Evil malware has hijacked Google, gives me a page of ads instead of Google hits.

Factual Questions
1

What I get for a Google search (for example, for “lyrics old man river”) is a page of links to ads, instead of a page to links to web pages that have the lyrics to “Old Man River” on them.

This is what I get:

And those are all links to the same URL (although they show different names down in the tray): http://216.221.138.95/ And no, I’m not stupid enough to click on that to find out where it goes.

Now, if I click on “Next” at the bottom of my Google’s Evil Twin Search Results, up comes a normal-appearing page of Google hits (I didn’t know Reba McIntyre had a song “Old Man River”), which says “Page 1”. However, if I put in a new search string on that page (“lyrics numb”), I once again get the Google’s Evil Twin search results. And then I can click on “Next” and it will bring up the real page of Google hits for the lyrics to “Numb”.

WinXP Home Edition, IE 6.

I have Google’s Toolbar with popup blocker installed. Since January, it has worked fine. It is also incidentally blocking a popup that appears when the Google Evil Twin search results page appears.

However I am now also getting other miscellaneous popups which are not being blocked.

**I have Adaware 6 (free personal version).

I have Spybot.**

I have been running them, with updates, practically nonstop since yesterday. They remove a bunch of crap off and on (Clientman, Jeired, others), but whatever this is, it keeps coming back, and it isn’t necessarily showing up on Spybot or Adaware.

I have checked Microsoft for security patches for XP and/or IE.

This is a home computer, no network. No firewalls, no virus software. Normally we don’t need them.

Please do not suggest that I simply purchase your favorite anti-virus software and run it.

Please do not suggest that I simply switch to a different browser.

Or that I simply get a Mac.

Please do not suggest that in the future I “think” before clicking on any .exe files or attachments. I assure you, everyone in my family is perfectly conversant with those particular Internet ground rules. This scumware installed itself in the wee hours Sunday morning on our computer all by itself while someone at this end was surfing the web in a perfectly normal way.

Sorry if that all sounds pissy, but that’s the sum total of the advice I’ve gotten so far IRL at this end: “Get Netscape/get Norton/get a Mac/tell your kids not to download stuff”. None of that is helpful.

Since apparently it doesn’t do this with Google Canada or Google NZ, I could just use them. Or I could go ahead and use Google.com, and just keep on running Adaware and Spybot once a day, like I already normally do, and ignore the first page of spurious Google hits I get every time I do a Google search.

But dammit, I want this crap the FUCK off my 'puter.

Anybody have any ideas?

I have checked Spybot’s BHO list, and there’s nothing on there that has a red check mark.

Obviously this thing has some .dll or pre-fetch thingie quietly installed somewhere. If someone can give me a hint, I can go look for it. I’m not afraid of regedit (I’m desperate enough that I’m considering a complete reformat) so I’m open to suggestions.

And it doesn’t keep showing up in Spybot or Adaware, whatever it is. I run them, they say it’s clean, but I’m still getting the Google’s Evil Twin page of search results. And then I go back to Spybot and run it again, and it still tells me “Congratulations! No immediate threats were found.”

2

Run HijackThis and post the log. It may give hints as to what malware is responsible.

You could also try CWShredder. It removes some things that Spybot and Ad-aware miss.

3

Well, you could get a kids buy a Mac …

the url you listed looks like it’s some sort of browser hijack thingy and definitely scumware related.

If you can get to this page it gives instructions on how to get rid of one of the worst offenders.

4

Here’s a post by someone who had the same problem. Apparently the latest version of CWShredder will get rid of it.

5

Thanks! (I maintain that page, actually.)

If it’s not CWShredder, go to the other antispyware pages and run either Ad-Aware or Spybot S&D. As a matter of fact, it’s a good idea to install one of the two on your computer and run it from time to time.

Also, get Spyware Blaster – same location.

6

I agree. HijackThis is very powerful but it’s not for the inexperienced user. It’ll show exactly what’s plugged into your browser, and from there we can figure out the best tool to remove it.

7

Mentioned in the OP.

Seconded. This is another very good tool and is easy for anyone to use, unlike HijackThis.

8

I am :slight_smile:

(I’m on a Mac, so I go anywhere I please)

On my machine it goes to

(That could possibly be due to some barrier stuff implemented on our network, but they don’t do much of that around here).

It appears to reconcile to something in New Canaan CT;

SamSpade reports:

9

No problem :cool:

10

I am glad DDG posted this, because I’ve had the same problem with google for a few weeks now.

Number, I read that link (it worked earlier today, but not now) and I had already run CWSShredder…it didn’t help a bit. :frowning:

I, too, have run both Ad-aware and Spybot S&D. The google problem is still there. Not wanting to totally take over DDG’s thread, I will wait for her to post her results from hijackthis (which I have also run) and see if any of you gurus can tell me what to delete.

Some of them are kind of obvious, but there are a few on there I am a little wary of deleting.

Thanks for any help you guys can give!

11

Okay, I have installed Spywareblaster, although it tells me it can’t remove anything, just prevent spyware from installing itself.

And here is the Hijackthis logfile.

[shrug]

12

Ok, I hunted around (even on my Evil Google Twin!) and found that when I deleted this:

BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll

it got rid of Evil Google. I did not see that one on your list, Duck Duck Goose but I am betting that one of the other “no names” on your Hijack This log is the culprit.

I did not bookmark the message board that helped me (I will try to locate it again), but another person also mentioned that completely getting rid of the google toolbar did the trick for her. I never have used the google toolbar, so I knew that wasn’t my problem.

If anyone else knows which exact “no name” you need to check on, please let her know. Y’all have no idea how big a pain this thing is.

13

This is the message board I found my help on. I must have seen the post about deleting the google toolbar on another of the fifty boards I visited trying to fix this mess.

There’s also another link on this board that may help you. I hope so…because I sure did feel your pain. I know that I feel much better since Evil Google is gone.

Oh and I also clicked my WinXP firewall to “on”. I have also been bombed with myriad of Trojan horses lately, and figured a little protection from these things is better than none. Might help the Evil Google problem, as well.

14

OK, here’s an analysis:

First move Hijackthis to its own folder and run it from there. The allows it to make backups.

Next, close MSIE, run Hijackthis, click on “Scan,” and put a check mark by the following:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310}_ - (no file)
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
O2 - BHO: (no name) - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - C:\WINDOWS\System32\mshkof.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/244e0ae...ip/RdxIE601.cab
O16 - DPF: {986DDE35-E955-11D0-A707-000000521958} - http://69.56.176.75/webplugin.cab

Restart your computer. Search for the following, and if you find it, delete it:

mshkof.dll

See if that helps.

15

OOPS! Forgot to mention – after you check the items, click on “Fix Checked” and delete them. Then restart your computer.

16

Okay, are you saying that a BHO named mshkof.dll is the culprit? Because I already know it’s on my system: Spybot Advanced Mode will tell you a list of all the BHO that are there, and “mshkof.dll” is mentioned. But it has a date of 8-22-01, not 4-18-04, and it says “Bundle”, and it says that scary-lookin’ “Windows System 32”, which I know is NOT something that the Average Consumer is supposed to mess with, so I assumed it was something that came with this computer. It’s not?

17

…I have a firewall in this thing?? [looks around instrument panel] I learned how to drive one a these things on a Windows 3.1, I still don’t know what all these bells ‘n’ whistles do…

So, wherezitat?

Criminently

18

I have had so much trouble recently, these malware/spyware folks should be shot. What I found helpful was looking for shortcuts that were recently created in the Windows startup folder and deleting them. Then reboot and do it again. It also helps to stop visiting porno sites.

19

Go to Control Panel

Click on Network Connections

Right Click on the connection you are using and choose Properties

Click on the Advanced Tab - it’s up there on the top right

Check the box that says Firewall

I know other people will say that you should download this and that, and that the MS firewall isn’t any good, but it looks like you don’t want to go down that route.

20

Well, you don’t just blithely delete things from it, but sometimes that’s the only way to fix spyware problems, since the spyware sometimes is put into that folder.

The question is whether you want that BHO on your system. BHOs give added functionality to MISE (for example, the Google toolbar is a BHO – perfectly fine). However, it’s also the way a lot of spyware adds itself. Luckily, removing a BHO only removes the functionality of the BHO; it does not affect the operation of MSIE.

mshkof.dll is a randomly named BHO, which is never a good thing. Also, making the fix only removes the item from the registry (I know – they say this isn’t a good idea, but only if you don’t know what you’re doing). The second delete actually removes the file.

If you’re concerned, ask yourself if you intentionally added this BHOs to your system.

Another option if you’re concerned is to download BHO Demon. It will allow you to disable the BHO, but reenable it if it causes problems.