google hijacking?

Discussion in 'Computer Support' started by richard, Dec 13, 2008.

  1. richard

    richard Guest

    Seems to me that for the past few weeks at least, I've been
    experiencing something odd with google.
    I use Firefox 2.

    Makes no difference what search I do. The first 5 or 10 hits always
    get hijacked.
    Here's an example. I just searched for "RIAA".
    Hit #1 www.riaa.com/
    Click #1:
    http://www.yellowbook.com/?se=7&cid...=ask&utm_medium=cpc&utm_campaign=roc+business
    click #2:
    http://www.blinkx.com/category/news?adid=12-100-201-300-404-1&p=1
    click #3
    http://www.blinkx.com/video/they-said-what-monday-december-08/IbueFdbA_y5YQyb4wnR4dA/rf
    click #4:
    www.riaa.com

    Is this google's doing or some spyware crap I might have or what?
    Might not be google. I just tried it in IE 7 and got the right site on
    the first click.
     
    richard, Dec 13, 2008
    #1
    1. Advertisements

  2. Consider upgrading to version 3.
    http://www.google.com/search?hl=en&q=RIAA&btnG=Google+Search
    produced these first four:
    http://www.riaa.com/
    http://www.riaa.com/aboutus.php
    http://en.wikipedia.org/wiki/RIAA
    http://www.boycott-riaa.com/
    I'd bet on your spyware or sumpin'.

    Try cleaning out your history and cache.
     
    Beauregard T. Shagnasty, Dec 13, 2008
    #2
    1. Advertisements

  3. richard

    richard Guest

    I was using 3. There was an issue with downloading. If during
    downloading the page you were on changed, the downloader would be
    tricked into thinking the download was done when the new page loaded.
     
    richard, Dec 13, 2008
    #3
  4. ...but.. not when you had this google problem? Or did you mean ??
    Downloading what? Link to a file? Or do you mean "grabbing the page
    itself from the server?" Was there supposed to be a comma between
    "downloading" and "the page?"
    Were you were doing a 'refresh' before the whole page loaded? I can't
    see any other way a page could 'change' once you first asked for it. You
    will have to explain this so-called downloading problem using better
    sentence structure.

    I'd guess news pages would be the most likely to change frequently. I
    read numerous news sites several times a day, and have never noticed
    Firefox 3 to be 'tricked' into anything.

    In any case, I've been using Firefox 3 since it was released and have
    seen no symptoms as you describe (for whatever meaning you meant).

    [snip rest as you didn't address it]
     
    Beauregard T. Shagnasty, Dec 13, 2008
    #4
  5. richard

    elaich Guest

    I just went back to 2. 3 isn't ready for prime time yet, and it's slowly
    becoming an annoying, hand holding net nanny.

    "You appear to have add-ons that are not compatible with Firefox 3, so all
    compatibility checking has been disabled."

    3 wouldn't remember passwords properly, and was prone to forgetting my last
    session. I also don't like what they did to the bookmarking system in 3.

    There's a reason Mozilla is still supporting 2. They know 3 isn't anywhere
    near ready.
     
    elaich, Dec 13, 2008
    #5
  6. richard

    catchme Guest

    i havent encountered that particular problem....
     
    catchme, Dec 13, 2008
    #6
  7. Neither have I. <wonders what add-ons he has...>
     
    Beauregard T. Shagnasty, Dec 13, 2008
    #7
  8. richard

    Pennywise Guest


    Go here http://hijackthis.de/en download
    http://download.hijackthis.eu/HJTInstall.exe

    No need to install, just run it; Scan, save log, copy then, paste the
    log file into http://hijackthis.de/en click analyze. Google first of
    course, but Red should be deleted and yellow researched.

    And whatever it is could be in your restore points. so turn restore
    off.
     
    Pennywise, Dec 13, 2008
    #8
  9. richard

    richard Guest


    I did. It didn't find anything that could be the culprit.
    Noting some programs I have were shown as "NASTY!".
    Simply because I don't have them in their default locations.
    Another program I have used for years was reported as a virus.
    Couple of programs I've used were shown as UNKNOWN.

    So I'm assuming that there is something in FF which is causing this to
    happen.

    At least it's not with all the hits. Just the first 10 or so.
     
    richard, Dec 14, 2008
    #9
  10. richard

    richard Guest

    SOLVED!

    Installed and ran malwarebytes.
    Found I had 6 items that were marked as "Dns changer" and 3 trojans.
    Now when I click on the first hit, I get that web page.
     
    richard, Dec 14, 2008
    #10
  11. §ñühw¤£f, Dec 14, 2008
    #11
  12. richard

    Pennywise Guest

    From the link

    System requirements:
    Operating System:
    Microsoft™ Windows™ Vista
    Microsoft™ Windows™ XP
    Microsoft™ Windows™ 2000
    Microsoft™ Windows™ Me
    Microsoft™ Windows™ 98
    Software:
    Microsoft Internet Explorer 6.0 or 7.0
    Mozilla™ Firefox™ 1.5 or 2.0

    - and it works just find with Opera.
     
    Pennywise, Dec 14, 2008
    #12
  13. richard

    Pennywise Guest

    I was going to mention you could of:

    Start | Run <type in>
    ipconfig /flushdns
    <enter>
     
    Pennywise, Dec 14, 2008
    #13
  14. Hah! I win the prize! ;-)

    "I'd bet on your spyware or sumpin'."
     
    Beauregard T. Shagnasty, Dec 14, 2008
    #14
  15. Interesting. I installed it (got the missing .dll file added so it would
    work) and after running it it produced a nice notepad logfile. I looked at
    that, scratched my head, mumbled, and saw a button on the widget that said
    "verify" or something. So I clicked that and it loaded their webpage up
    and gave me an error about it not working with w98.
    So I'm behind the lerning kerve, again.
     
    §ñühwØ£f, Dec 14, 2008
    #15
  16. richard

    Pennywise Guest

    I only use hijackthis to produce the log which I paste into
    http://hijackthis.de/en -

    Anything else wants to take you to Trend Micro - you don't need them,
    it's just another website you would need to log onto.

    http://hijackthis.de/en are instant results as well.
    But then I do google the unknown or questionable items.
     
    Pennywise, Dec 14, 2008
    #16
  17. Ok...thats what it did when I tried it.
    I'll cut & paste the logfile into the site next.
    In other news...
    When I fired up my win98 lappy I got some weird connections in my firewall
    that seem suspicios...all on port 53...
    192.112.36.4:53
    192.32.64.12:53
    192.8.10.90:53

    A g00gle suggested a DNS exploit might be happening since port 53 is for
    that.
    Any ideas?
     
    §ñühwØ£f, Dec 15, 2008
    #17
  18. richard

    Pennywise Guest

    Might try Shields up http://www.grc.com/intro.htm
     
    Pennywise, Dec 16, 2008
    #18
  19. Did...said all service ports were stealthed.
    But my system will reply to a ping :(
    Haven't figured that one out just yet.
     
    §ñühwØ£f, Dec 16, 2008
    #19
  20. richard

    Walter Guest

    Do you have file/print sharing enabled on that machine? If so, try
    disabling it. I run XP across the board so I don't know if it's the same
    with 98, but Shields Up has always reported that all of my machines 'fail'
    because they will respond to a ping as long as I have file/print sharing
    enabled. If I shut it off, I "pass". I don't worry about. Being pinged is
    like somebody knocking on your door. They can knock all they want but they
    can't get in unless you were stupid enough to leave the door open. Or you
    *let* them in on purpose. :)
     
    Walter, Dec 16, 2008
    #20
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.