# Computer Hijack When Googleing **URL:** \ **Category:** Factual Questions\ **Created:** [August 17, 2011, 1:19am UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976 "2011-08-17T01:19:46Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Bosda\_Di\_Chi\_of\_Tricor](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bosda_di_chi_of_tricor/32/16845_2.png) [@Bosda\_Di\_Chi\_of\_Tricor](https://boards.straightdope.com/u/Bosda_Di_Chi_of_Tricor)\ **Post date:** [August 17, 2011, 11:01am UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/21 "2011-08-17T11:01:24Z")
> [@Marconi\_N.Cheese](#): > > Malwarebytes download: > [http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022\_4-10804572.html?part=dl-10804572&subj=dl&tag=button](http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button) > > I think you could probably use Hijack This! but it takes a bit of experience to interpret the results and you could hose something if you’re not careful. Could I be directed to an English-language site, please? I can read a little German, but I’d prefer more certainty. ---
**Author:** ![tnetennba](https://avatars.discourse-cdn.com/v4/letter/t/7993a0/32.png) [@tnetennba](https://boards.straightdope.com/u/tnetennba)\ **Post date:** [August 17, 2011, 11:04am UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/22 "2011-08-17T11:04:22Z")
> [@The\_Niply\_Elder](#): > > Your ISP is most likely to blame. Basically, they want to make some extra money, so instead of directly directing you to [www.google.com](http://www.google.com), they direct you to some intermediary shell (shill?) search company who skims some money off of google by pretending that they provided a service to google by referencing you to google (as if there was any chance I the world that you didn’t know of the existence of google, and they needed to act as a reference conduit to google) anyway, the whole scheme works with small time ISP copanies that can stay under the radar of these practices. > > The solution is to change the DNS servers used by your computer. A DNS server is basically like a huge phone book, but for the Internet, such that when you type the address [www.sdmb.com](http://www.sdmb.com), it looks up the real IP address of the server computer hosting this site. > > Long story short you have to change your DNS settings to 8.8.8.8 or 8.8.4.4 . These two DNS servers belong to google (basically google’s version of the Internet phone book) which is very trustworthy. > > Let us know if this fixes your problem. I find it extremely hard to believe that any reputable ISP would do this. ---
**Author:** ![The\_Surb](https://avatars.discourse-cdn.com/v4/letter/t/ce73a5/32.png) [@The\_Surb](https://boards.straightdope.com/u/The_Surb)\ **Post date:** [August 17, 2011, 11:17am UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/23 "2011-08-17T11:17:40Z")
I would be willing to bet that you have a google redirector rootkit. I seriously doubt it’s your ISP. Malwarebytes, hijackthis, and most virus scanners won’t touch it. Go to [bleepingcomputers.com](http://bleepingcomputers.com) forum, make an account (it’s free), and ask for help. Be forewarned, you **must be patient** , and the steps can be rather involved, but they will fix it. The tools to remove them are free. I do not know enough about rootkits and the removal tools that I feel comfortable telling you how to clean them, but I have removed several from the computers at work. ---
**Author:** ![Bosda\_Di\_Chi\_of\_Tricor](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bosda_di_chi_of_tricor/32/16845_2.png) [@Bosda\_Di\_Chi\_of\_Tricor](https://boards.straightdope.com/u/Bosda_Di_Chi_of_Tricor)\ **Post date:** [August 17, 2011, 12:51pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/24 "2011-08-17T12:51:48Z")
> [@The\_Surb](#): > > I would be willing to bet that you have a google redirector rootkit. I seriously doubt it’s your ISP. > > Malwarebytes, hijackthis, and most virus scanners won’t touch it. > > Go to [bleepingcomputers.com](http://bleepingcomputers.com) forum, make an account (it’s free), and ask for help. > > Be forewarned, you **must be patient** , and the steps can be rather involved, but they will fix it. The tools to remove them are free. > > I do not know enough about rootkits and the removal tools that I feel comfortable telling you how to clean them, but I have removed several from the computers at work. My skills are so poor that this is unhelpful. I need a link to Malwarebytes in English, please? ---
**Author:** ![tnetennba](https://avatars.discourse-cdn.com/v4/letter/t/7993a0/32.png) [@tnetennba](https://boards.straightdope.com/u/tnetennba)\ **Post date:** [August 17, 2011, 12:55pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/25 "2011-08-17T12:55:00Z")
> **[Cyber Security Software & Anti-Malware | Malwarebytes](https://www.malwarebytes.com/)** > > Protect your home and business PCs, Macs, iOS and Android devices from the latest cyber threats and malware, including ransomware. ---
**Author:** ![The\_Surb](https://avatars.discourse-cdn.com/v4/letter/t/ce73a5/32.png) [@The\_Surb](https://boards.straightdope.com/u/The_Surb)\ **Post date:** [August 17, 2011, 1:10pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/26 "2011-08-17T13:10:07Z")
It doesn’t matter WHAT language malwarebytes you use. Malwarebytes will NOT fix this. Good luck. ---
**Author:** ![ratatoskK](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ratatoskk/32/2987_2.png) [@ratatoskK](https://boards.straightdope.com/u/ratatoskK)\ **Post date:** [August 17, 2011, 1:53pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/27 "2011-08-17T13:53:46Z")
I had the same problem last week. The problem was only in Firefox with Google. IE was ok. I used IE to google for “google redirect virus” and basically everyone has a very hard time getting rid of it. I used a variety of utilities, then finally STOPZilla worked. (It is $10 for one year.) I’m not sure whether it worked in combination with the other stuff I was doing, or just by itself. Use IE, go to Google and search for “google redirect virus” and you’ll find a big variety of things people have tried. ---
**Author:** ![Sal\_Ammoniac](https://avatars.discourse-cdn.com/v4/letter/s/8dc957/32.png) [@Sal\_Ammoniac](https://boards.straightdope.com/u/Sal_Ammoniac)\ **Post date:** [August 17, 2011, 2:20pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/28 "2011-08-17T14:20:13Z")
> [@The\_Surb](#): > > I would be willing to bet that you have a google redirector rootkit. I seriously doubt it’s your ISP. > > Malwarebytes, hijackthis, and most virus scanners won’t touch it. > > Go to [bleepingcomputers.com](http://bleepingcomputers.com) forum, make an account (it’s free), and ask for help. > > Be forewarned, you **must be patient** , and the steps can be rather involved, but they will fix it. The tools to remove them are free. > > I do not know enough about rootkits and the removal tools that I feel comfortable telling you how to clean them, but I have removed several from the computers at work. This is the right answer. You can also try [Malwarecrypt.com](http://Malwarecrypt.com). The guy there will walk you through, step-by-step. It is a long process (takes about a week), and pretty involved. IT professionals, as I understand it, don’t go this route. They just reinstall the operating system. If that’s an option, consider it, because it’ll probably be faster. Oh, and I’m told that the Chrome browser is actually more effective at preventing this kind of infection in the first place. ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [August 17, 2011, 2:25pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/29 "2011-08-17T14:25:59Z")
> [@The\_Niply\_Elder](#): > > Your ISP is most likely to blame. You are so wrong it is not even funny. ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [August 17, 2011, 2:27pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/30 "2011-08-17T14:27:34Z")
> [@The\_Surb](#): > > I would be willing to bet that you have a google redirector rootkit. I seriously doubt it’s your ISP. Seconded Here is a direct download link to a rootkit killer that should get most of the common ones. [http://support.kaspersky.com/downloads/utils/tdsskiller.zip](http://support.kaspersky.com/downloads/utils/tdsskiller.zip) ---
**Author:** ![Bosda\_Di\_Chi\_of\_Tricor](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bosda_di_chi_of_tricor/32/16845_2.png) [@Bosda\_Di\_Chi\_of\_Tricor](https://boards.straightdope.com/u/Bosda_Di_Chi_of_Tricor)\ **Post date:** [August 17, 2011, 2:37pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/31 "2011-08-17T14:37:25Z")
> [@drachillix](#): > > Seconded > > Here is a direct download link to a rootkit killer that should get most of the common ones. > > [Kaspersky Knowledge Base](http://support.kaspersky.com/downloads/utils/tdsskiller.zip) I shall try this ASAP. Many thanks ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [August 17, 2011, 2:38pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/32 "2011-08-17T14:38:53Z")
> [@Sal\_Ammoniac](#): > > IT professionals, as I understand it, don’t go this route. They just reinstall the operating system. If that’s an option, consider it, because it’ll probably be faster. Alot of computer guys prefer the OS reload route because its never going to fail, and especially with mass deployed images, it takes just as long to restore an image as even bothering to scan for viruses. I work in small business support where “just nuke and reload” is often not the easy option. since reloading software and recreating things like file and printer shares for applications shared to 2-3 machines can turn into an all day project vs an hour or two if it can be cleaned in place. ---
**Author:** ![Bosda\_Di\_Chi\_of\_Tricor](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bosda_di_chi_of_tricor/32/16845_2.png) [@Bosda\_Di\_Chi\_of\_Tricor](https://boards.straightdope.com/u/Bosda_Di_Chi_of_Tricor)\ **Post date:** [August 17, 2011, 2:39pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/33 "2011-08-17T14:39:59Z")
> [@drachillix](#): > > Seconded > > Here is a direct download link to a rootkit killer that should get most of the common ones. > > [Kaspersky Knowledge Base](http://support.kaspersky.com/downloads/utils/tdsskiller.zip) Nothing. Can’t even find the problem. A bust. ---
**Author:** ![Bosda\_Di\_Chi\_of\_Tricor](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bosda_di_chi_of_tricor/32/16845_2.png) [@Bosda\_Di\_Chi\_of\_Tricor](https://boards.straightdope.com/u/Bosda_Di_Chi_of_Tricor)\ **Post date:** [August 17, 2011, 2:41pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/34 "2011-08-17T14:41:19Z")
> [@ratatoskK](#): > > I had the same problem last week. The problem was only in Firefox with Google. IE was ok. I used IE to google for “google redirect virus” and basically everyone has a very hard time getting rid of it. I used a variety of utilities, then finally STOPZilla worked. (It is $10 for one year.) I’m not sure whether it worked in combination with the other stuff I was doing, or just by itself. Use IE, go to Google and search for “google redirect virus” and you’ll find a big variety of things people have tried. Got a direct link to Stopzilla? ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [August 17, 2011, 2:46pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/35 "2011-08-17T14:46:13Z")
> [@psychonaut](#): > > I suspect **The Niply Elder** is correct, at least if you have an American ISP. A couple weeks ago a research project released its findings that there is widespread hijacking of search traffic by American ISPs. You can read [a report from the Electronic Frontier Foundation on the matter](https://www.eff.org/deeplinks/2011/07/widespread-search-hijacking-in-the-us). Notably missing from the list are all the common players, AT&T, Comcast, Time Warner, Covad, Verizon… These few companies represent around 95% of the internet users in the country, so most of the places who are doing this are small fringe outfits desperate to make a couple extra bucks. ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [August 17, 2011, 2:55pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/36 "2011-08-17T14:55:20Z")
stopzilla download. > **[AntiVirus | Virus Removal Software - STOPzilla](https://www.stopzilla.com/products/stopzilla-antivirus/?aid=10642&cid=stopzilla&gclid=CMjdkprK1qoCFSY0QgodwmaO8A)** > > STOPzilla AntiVirus for Windows offers multiple levels of protection against viruses and malware. With powerful anti-rootkit technology and reliable active scanning. Try this virus removal software here. Have you tried using the rootkit killer in AVG? AVG has its own rootkit scanner that you have to run separately, its not part of the normal scanner. ---
**Author:** ![psychonaut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/psychonaut/32/4655_2.png) [@psychonaut](https://boards.straightdope.com/u/psychonaut)\ **Post date:** [August 17, 2011, 3:11pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/37 "2011-08-17T15:11:10Z")
> [@tnetennba](#): > > I find it extremely hard to believe that any reputable ISP would do this. According to [an article in the _New Scientist_](http://www.newscientist.com/article/dn20768-us-internet-providers-hijacking-users-search-queries.html), the following ISPs are currently or were recently hijacking their customers’ search traffic: > [@](#): > > Cavalier > Charter > Cincinnati Bell > Cogent > Frontier > Hughes > IBBS > Insight Broadband > Iowa Telecom > Megapath > Paetec > RCN > Wide Open West > XO Communication I don’t know how reputable they are, but together they have several million subscribers. ---
**Author:** ![ratatoskK](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ratatoskk/32/2987_2.png) [@ratatoskK](https://boards.straightdope.com/u/ratatoskK)\ **Post date:** [August 17, 2011, 3:11pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/38 "2011-08-17T15:11:56Z")
There is a comment to a PC Mag article about a Google redirect virus removal tool. I have not tried it and know nothing about it, just FYI. [http://fixredirectvirus.org/?hop=dineshktl](http://fixredirectvirus.org/?hop=dineshktl) ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [August 17, 2011, 3:16pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/39 "2011-08-17T15:16:36Z")
> [@The\_Surb](#): > > I would be willing to bet that you have a google redirector rootkit. I seriously doubt it’s your ISP. > > Malwarebytes, hijackthis, and most virus scanners won’t touch it. > > Go to [bleepingcomputers.com](http://bleepingcomputers.com) forum, make an account (it’s free), and ask for help. > > Be forewarned, you **must be patient** , and the steps can be rather involved, but they will fix it. The tools to remove them are free. > > I do not know enough about rootkits and the removal tools that I feel comfortable telling you how to clean them, but I have removed several from the computers at work. Based on your knowledge levels, you really just need to do this. I sat down trying to describe what I would do, and I realized that, at several points, you might run into problems. These guys will have the patience to walk you through them. ---
**Author:** ![Bosda\_Di\_Chi\_of\_Tricor](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bosda_di_chi_of_tricor/32/16845_2.png) [@Bosda\_Di\_Chi\_of\_Tricor](https://boards.straightdope.com/u/Bosda_Di_Chi_of_Tricor)\ **Post date:** [August 17, 2011, 3:52pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/40 "2011-08-17T15:52:10Z")
> [@tnetennba](#): > > [http://www.malwarebytes.org/](http://www.malwarebytes.org/) GGGOOOOOAAAAAAALLL!! Malwarebytes for the win!!! [Previous page](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976.md?page=1) [Next page](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976.md?page=3)