Welcome to WebmasterWorld Guest from 54.146.171.44

Forum Moderators: open

Message Too Old, No Replies

Google results changing after page loads

think it is scum ware

   
6:24 pm on Feb 19, 2004 (gmt 0)

10+ Year Member



Hi,
I was just speaking to a client. They were telling me that the SERPs would load - then there would be a flash 1/4 second later and new results would show up as the top 5 and push the orginal top 5 down. I was stunned - it sounds like scum ware, but really good scum ware.

I sent her Google IP address to try - and the "flash" did not happen.

For KWs in our nieche the same five sites were being flashed into the top 5. She sent me a couple of screen shots - and these are diffinetly not sponsored results or froogle results. They appear as normal organic listings.

Has anyone else seen this?

7:16 pm on Feb 20, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



>>it sounds like scum ware, but really good scum ware.

If the altering of the original results is detectible to the eye, then I would say that it is really bad scum ware.

More than likely, she'll need to unistall and reinstall IE in order for it to go away.

10:07 pm on Feb 20, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Question

Would software like SpyBot detect something like this?

5:38 am on Feb 21, 2004 (gmt 0)

WebmasterWorld Senior Member googleguy is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Sounds like scumware alright. I'd start with Spybot. There's also a neat program called CoolWebShredder that can defuse the CoolWeb scumware.
2:26 pm on Feb 21, 2004 (gmt 0)

10+ Year Member



I had the client run scumware removal tools - she found it and removed it.
Paul
12:46 am on Mar 17, 2004 (gmt 0)

10+ Year Member



I have had this same problem for weeks. Results 2-6 change on Google shortly after it loads. I have tried PestPatrol, SpyBot, Ad-Aware and none of them get it off fully. It reappears at the next boot up.

I checked at work and it does the same thing. When you first bring up IE you can actually see the change. When you go to the next results page (2) you can't see it change.

Still haven't got it off. That's the bad news. Good news is is that when I remove it my site will move up in Google's results ;)

I'll post what finally fixes it.

wellzy

2:32 am on Mar 17, 2004 (gmt 0)

10+ Year Member



I think I've tried everything I can think of. Anybody out there good with HijackThis logs? I could use some help.

Thanks
wellzy

3:08 am on Mar 17, 2004 (gmt 0)

10+ Year Member



There is a new virus kicking around w32.tuoba.trojan & bloodhound.exploit.6

They re-direct your browser - might mess with SERPS - maybe a virus scan?
Paul

11:36 am on Mar 18, 2004 (gmt 0)

10+ Year Member



Tried virus scan (Norton Anti-Virus & others). This is driving me crazy....lol

wellzy

3:07 pm on Mar 18, 2004 (gmt 0)

10+ Year Member



I have been having this problem for the past week. It happens on both Google and Yahoo. Spybot and Adware do not fix the problem. Any other ideas?

[edited by: newbieatseo at 3:09 pm (utc) on Mar. 18, 2004]

3:54 pm on Mar 18, 2004 (gmt 0)

10+ Year Member



I had this problem, the free version of ad-aware fixed it for me.
4:00 pm on Mar 18, 2004 (gmt 0)

10+ Year Member



My spybot doesnt even load, it stops loading and says not responding when i initiate it. Any suggestions...
I even downloaded a newer one, but no help :(
6:45 pm on Mar 18, 2004 (gmt 0)

10+ Year Member



Ad-aware did not fix this problem. I have tried 2-3 different AV's with no luck. I've tried MANY scumware/spyware removal programs with no luck. Even tried to clean the reg.

Ughhh

8:11 pm on Mar 18, 2004 (gmt 0)

WebmasterWorld Senior Member jomaxx is a WebmasterWorld Top Contributor of All Time 10+ Year Member



FWIW, I saw this described on another forum and the problem was allegedly caused by CoolWebSearch. You could try removing it with CWShredder.

[edit - just noticed that Googleguy recommended the same software in a previous message.]

8:49 pm on Mar 18, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Is it feasible to think that google could sue the creator of this scumware for altering the serps, or no? Surely someone needs to start putting an end to this kind of thing. It is so out of hand.
8:55 pm on Mar 18, 2004 (gmt 0)

10+ Year Member



CWShredder - no affiliation. It's freeware, and the only app. to get rid of this infection. Brilliant, a real service to the Internet.

Google take note, this guy does it for nothing; you do it for billions and have still managed to b*gger it up.

9:46 pm on Mar 18, 2004 (gmt 0)

10+ Year Member



Already tried CWShredder - no luck. It leaves something behind and reinstalls at next boot up.

wellzy

9:53 pm on Mar 18, 2004 (gmt 0)

10+ Year Member



Just for the record, I just ran CWShredder again and it didn't even find it this time (but problem is till there). I would think Google would have grounds to sue.

wellzy

11:10 pm on Mar 18, 2004 (gmt 0)

10+ Year Member



I had somebody call me today trying to sell keyword type ads on one top of one of these browser hijack setups. This one works like keywords except you need the scumware for it to work. I guess as long as someone will buy they will keep building 'em.

Your scumware type sounds similiar to the ones that I have removed for users that have had hidden install directories and also dll's that take control of windows explorer. If you remove it wrongly your windows explorer will break. You can still browse with outlook if you have it to find a patch on the internet, or you could use netscape to find an explorer patch. Once you remove it with spybot or shredder next time then don't reboot until you have found the bad dll and install files and removed them permanently. You might check that your spy tools are up to date also with the latest specs. Also, if you use XP or 2000... make yourself a non administrator account to surf the web with that does not have install priviliges. That way you will get a prompt when something tries to install itself.

1:17 pm on Mar 19, 2004 (gmt 0)

WebmasterWorld Senior Member leosghost is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Personally since the 12 march I have hard time telling the difference between scumware generated serps and the stuff the "plex" is telling me is relevant ...

More practically try checksumming the dlls associated with your browser against the ones on your boot disc ...replace those that aren't at the original size with the ones off the disc "shred the old ones first"...

If you really want to see what the difference is with what youv'e currently got and what it ought to be try running "windiff" or similar at the "paired" dlls before you do this ...

DONT DO THESE THINGS ..if you don't know what you are doing in your register .....

BACK UP YOUR REGISTER FIRST ...( even a wiggy register is better than a "self zapped" register )..

Cant tell you the url ( tos ) ...

But ...search ( with something other than google ...you'll probably get a more relevant result even without the scumware problem if you use another SE at the moment ) ..for "Wormguard" ...

Look around the site in question ....i've installed their stuff in many machines and eveyone now sleeps sound ....

Iv'e got no connection at all with the site etc ...just know their stuff works very well for those who install stuff on their machines without the knowledge to see what its doing on the way in ...

2:08 pm on Mar 19, 2004 (gmt 0)

10+ Year Member



I tried CWShredder last night as well but it didn't find anything. Must be a new variant without an update yet.
2:57 pm on Mar 19, 2004 (gmt 0)

10+ Year Member



Thanks for all the help. Still working on it. I have been working on the registry and found a few things, but they reappear on reboot. I have even unregistered the dll's, still no luck.

I have updated Ad-aware, spybot, anti-virus and the other 10 scumware proggys (many times).

What really blows is that I'm not a newbie to any of this. Usually takes about 10 mins to find and remove this stuff.

wellzy

3:25 pm on Mar 19, 2004 (gmt 0)

10+ Year Member



Try Hijackthis: Download Here [spychecker.com]

It does not Auto remove but it lists programs that are started automatically and allows you to "CHECK" which ones to remove. Careful some of them are usefull.

I used this for a similar scumware that had 4 or 5 apps running and checking to see if any were removed then installed again if they were gone.

3:43 pm on Mar 19, 2004 (gmt 0)

10+ Year Member



There is a nice little program called BHOdemon that removes unwanted Browser Helper Objects. This includes Gator and similar garbage. The only BHO's you might want are typically an Adobe Acrobat BHO and the Google Toolbar.

[definitivesolutions.com...]

3:46 pm on Mar 19, 2004 (gmt 0)

10+ Year Member



Another cool tool is AutoRuns from sysinternals. This will show you all the programs that could automatically start when you start up Windows.

[sysinternals.com...]

Good luck.

1:59 pm on Mar 21, 2004 (gmt 0)

10+ Year Member



Thanks for all the help. Still working on it. No luck yet. Tried everything suggested and more.

wellzy

3:03 pm on Mar 21, 2004 (gmt 0)



Make sure your default IE home page does not first go to a scumware site on IE load. That is another way they get you, by proxy redirection. Go into IE options and make sure your default settings are set to a real web site, like MSN or YAhoo.
12:51 pm on Mar 22, 2004 (gmt 0)

10+ Year Member



Got it with BHOdemon. I still have to delete it from the registry, but atleast I know which one it is and can delete (BHOdemon has it disabled for now). Thanks DVDBurner and everyone else that helped. I'll post the reg entry tonight when I get home from work.

wellzy

2:32 am on Mar 26, 2004 (gmt 0)

10+ Year Member



Thanks for all the help. Here is what I found (and have since deleted:
C:\WINDOWS\2_0_1browserhelper2.dll and registry key: {83DE62E0-5805-11D8-9B25-00E04C60FAF2}

It was found and I could disable it with BHODemon. When that worked I deleted it with CWShredder.

Thanks again

wellzy