Google results changing after page loads

think it is scum ware

[jpavery]

Hi,
I was just speaking to a client. They were telling me that the SERPs would load - then there would be a flash 1/4 second later and new results would show up as the top 5 and push the orginal top 5 down. I was stunned - it sounds like scum ware, but really good scum ware.

I sent her Google IP address to try - and the "flash" did not happen.

For KWs in our nieche the same five sites were being flashed into the top 5. She sent me a couple of screen shots - and these are diffinetly not sponsored results or froogle results. They appear as normal organic listings.

Has anyone else seen this?

[WebGuerrilla]

>>it sounds like scum ware, but really good scum ware.

If the altering of the original results is detectible to the eye, then I would say that it is really bad scum ware.

More than likely, she'll need to unistall and reinstall IE in order for it to go away.

[webdude]

Question

Would software like SpyBot detect something like this?

[GoogleGuy]

Sounds like scumware alright. I'd start with Spybot. There's also a neat program called CoolWebShredder that can defuse the CoolWeb scumware.

[jpavery]

I had the client run scumware removal tools - she found it and removed it.
Paul

[wellzy]

I have had this same problem for weeks. Results 2-6 change on Google shortly after it loads. I have tried PestPatrol, SpyBot, Ad-Aware and none of them get it off fully. It reappears at the next boot up.

I checked at work and it does the same thing. When you first bring up IE you can actually see the change. When you go to the next results page (2) you can't see it change.

Still haven't got it off. That's the bad news. Good news is is that when I remove it my site will move up in Google's results ;)

I'll post what finally fixes it.

wellzy

[wellzy]

I think I've tried everything I can think of. Anybody out there good with HijackThis logs? I could use some help.

Thanks
wellzy

[jpavery]

There is a new virus kicking around w32.tuoba.trojan & bloodhound.exploit.6

They re-direct your browser - might mess with SERPS - maybe a virus scan?
Paul

[wellzy]

Tried virus scan (Norton Anti-Virus & others). This is driving me crazy....lol

wellzy

[newbieatseo]

I have been having this problem for the past week. It happens on both Google and Yahoo. Spybot and Adware do not fix the problem. Any other ideas?

[edited by: newbieatseo at 3:09 pm (utc) on Mar. 18, 2004]

[ntrance]

I had this problem, the free version of ad-aware fixed it for me.

[nkakar]

My spybot doesnt even load, it stops loading and says not responding when i initiate it. Any suggestions...
I even downloaded a newer one, but no help :(

[wellzy]

Ad-aware did not fix this problem. I have tried 2-3 different AV's with no luck. I've tried MANY scumware/spyware removal programs with no luck. Even tried to clean the reg.

Ughhh

[jomaxx]

FWIW, I saw this described on another forum and the problem was allegedly caused by CoolWebSearch. You could try removing it with CWShredder.

[edit - just noticed that Googleguy recommended the same software in a previous message.]

[dazzlindonna]

Is it feasible to think that google could sue the creator of this scumware for altering the serps, or no? Surely someone needs to start putting an end to this kind of thing. It is so out of hand.

[SyntheticUpper]

CWShredder - no affiliation. It's freeware, and the only app. to get rid of this infection. Brilliant, a real service to the Internet.

Google take note, this guy does it for nothing; you do it for billions and have still managed to b*gger it up.

[wellzy]

Already tried CWShredder - no luck. It leaves something behind and reinstalls at next boot up.

wellzy

[wellzy]

Just for the record, I just ran CWShredder again and it didn't even find it this time (but problem is till there). I would think Google would have grounds to sue.

wellzy

[idoc]

I had somebody call me today trying to sell keyword type ads on one top of one of these browser hijack setups. This one works like keywords except you need the scumware for it to work. I guess as long as someone will buy they will keep building 'em.

Your scumware type sounds similiar to the ones that I have removed for users that have had hidden install directories and also dll's that take control of windows explorer. If you remove it wrongly your windows explorer will break. You can still browse with outlook if you have it to find a patch on the internet, or you could use netscape to find an explorer patch. Once you remove it with spybot or shredder next time then don't reboot until you have found the bad dll and install files and removed them permanently. You might check that your spy tools are up to date also with the latest specs. Also, if you use XP or 2000... make yourself a non administrator account to surf the web with that does not have install priviliges. That way you will get a prompt when something tries to install itself.

[Leosghost]

Personally since the 12 march I have hard time telling the difference between scumware generated serps and the stuff the "plex" is telling me is relevant ...

More practically try checksumming the dlls associated with your browser against the ones on your boot disc ...replace those that aren't at the original size with the ones off the disc "shred the old ones first"...

If you really want to see what the difference is with what youv'e currently got and what it ought to be try running "windiff" or similar at the "paired" dlls before you do this ...

DONT DO THESE THINGS ..if you don't know what you are doing in your register .....

BACK UP YOUR REGISTER FIRST ...( even a wiggy register is better than a "self zapped" register )..

Cant tell you the url ( tos ) ...

But ...search ( with something other than google ...you'll probably get a more relevant result even without the scumware problem if you use another SE at the moment ) ..for "Wormguard" ...

Look around the site in question ....i've installed their stuff in many machines and eveyone now sleeps sound ....

Iv'e got no connection at all with the site etc ...just know their stuff works very well for those who install stuff on their machines without the knowledge to see what its doing on the way in ...

[newbieatseo]

I tried CWShredder last night as well but it didn't find anything. Must be a new variant without an update yet.

[wellzy]

Thanks for all the help. Still working on it. I have been working on the registry and found a few things, but they reappear on reboot. I have even unregistered the dll's, still no luck.

I have updated Ad-aware, spybot, anti-virus and the other 10 scumware proggys (many times).

What really blows is that I'm not a newbie to any of this. Usually takes about 10 mins to find and remove this stuff.

wellzy

[XtendScott]

Try Hijackthis: Download Here [spychecker.com]

It does not Auto remove but it lists programs that are started automatically and allows you to "CHECK" which ones to remove. Careful some of them are usefull.

I used this for a similar scumware that had 4 or 5 apps running and checking to see if any were removed then installed again if they were gone.

[DVDBurning]

There is a nice little program called BHOdemon that removes unwanted Browser Helper Objects. This includes Gator and similar garbage. The only BHO's you might want are typically an Adobe Acrobat BHO and the Google Toolbar.

[definitivesolutions.com...]

[DVDBurning]

Another cool tool is AutoRuns from sysinternals. This will show you all the programs that could automatically start when you start up Windows.

[sysinternals.com...]

Good luck.

[wellzy]

Thanks for all the help. Still working on it. No luck yet. Tried everything suggested and more.

wellzy

[ILuvSrchEngines]

Make sure your default IE home page does not first go to a scumware site on IE load. That is another way they get you, by proxy redirection. Go into IE options and make sure your default settings are set to a real web site, like MSN or YAhoo.

[wellzy]

Got it with BHOdemon. I still have to delete it from the registry, but atleast I know which one it is and can delete (BHOdemon has it disabled for now). Thanks DVDBurner and everyone else that helped. I'll post the reg entry tonight when I get home from work.

wellzy

[wellzy]

Thanks for all the help. Here is what I found (and have since deleted:
C:\WINDOWS\2_0_1browserhelper2.dll and registry key: {83DE62E0-5805-11D8-9B25-00E04C60FAF2}

It was found and I could disable it with BHODemon. When that worked I deleted it with CWShredder.

Thanks again

wellzy