# Computer Hijack When Googleing

**URL:** <https://boards.straightdope.com/t/computer-hijack-when-googleing/592976>\
**Category:** Factual Questions\
**Created:** [August 17, 2011, 1:19am UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976 "2011-08-17T01:19:46Z")\
**Posts on this page:** 9\
**Page:** 3

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [August 17, 2011, 3:53pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/41 "2011-08-17T15:53:30Z")

</div>

> [@ratatoskK](#):
>
> There is a comment to a PC Mag article about a Google redirect virus removal tool. I have not tried it and know nothing about it, just FYI.  
> [http://fixredirectvirus.org/?hop=dineshktl](http://fixredirectvirus.org/?hop=dineshktl)

$29, and it is just a collection of instructions for existing using tools like MalwareBytes, HitmanPro and Combofix.

---

<div class="post-metadata">

**Author:** ![JoelUpchurch](https://avatars.discourse-cdn.com/v4/letter/j/f05b48/32.png) [@JoelUpchurch](https://boards.straightdope.com/u/JoelUpchurch)\
**Post date:** [August 17, 2011, 5:40pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/42 "2011-08-17T17:40:34Z")

</div>

I had the problem with Firefox and never managed to fix it. I’m using Seamonkey now.

---

<div class="post-metadata">

**Author:** ![Ferret\_Herder](https://avatars.discourse-cdn.com/v4/letter/f/e47774/32.png) [@Ferret\_Herder](https://boards.straightdope.com/u/Ferret_Herder)\
**Post date:** [August 17, 2011, 5:47pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/43 "2011-08-17T17:47:27Z")

</div>

> [@Bosda\_Di\_Chi\_of\_Tricor](#):
>
> Could I be directed to an English-language site, please?
> 
> I can read a little German, but I’d prefer more certainty.

That is an English-language link, FWIW.

---

<div class="post-metadata">

**Author:** ![filmore](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@filmore](https://boards.straightdope.com/u/filmore)\
**Post date:** [August 17, 2011, 6:34pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/44 "2011-08-17T18:34:13Z")

</div>

I fixed a friend’s computer with a virus which did the google redirect. It was nasty. Every time I cleaned it off it came back. Tried multiple virus scanners, malware cleaners, and rootkit checkers. Each time they removed it but it came back each time. It turns out it was also in the boot record. I think I used tdsskiller to get rid of it there and that did the trick. It was something like this:

-Do a full scan with avast  
-Do a full scan with malwarebytes  
-Run tdsskiller  
-Reboot  
Good luck! If tdsskiller didn’t work I was just going to reinstall the computer as I had tried everything else. If you do reinstall, either get a new disk or do a full wipe of the disk **including the boot record**. If you don’t wipe the boot record you risk the virus coming back after reinstall.

---

<div class="post-metadata">

**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\
**Post date:** [August 17, 2011, 11:06pm UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/45 "2011-08-17T23:06:43Z")

</div>

> [@Marconi\_N.Cheese](#):
>
> Malwarebytes download:  
> [http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022\_4-10804572.html?part=dl-10804572&subj=dl&tag=button](http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button)
> 
> I think you could probably use Hijack This! but it takes a bit of experience to interpret the results and you could hose something if you’re not careful.

There are, however, several sites where you can post logs from HijackThis etc. and people will help you debug the thing. I worked with someone at one of the MalwareBytes forums; the sticky here at the SDMB has some other suggestions. The folks there will work with you on running ComboFix and other cleanup tools.

One of the things he asked was whether we were getting redirects ( we were not, as it hapened). It turned out we had a rootkit hiding under my daughter’s user. Probably from a bad ad or something on some site she went to. Thankfully, she didn’t have admin rights, so the damage was limited.

For the record, MalwareBytes and AVG both failed to find the rootkit.

---

<div class="post-metadata">

**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\
**Post date:** [August 18, 2011, 4:17am UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/46 "2011-08-18T04:17:22Z")

</div>

> [@Bosda\_Di\_Chi\_of\_Tricor](#):
>
> GGGOOOOOAAAAAAALLL!!  
> Malwarebytes for the win!!!

Oh. I thought you already tried that one.

Still, you need to go through and rescan with all your other tools to make sure there are no nasties left that the rootkit was hiding from you.

---

<div class="post-metadata">

**Author:** ![DaveEn](https://avatars.discourse-cdn.com/v4/letter/d/c37758/32.png) [@DaveEn](https://boards.straightdope.com/u/DaveEn)\
**Post date:** [August 18, 2011, 9:43am UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/47 "2011-08-18T09:43:52Z")

</div>

visit [http://www.pornsmacker.com](http://www.pornsmacker.com), it has a worthy compendium of free adult videos…

---

<div class="post-metadata">

**Author:** ![DaveEn](https://avatars.discourse-cdn.com/v4/letter/d/c37758/32.png) [@DaveEn](https://boards.straightdope.com/u/DaveEn)\
**Post date:** [August 18, 2011, 9:48am UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/48 "2011-08-18T09:48:53Z")

</div>

visit [http://www.pornsmacker.com](http://www.pornsmacker.com), it has a worthy library of free adult videos…

---

<div class="post-metadata">

**Author:** ![DaveEn](https://avatars.discourse-cdn.com/v4/letter/d/c37758/32.png) [@DaveEn](https://boards.straightdope.com/u/DaveEn)\
**Post date:** [August 18, 2011, 9:52am UTC](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976/49 "2011-08-18T09:52:54Z")

</div>

take a look at [http://www.pornsmacker.com](http://www.pornsmacker.com), it has a good selection of free porn videos…

[Previous page](https://boards.straightdope.com/t/computer-hijack-when-googleing/592976.md?page=2)
