Click on a search result, but end up on other sites.

[WolfLover]

Ok, the past few days (I have had this happen on more than one computer), when I go to google.com and do a search for something, I click on a link that looks interesting to me and I get a totally different website, many times not even related to what I was looking for.

Then I copy and paste the correct address in, the correct site is there, but it is SO annoying that I can't just click on the links and be taken to the correct site.

This does not happen every time, but let's say maybe 20% of the time?

Has anyone else had this issue or know what to do about it?

Thanks!

[SteveWh]

This can happen if the website you are trying to visit got hacked so that it sends visitors to some other site. It would be unusual for you to encounter so many hacked sites in such a short time, but there is one type of hack that sends visitors to a different website when they come from a search engine, but allows them to get to the correct site if they typed the address in their address bar, and that does fit with what you described.

It can also happen due to malware on your computer doing something called "browser hijacking" where your browser starts sending you to sites you didn't intend. But it would be unusual for you to get more than one computer hijacked in the same way, unless both computers have poor antivirus protection and you visited the same website on both of them, so they both got infected with the same browser hijacking virus.

A third and much less likely possibility is that your ISP's DNS cache has been poisoned so that it's sending people to the wrong websites. That seems unlikely because you can get to the site ok with your address bar.

The only one you can really do anything about (other than wait and see if it resolves itself) is browser hijacking. If you're using antivirus software, do a full scan. If you're not, visit Trend Housecall or Norton (Symantec)'s online scanner (both free) and do a scan there.

[edited by: SteveWh at 5:00 am (utc) on May 15, 2009]

[tedster]

That could be a symptom of DNS Cache Poisoning [webmasterworld.com]. It could also be a sign that the target site has been hacked and is now hosting a script that "sometimes" redirects. Even some sophisticated malware hijacks the click just part of the time - but if the three computers are independent, I think that makes malware infection less likely.

These nasty "dark arts" traffic thefts can be hard to notice, and even when noticed, they can be hard to pin down and fix.

I'd say use Firefox and have the Live HTTP Headers add-on available. Then start by viewing the source code on the Google Search Results Page to verify the url in the link at its source. Then, with the add-on active, click on the link and track the information that goes back and forth between your browser and whatever servers get involved.

<added>
You're faster than me, SteveWh - and we hit on all the same points, too!

[SteveWh]

Simultaneous posting!

Each scenario sort of fits for one reason and sort of doesn't for another. It will be interesting what it turns out to be.

My suspicion is hacked sites, but how many hacked sites can a person accidentally stumble onto in a day? It's not that easy unless you're looking for them.

[dstiles]

I would add to tedster's advice on Firefox - get the NoScript addon - it not only blocks scripts but other things as well, including redirects. That may show up the problem but in any case is a good safety move.

[WolfLover]

I just had it happen again and I was going to the official government website for congress, again from a search on Google.

I am also using FireFox. I do have McAfee virus protection and Windows Defender and I have MalwareBytes on my computers.

Thanks for the advice, I'll do another full scan and see what comes up. I'm SO sick of these viruses, malware, etc. These hackers make me sick. I was on FaceBook and there is an app on there called Flair. I clicked on one of the Flair buttons (something I've done many times before) and both McAfee and Windows Defender said they just stopped a Trojan, however, before I could click on the button to kill it, my computer froze and I spent the next 5 hours trying to figure out how to get my computer back up. I finally did.

I've had to waste SO much time in recent weeks on this crap.

[WolfLover]

dstiles, thanks for the advice about the NoScript addon. As a test, I went back to the congress website from Google search as I had done a little while ago and I got to the correct website this time.

Thanks to everyone for the information and help!

[bwnbwn]

WolfLover from the last post I would feel it is your computer or computers that have been infected and the trojan got installed and past your security.

You said computers are they on the same router or office domain?

[dstiles]

Apart from the firefox tip, I would mention that downloads and links on "social networking" sites are VERY iffy. Hackers have apparently infiltrated most if not all of them.

There is an invaluable site about exploits of all kinds on the security blog at zdnet [blogs.zdnet.com]

<Note - I approved this link as it is an authoritative and useful resource.
but links to the "average blog" are not OK, per the Forum Charter [webmasterworld.com]>

[edited by: tedster at 10:00 pm (utc) on May 19, 2009]

[JohnRoy]

One virus checker is not enough if the symptoms are there.

TechSpot has an excellent article: 8-step Viruses/Spyware/Malware Preliminary Removal Instructions [techspot.com]

Follow instructions and play it safe

[edited by: tedster at 5:38 am (utc) on May 20, 2009]
[edit reason] add link [/edit]

[SteveWh]

WolfLover, do a web search on "gumblar". Sounds like it might be what your PC is infected with. One of the things it does is what you described, and it's very prevalent right now.

_________________________________________________________

< Moderator Note: Here is a CNet article about Gumblar attacks:
[news.cnet.com...] >

[edited by: tedster at 2:23 am (utc) on May 25, 2009]

[stevenjm]

ive noticed similar. on some top business results the url is incorrect. its a google error

[gyppo]

Could also be IP Based Cloaking that only redirect people if the referrer string is a Search Result.

That would explain why you still see the site if you paste the URL into the browser normally.