user might just think that Google has changed their home page - and continue this way for months.

Ah, that makes sense. Clever...and nasty. I'm glad they could educate me on hosts files though, even if it wasted almost a whole evening of doing all kinds of useless things to my computer.

This 33 message thread spans 2 pages: 33