Forum Moderators: open

Message Too Old, No Replies

The Google Toolbar has been hijacked and replaced by scumware

         

Marcia

8:00 am on Nov 15, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



No kidding, the Google toolbar's been replaced by another toolbar altogether. Don't know how it happened, but how do I get rid of this thing?

It's got "affiliate" and "day trading" plus another couple others across it. No, I didn't accept any downloads.

This was the last site I was at when it happened - #2, The Elements of Style at bartleby.com

[google.com...]

A search with this thing takes you here:
ww2.ieplugin.com/q.cgi?q=google%20toolbar

The browser froze up when a popup ad loaded, next thing when a new browser window is opened it's got the other toolbar.

I grabbed a screenshot in Photoshop, includiing the URL of where it goes when I do a search. Where do I send it to report it?

Added:
I went to View > Toolbars and disabled what's there now, called Intelligent Explorer. It's not showing, but the entry is still in the menu and the Google Toolbar is gone altogether.

Birdman

8:19 am on Nov 15, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Hi Marcia. You probably just read this but, here is another thread.

[webmasterworld.com...]

Woz

8:26 am on Nov 15, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I noticed an advertising campaign offer for this plugin this morning but declined to show them. Looked a bit too iffy. This afternoon the offer has dissapeared. I assume the banner company has removed it.

I guess you will need to remove it via "add/remove programs" and reinstall Tooglebar.

Onya
Woz

Marcia

8:30 am on Nov 15, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



OK if someone needs to remove this post, but this is what the thing looks like (loads slow)

[welterweb.com...]

Marcia

6:35 pm on Nov 15, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



This is serious, I cleared cookies, uninstalled, rebooted and downloaded the google toolbar again. I just turned the computer on and that thing is back.

No idea what this is, or how to permanently get rid of it.

korkus2000

6:38 pm on Nov 15, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I had my default search page hijacked and the only thing that got rid of it was a format. I hope this is not the case for you. You need to contact google about it.

jatar_k

6:46 pm on Nov 15, 2002 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



Have you looked through the registry to see if there is anything in there?

maybe in
HKEY_CURRENT_USER/software/google/navclient/
or
HKEY_CURRENT_USER/software/Microsoft/Internet Explorer/MenuExt/

not sure if there are other spots but those are the ones I have.

Marcia

6:48 pm on Nov 15, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I emailed Google, all I got is an autoresponder. So now what it amounts to is that having the toolbar on my computer is like having scumware.

Macguru

6:55 pm on Nov 15, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I emailed Google, all I got is an autoresponder.

Ho thats new, they used to ignore emails. Let me gess, they tell you to buy addwords to fix your problem? :)

jdMorgan

7:20 pm on Nov 15, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Marcia,

How about running AdAware, the scumware remover - does that help?

Jim

Marcia

7:21 pm on Nov 15, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Problem is, now it's there permanently, and even when uninstalling and reinstalling, when a new browser window is opened, it's causing the regular toolbar NOT to be there, and I need it to work.

Google needs to do something, because at this point the toolbar is opening the door to people having costly computer problems. How many people will have to pay a tech to reformat their hard drive and reinstall everything? And lose software they paid for if it was downloaded and they don't still have the registration information.

Brad

7:33 pm on Nov 15, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I would try Adaware. Is is possible to uninstall IE and then reinstall it? I suppose it is too imbedded in Win.

jatar_k

7:48 pm on Nov 15, 2002 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



I would hunt it down, it has to connected to the google toolbar somehow. If not in registy then somewhere else.

If you track down every part of the toolbar there has to be a piece that is showing the other one.

Marcia

9:21 pm on Nov 16, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



No matter what I do, the toolbar won't install - no matter how many times I uninstall, clear cookies and reboot.

What it amounts to now is that I have to have to pay a technician to come in and take care of this, and possibly buy a CD-r/w to back up, reformat and buy some new software to replace what gets lost - not cheap. Very expensive deal here, and I can't work without it for a lot of what I do.

This is a parasite that's attaching when the toolbar is present, and Google really needs to do something besides send auto-responder messages. It's apparently the presence of the toolbar that's creating the vulnerability.

percentages

10:01 pm on Nov 16, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Marcia,

Download adware from cnet or tucows and run that, it's free to download. I had a similar problem two weeks ago, everytime I did a Google search it took me to Lycos! Adware fixed it.

The problem is most likely caused by "spyware" that has been loaded on your PC. At sometime you probably clicked on what you thought was the close box for a pop-up ad window and that pop-up tricked you into installing some spyware software that hi-jacks the Google Toolbar. I didn't even notice it happening to me, the install is totally invisible.

These spyware people need legal action taking against them, I know of 4 people who have been caught by the same trick in the last few weeks. One client phoned me and asked why I had turned his web site into a porn site! Sure enough on his PC everytime you typed his url into IE you ended up displaying a porn site instead. Adware fixed that also.

If adware doesn't fix it please be a good net citizen and send adware an email about this thing, then they will build it into their scan so we can all easily combat it in the future. :)

buckworks

12:45 am on Nov 17, 2002 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



This stuff is a PLAGUE.

Get Ad-Aware from [lavasoftusa.com...]

It's pretty good at finding and removing spyware, scumware etc.

mack

12:53 am on Nov 17, 2002 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



Marcia...

Does your OS have system restore, would that be of any use?

I had a very similar problem a few weeks ago and I went to the toolbar changes page and checked the box to remove advanced features.. I then went to add remove programs and removed the entire toolbar. went back to google and got a fresh install...seamed to work ok.

Hope you got it fixed.

When I tried to simply remove and re-install the thing ( with advanced features still set) it was back to square one after the re-instal and the blighter was still there.

GoogleGuy

8:49 pm on Nov 17, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Marcia, it's not an issue with the Google toolbar, it's just that some scumware is really predatory. It will uninstall other programs/toolbars you have installed and install itself in ways that are nearly impossible to get rid of. Beside Ad-Aware, you might look for a program called BHO Cop. BHO stands for Browser Helper Object, and it's one way that IE plugins can install themselves.

So this is not a Google Toolbar issue--the scumware can do whatever it wants once someone runs the program somehow.

Marcia

9:51 pm on Nov 17, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



GoogleGuy, when that happens temper flares and the first thing is to go to Google's toolbar page looking for help. A concern is that some might hesitate to download the toolbar.

There's info on pop-ups at the site, maybe it would be a good idea to have a link from somewhere a person who's been infected would likely to be looking for help so they could easily find info on popups and parasite-ware, done subtly so it wouldn't be inadvertantly connected with the toolbar.

In spite of possible excessive crosslinking ;), a few small text links to some Google help areas at the bottom of these pages wouldn't hurt - that's the first place I looked.

[toolbar.google.com...]

Even after uninstalling and going through the whole routine, the toolbar wouldn't install, said it was already present - devastating to a toolbar addict.

To be perfectly honest, an auto-responder message with somewhat helpful information, even links to a few good spots in Google's help pages that are relevant to common problems just as a FYI, would help tremendously rather than just sending a generic that says basically nothing. It wouldn't be bad in terms of appearing to be more service oriented. The response message got me even madder than I was. I know Google's free, but any time a fluff autoresponder message is sent out it's a missed opportunity for building ongoing tighter relationships, as well as slipping in a subtle sales letter.

Interesting that when trying to go to an information page on the Ad-aware site I couldn't get there - that predator hijacked me straightaway to a page on the offending site. Opera saved the day, I downloaded Ad-Aware and that thing is gone, fortunately. There were 47 components found in the Windows Registry, plus a similar number on the C-Drive. I had more garbage in there than the city dump.

Thanks, people. I never gave this too much thought until it hit where really it hurt. I'll go through the suggestions and see what else needs to be done. It seems to be solved now; I was so mad I couldn't think - thanks for all your help and support.

ukgimp

9:07 am on Nov 18, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



This sort of thing happened to me 8 months ago. Loads of pop up windows and while attempting to close that down it set my homepage and installed a toolbar. I thought I had cleared my system up until I accidentaly clicked search in IE, and it was still there and my action reinstalled all the old favorites, toolbars etc.

Absolute scum!

After that I started using AdAware by Lavasoft.

RoadRash

6:17 pm on Nov 29, 2002 (gmt 0)

10+ Year Member



I can confirm that AdAware will remove this parasite from your computer. If you have not done so, please download this application, its a life saver!

GoogleGuy

5:30 am on Nov 30, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Glad that you got your scumware cleaned off your system, Marcia. I totally agree with how annoying it is, and even though it technically doesn't have much to do with Google or our toolbar, other than hijacking your start or search page, I agree 100% that Google could try to give some basic info to help users avoid the the annoyance of dealing with these programs.

The "no pop-ups" page did a lot to educate consumers about scumware. Based on your experience, I'll talk to a few people and see what they think. Things are always busy at Google, but I'm hearing your suggestions loud and clear--thanks for the post.

Does anybody have specifics about some of these programs? Program/company names, worst offenders, good pointers to anti-scumware sites? It looks like and.doxdesk.com/parasite has gone away, which was a fantastic resource site.

Visit Thailand

5:43 am on Nov 30, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Marcia, it is amazing how many companies do not understand this or act on it in any way,
it's a missed opportunity for building ongoing tighter relationships, as well as slipping in a subtle sales letter.

Anyway I am glad you got it fixed.

Hoople

6:08 am on Nov 30, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I've had a few Trojans sneek in too. My firewall usually flags them though as "such-a-scummy-app.exe wants to connect to 999.888.777.wayovertheocean.com, do you want to allow this?" My firewall alert usually gives the full path to it which then allows me to zap it and find how it launches. It's usually win.ini load= or run= but can be in the registry too.

Make sure your firewall is highly rated as some of the wannabe's are so so to no with this kind of alerting.

Run these trojan/scumware killers regularly as a second check sometimes finds ones that are programmed to lay low for a time (or trigger on a special day).

JonB

7:17 am on Nov 30, 2002 (gmt 0)

10+ Year Member



marcia, you already lceared it but does this look like your toolbar? site he mentions has simmilar desing like your toolbar:

[experts-exchange.com...]

i did a search on "scum toolbar" on google.i guess it is jsut simmilar like yours.

EliteWeb

7:24 am on Nov 30, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Would what has happened in anyway be illegal? It seems like it could be if indeed the user didn't act for the installation/modifications to take place. Is this something due to IE's setup and nature or beyond that.

If I went through what some of you explained I would be knocking on the persons door who did the deed.

DaveAtIFG

11:37 pm on Nov 30, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Is this something due to IE's setup and nature or beyond that

It's a shortcoming in IE and the scripting it supports. If memory serves, IE allows considerably more access to system resources (via ASP scripts I think) than Java does. In a recent post in another thread, an individual posted that he could create a script that could format a user's hard drive.

I continuted using NS4 (Communicator) as my primary browser and personal email app until Opera 6 was released (included a decent email program) simply to avoid these problems. Only use IE to visit trusted sites, never for general surfing, IMHO.

Outlook is program I have always refused to use. I have no recollection about the security issues, I suspect they're similar to IE, but it's the most common target for most email type attacks.

I'm behind a hardware AND a software firewall, and Norton AntiVirus is script blocking and scanning all email, so far it's working pretty well. Paranoid? Maybe, but I prefer to think of it as careful! :)

ann

6:28 am on Dec 2, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



It's lavasoft.de now....the .com site has been gone for a while.

Ann

edit: ditto on the paranoid!

Mohamed_E

12:41 pm on Dec 2, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



There is also a US site at www.lavasoftusa.com.