# Evil malware has hijacked Google, gives me a page of ads instead of Google hits. **URL:** \ **Category:** Factual Questions\ **Created:** [April 19, 2004, 4:49pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845 "2004-04-19T16:49:10Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Duck\_Duck\_Goose](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@Duck\_Duck\_Goose](https://boards.straightdope.com/u/Duck_Duck_Goose)\ **Post date:** [April 19, 2004, 4:49pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/1 "2004-04-19T16:49:10Z")
What I get for a Google search (for example, for “lyrics old man river”) is a page of links to ads, instead of a page to links to web pages that have the lyrics to “Old Man River” on them. This is what I get: > [@](#): > > Guitar Players: Stuck in a Rut? > Amazing Guitar Video. Guitar playing stuck in a rut? Here is a surefire way to improve fast. Join the thousands of guitar players who improve fast. Fantastic results in 7 days. Guaranteed. > > The Turning Magazine > The Turning Magazine is a free online magazine for skeptical,new Christians. How much of the bible is true? Why are believers often so judgmental? Does it have to be like this? > > Christmas Light Design Software! > Virtually string Christmas lights, place pre-lighted foliage on exterior and interior images of your home, commercial project, or any setting you want to decorate. > > Kazaa Gold Edition $29 One Time Fee. > Instant access to unlimited free MP3 music and lyrics. Unlimited free movie and software downloads too. > > [guitar5day.com](http://guitar5day.com) $19.95 Visualize the Fretboard NOW > Guitar Players: Don’t click here unless you need to improve fast. Proven Video Unlocks the Secret of Guitar. Must Have Your Credit Card Ready to receive limited offer. Don’t delay. > > Find lyrics old man river Using the FREE 2020 Search Toolbar! > Having trouble finding lyrics old man river? Get the 2020 Search toolbar and say “good-bye” to those annoying pop-ups. Many other useful features such as: text highlighter, multi-search engine, drag & drop, e-mail results and more! > > Find lyrics old man river at [SMARTpages.com](http://SMARTpages.com) - Online Yellow Pages > Find local business listings for lyrics old man river at [SMARTpages.com](http://SMARTpages.com), the online yellow pages directory of SBC Communications. SMARTpages also offers city guides, shopping guides, white pages and more. > > Best Performing Sexual Enhancements Today > All Natural Sexual Enhancement Products for both Men and Women. Increase penis size, Triple Sperm Ejaculation pills, Harder erection spray, Intensify female orgasms. Money Back Guarantee. > > lyrics old man river at Starpulse > Your one stop lyrics old man river resource, including links to your favorite actors, actresses, supermodels, musicians, athletes, movies, TV and video games. > > Distinctive Name Poems > Touch someone’s heart by turning their name into poetry. A poetic way to tell that someone how much you think and care about them; be they a partner, family member, or close friend And those are all links to the same URL (although they show different names down in the tray): [http://216.221.138.95/](http://216.221.138.95/) And no, I’m not stupid enough to click on that to find out where it goes. Now, if I click on “Next” at the bottom of my Google’s Evil Twin Search Results, up comes a normal-appearing page of Google hits (I didn’t know Reba McIntyre had a song “Old Man River”), which says “Page 1”. However, if I put in a new search string on _that_ page (“lyrics numb”), I once again get the Google’s Evil Twin search results. And then I can click on “Next” and it will bring up the real page of Google hits for the lyrics to “Numb”. WinXP Home Edition, IE 6. I have Google’s Toolbar with popup blocker installed. Since January, it has worked fine. It is also incidentally blocking a popup that appears when the Google Evil Twin search results page appears. However I am now also getting other miscellaneous popups which are not being blocked. \*\*I have Adaware 6 (free personal version). I have Spybot.\*\* I have been running them, with updates, practically nonstop since yesterday. They remove a bunch of crap off and on (Clientman, Jeired, others), but whatever this is, it keeps coming back, and it isn’t necessarily showing up on Spybot or Adaware. I have checked Microsoft for security patches for XP and/or IE. This is a home computer, no network. No firewalls, no virus software. Normally we don’t need them. Please do not suggest that I simply purchase _your favorite_ anti-virus software and run it. Please do not suggest that I simply switch to a different browser. Or that I simply get a Mac. Please do not suggest that in the future I “think” before clicking on any .exe files or attachments. I assure you, everyone in my family is perfectly conversant with those particular Internet ground rules. This scumware installed itself in the wee hours Sunday morning on our computer all by itself while someone at this end was surfing the web in a perfectly normal way. Sorry if that all sounds pissy, but that’s the sum total of the advice I’ve gotten so far IRL at this end: “Get Netscape/get Norton/get a Mac/tell your kids not to download stuff”. None of that is helpful. Since apparently it doesn’t do this with Google Canada or Google NZ, I could just use them. Or I could go ahead and use [Google.com](http://Google.com), and just keep on running Adaware and Spybot once a day, like I already normally do, and ignore the first page of spurious Google hits I get every time I do a Google search. But dammit, I want this crap the FUCK off my 'puter. Anybody have any ideas? I have checked Spybot’s BHO list, and there’s nothing on there that has a red check mark. Obviously this thing has some .dll or pre-fetch thingie quietly installed somewhere. If someone can give me a hint, I can go look for it. I’m not afraid of regedit (I’m desperate enough that I’m considering a complete reformat) so I’m open to suggestions. And it doesn’t keep showing up in Spybot or Adaware, whatever it is. I run them, they say it’s clean, but I’m still getting the Google’s Evil Twin page of search results. And then I go back to Spybot and run it again, and it still tells me “Congratulations! No immediate threats were found.” ---
**Author:** ![Number](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/number/32/242_2.png) [@Number](https://boards.straightdope.com/u/Number)\ **Post date:** [April 19, 2004, 5:10pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/2 "2004-04-19T17:10:47Z")
Run [HijackThis](http://www.spywareinfo.com/~merijn/files/hijackthis.zip) and post the log. It may give hints as to what malware is responsible. You could also try [CWShredder](http://www.spywareinfo.com/~merijn/files/cwshredder.zip). It removes some things that Spybot and Ad-aware miss. ---
**Author:** ![Tapioca\_Dextrin](https://avatars.discourse-cdn.com/v4/letter/t/3d9bf3/32.png) [@Tapioca\_Dextrin](https://boards.straightdope.com/u/Tapioca_Dextrin)\ **Post date:** [April 19, 2004, 5:19pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/3 "2004-04-19T17:19:28Z")
Well, you could get a kids buy a Mac … the url you listed looks like it’s some sort of browser hijack thingy and definitely scumware related. If you can get to [this page](http://www.siena.edu/antivirus/Spyware/CWS.htm) it gives instructions on how to get rid of one of the worst offenders. ---
**Author:** ![Number](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/number/32/242_2.png) [@Number](https://boards.straightdope.com/u/Number)\ **Post date:** [April 19, 2004, 5:21pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/4 "2004-04-19T17:21:34Z")
[Here’s](http://www.spywareinfo.com/forums/index.php?showtopic=40426) a post by someone who had the same problem. Apparently the latest version of CWShredder will get rid of it. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [April 19, 2004, 7:12pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/5 "2004-04-19T19:12:37Z")
> [@Tapioca Dextrin](#): > > Well, you could get a kids buy a Mac … > > the url you listed looks like it’s some sort of browser hijack thingy and definitely scumware related. > > If you can get to [this page](http://www.siena.edu/antivirus/Spyware/CWS.htm) it gives instructions on how to get rid of one of the worst offenders. Thanks! (I maintain that page, actually.) If it’s not CWShredder, go to the other [antispyware pages](http://www.siena.edu/antivirus/spyware) and run either Ad-Aware or Spybot S&D. As a matter of fact, it’s a good idea to install one of the two on your computer and run it from time to time. Also, get Spyware Blaster – same location. ---
**Author:** ![Cervaise](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cervaise/32/16693_2.png) [@Cervaise](https://boards.straightdope.com/u/Cervaise)\ **Post date:** [April 19, 2004, 7:13pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/6 "2004-04-19T19:13:30Z")
> [@Number](#): > > Run [HijackThis](http://www.spywareinfo.com/~merijn/files/hijackthis.zip) and post the log. It may give hints as to what malware is responsible. I agree. HijackThis is very powerful but it’s not for the inexperienced user. It’ll show exactly what’s plugged into your browser, and from there we can figure out the best tool to remove it. ---
**Author:** ![Cervaise](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cervaise/32/16693_2.png) [@Cervaise](https://boards.straightdope.com/u/Cervaise)\ **Post date:** [April 19, 2004, 7:15pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/7 "2004-04-19T19:15:47Z")
> [@RealityChuck](#): > > run either Ad-Aware or Spybot S&D Mentioned in the OP. > [@](#): > > _Also, get Spyware Blaster – same location._ Seconded. This is another very good tool and is easy for anyone to use, unlike HijackThis. ---
**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\ **Post date:** [April 19, 2004, 8:35pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/8 "2004-04-19T20:35:16Z")
> [@](#): > > And those are all links to the same URL (although they show different names down in the tray): [http://216.221.138.95/](http://216.221.138.95/) And no, I’m not stupid enough to click on that to find out where it goes. I am 🙂 (I’m on a Mac, so I go anywhere I please) On my machine it goes to > [@](#): > > Forbidden > You don’t have permission to access / on this server. (That could possibly be due to some barrier stuff implemented on our network, but they don’t do much of that around here). It appears to reconcile to something in New Canaan CT; SamSpade reports: > [@](#): > > Server Used: [[whois.arin.net](http://whois.arin.net) ] > > 216.221.138.95 = [[redir.goclick.com](http://redir.goclick.com) ] > > OrgName: DiscoverNet > OrgID: DSCV > Address: 111 Prospect Street > City: Stamford > StateProv: CT > PostalCode: 06901 > Country: US > NetRange: 216.221.128.0 - 216.221.143.255 > CIDR: 216.221.128.0/20 > NetName: DISCOVER-NET > NetHandle: NET-216-221-128-0-1 > Parent: NET-216-0-0-0-0 > NetType: Direct Allocation > NameServer: [DNS1.DISCOVERNET.NET](http://DNS1.DISCOVERNET.NET) > NameServer: [DNS2.DISCOVERNET.NET](http://DNS2.DISCOVERNET.NET) > Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE > RegDate: 1999-05-12 > Updated: 2003-04-14 > TechHandle: BB274-ARIN > TechName: Blank Bryan > TechPhone: 1-203-351-1178 > TechEmail: [ipadmin@discovernet.net](mailto:ipadmin@discovernet.net) ---
**Author:** ![Tapioca\_Dextrin](https://avatars.discourse-cdn.com/v4/letter/t/3d9bf3/32.png) [@Tapioca\_Dextrin](https://boards.straightdope.com/u/Tapioca_Dextrin)\ **Post date:** [April 19, 2004, 9:24pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/9 "2004-04-19T21:24:19Z")
> [@RealityChuck](#): > > Thanks! (I maintain that page, actually.) No problem 🆒 ---
**Author:** ![Sylkyn](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@Sylkyn](https://boards.straightdope.com/u/Sylkyn)\ **Post date:** [April 19, 2004, 10:12pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/10 "2004-04-19T22:12:16Z")
> [@Number](#): > > [Here’s](http://www.spywareinfo.com/forums/index.php?showtopic=40426) a post by someone who had the same problem. Apparently the latest version of CWShredder will get rid of it. I am glad **DDG** posted this, because I’ve had the same problem with google for a few weeks now. **Number** , I read that link (it worked earlier today, but not now) and I had already run CWSShredder…it didn’t help a bit. ☹ I, too, have run both Ad-aware and Spybot S&D. The google problem is still there. Not wanting to totally take over **DDG** ’s thread, I will wait for her to post her results from hijackthis (which I have also run) and see if any of you gurus can tell me what to delete. Some of them are kind of obvious, but there are a few on there I am a little wary of deleting. Thanks for any help you guys can give! ---
**Author:** ![Duck\_Duck\_Goose](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@Duck\_Duck\_Goose](https://boards.straightdope.com/u/Duck_Duck_Goose)\ **Post date:** [April 19, 2004, 10:46pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/11 "2004-04-19T22:46:41Z")
Okay, I have installed Spywareblaster, although it tells me it can’t remove anything, just prevent spyware from installing itself. And here is the Hijackthis logfile. > [@](#): > > Logfile of HijackThis v1.97.7 > Scan saved at 5:43:32 PM, on 4/19/2004 > Platform: Windows XP SP1 (WinNT 5.01.2600) > MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) > > Running processes: > C:\WINDOWS\System32\smss.exe > C:\WINDOWS\system32\winlogon.exe > C:\WINDOWS\system32\services.exe > C:\WINDOWS\system32\lsass.exe > C:\WINDOWS\system32\svchost.exe > C:\WINDOWS\System32\svchost.exe > C:\WINDOWS\system32\spoolsv.exe > C:\WINDOWS\Explorer.EXE > C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe > C:\WINDOWS\System32\carpserv.exe > C:\Program Files\AIM\aim.exe > C:\WINDOWS\System32\svchost.exe > C:\WINDOWS\wanmpsvc.exe > C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe > C:\Program Files\Sony Handheld\HOTSYNC.EXE > C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe > C:\WINDOWS\System32\HPZipm12.exe > C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe > C:\Program Files\America Online 9.0\waol.exe > C:\Program Files\America Online 9.0\shellmon.exe > C:\Program Files\America Online 9.0\aolwbspd.exe > C:\Program Files\Internet Explorer\iexplore.exe > C:\Program Files\Windows NT\Accessories\wordpad.exe > C:\Documents and Settings\Duck\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe > > R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [http://www.google.ca/](http://www.google.ca/) > R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = > R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = [http://mmjb.musicmatch.com/mmjb/process.cgi?REQUEST=PORTABLE&MMJB\_KEY=&MMUID=&grant=0&VERSION=8.10.1006DELL\_PORTABLE&OEM=DELL\_PORTABLE&OOEM=DELL\_PORTABLE&LANG=ENU&COUNTRY=UNITED%20STATES&LANG=ENU&Grant=0](http://mmjb.musicmatch.com/mmjb/process.cgi?REQUEST=PORTABLE&MMJB_KEY=&MMUID=&grant=0&VERSION=8.10.1006DELL_PORTABLE&OEM=DELL_PORTABLE&OOEM=DELL_PORTABLE&LANG=ENU&COUNTRY=UNITED%20STATES&LANG=ENU&Grant=0) > R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310}\_ - (no file) > R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}\_ - (no file) > O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx > O2 - BHO: (no name) - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - C:\WINDOWS\System32\mshkof.dll > O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll > O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll > O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll > O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx > O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll > O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll > O4 - HKLM…\Run: [CARPService] carpserv.exe > O4 - HKCU…\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl > O4 - Startup: HotSync Manager.LNK = C:\Program Files\Sony Handheld\HOTSYNC.EXE > O4 - Global Startup: hp psc 1000 series.lnk = ? > O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE > O4 - Global Startup: Forget Me Not.lnk = E:\Duck\create\AG Print\AGremind.exe > O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html > O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html > O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html > O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html > O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html > O9 - Extra button: AIM (HKLM) > O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll > O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - [http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab](http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab) > O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - [http://software-dl.real.com/244e0aed5985bc292e06/netzip/RdxIE601.cab](http://software-dl.real.com/244e0aed5985bc292e06/netzip/RdxIE601.cab) > O16 - DPF: {986DDE35-E955-11D0-A707-000000521958} - [http://69.56.176.75/webplugin.cab](http://69.56.176.75/webplugin.cab) > O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab](http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab) > O17 - HKLM\System\CCS\Services\Tcpip…{0A5BB636-4F46-4672-887B-9DA0DE8FA971}: NameServer = 205.188.146.146 > O17 - HKLM\System\CS1\Services\Tcpip…{0A5BB636-4F46-4672-887B-9DA0DE8FA971}: NameServer = 205.188.146.146 [shrug] ---
**Author:** ![Sylkyn](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@Sylkyn](https://boards.straightdope.com/u/Sylkyn)\ **Post date:** [April 19, 2004, 11:05pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/12 "2004-04-19T23:05:18Z")
Ok, I hunted around (even on my Evil Google Twin!) and found that when I deleted this: BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2\_0\_1browserhelper2.dll it got rid of Evil Google. I did not see that one on your list, **Duck Duck Goose** but I am betting that one of the other “no names” on your Hijack This log is the culprit. I did not bookmark the message board that helped me (I will try to locate it again), but another person also mentioned that completely getting rid of the google toolbar did the trick for her. I never have used the google toolbar, so I knew that wasn’t my problem. If anyone else knows which exact “no name” you need to check on, please let her know. Y’all have _no idea_ how big a pain this thing is. ---
**Author:** ![Sylkyn](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@Sylkyn](https://boards.straightdope.com/u/Sylkyn)\ **Post date:** [April 19, 2004, 11:14pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/13 "2004-04-19T23:14:19Z")
This is the [message board](http://www.computing.net/security/wwwboard/forum/10461.html) I found my help on. I must have seen the post about deleting the google toolbar on another of the fifty boards I visited trying to fix this mess. There’s also another link on this board that may help you. I hope so…because I sure did feel your pain. I know that I feel much better since Evil Google is gone. Oh and I also clicked my WinXP firewall to “on”. I have also been bombed with myriad of Trojan horses lately, and figured a little protection from these things is better than none. Might help the Evil Google problem, as well. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [April 19, 2004, 11:39pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/14 "2004-04-19T23:39:50Z")
OK, here’s an analysis: First move Hijackthis to its own folder and run it from there. The allows it to make backups. Next, close MSIE, run Hijackthis, click on “Scan,” and put a check mark by the following: R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310}\_ - (no file) R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}\_ - (no file) O2 - BHO: (no name) - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - C:\WINDOWS\System32\mshkof.dll O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - [http://software-dl.real.com/244e0ae...ip/RdxIE601.cab](http://software-dl.real.com/244e0ae...ip/RdxIE601.cab) O16 - DPF: {986DDE35-E955-11D0-A707-000000521958} - [http://69.56.176.75/webplugin.cab](http://69.56.176.75/webplugin.cab) Restart your computer. Search for the following, and if you find it, delete it: mshkof.dll See if that helps. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [April 20, 2004, 12:06am UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/15 "2004-04-20T00:06:08Z")
OOPS! Forgot to mention – after you check the items, click on “Fix Checked” and delete them. Then restart your computer. ---
**Author:** ![Duck\_Duck\_Goose](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@Duck\_Duck\_Goose](https://boards.straightdope.com/u/Duck_Duck_Goose)\ **Post date:** [April 20, 2004, 12:33pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/16 "2004-04-20T12:33:34Z")
Okay, are you saying that a BHO named mshkof.dll is the culprit? Because I already know it’s on my system: Spybot Advanced Mode will tell you a list of all the BHO that are there, and “mshkof.dll” is mentioned. But it has a date of 8-22-01, not 4-18-04, and it says “Bundle”, and it says that scary-lookin’ “Windows System 32”, which I know is NOT something that the Average Consumer is supposed to mess with, so I assumed it was something that came with this computer. It’s not? > [@](#): > > Spybot-S&D Browser helper object report, 4/20/2004 7:29:13 AM > > {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} > Class file: AcroIEHelper.ocx > Attributes: > Date: 4/16/2001 4:39:02 PM > MD5: 8394ABFC1BE196A62C9F532511936DF7 > Path: C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX > Short name: ACROIE~1.OCX > Size: 37808 bytes > Version: 0.1.0.0 > Class name: AcroIEHlprObj Class > CLSID database: legitimate software > Description: Adobe Acrobat reader > Filename: ACROIEHELPER.OCX > > {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} > Class file: mshkof.dll > Attributes: archive > Date: 8/22/2001 7:00:00 PM > MD5: AF3B70B4603933A414F5F0370D6D5E65 > Path: C:\WINDOWS\System32 > Short name: > Size: 65536 bytes > Version: 0.1.0.0 > Class name: CBundleObj Object > > {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} > Class file: realbar.dll > Attributes: archive > Date: 2/24/2004 5:39:16 AM > MD5: 613A87C0028097BFD2ADC933F2CB6AC0 > Path: C:\PROGRA~1\COMMON~1\Real\Toolbar > Short name: REALBAR.DLL > Size: 784384 bytes > Version: 0.1.0.1 > Class name: REALBAR > > {53707962-6F74-2D53-2644-206D7942484F} > Class file: SDHelper.dll > Attributes: archive > Date: 3/16/2003 1:02:00 AM > MD5: 423CBD3CFAEEB62C5C97A9449567B474 > Path: C:\PROGRA~1\SPYBOT~1 > Short name: SDHELPER.DLL > Size: 711168 bytes > Version: 255.255.255.255 > CLSID database: legitimate software > Description: Spybot-S&D IE Browser plugin > Filename: SDHelper.dll > > {AA58ED58-01DD-4d91-8333-CF10577473F7} > Class file: googletoolbar1.dll > Attributes: readonly archive > Date: 1/15/2004 3:06:52 PM > MD5: B831BDCC55E4F12FD811CD34F69838DD > Path: c:\program files\google > Short name: GOOGLE~1.DLL > Size: 761856 bytes > Version: 0.2.0.0 > Class name: Google Toolbar Helper > CLSID database: open for discussion > Description: Google toolbar > Filename: Googletoolbar.dll ---
**Author:** ![Duck\_Duck\_Goose](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@Duck\_Duck\_Goose](https://boards.straightdope.com/u/Duck_Duck_Goose)\ **Post date:** [April 20, 2004, 12:37pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/17 "2004-04-20T12:37:45Z")
> [@](#): > > \*\*I also clicked my WinXP firewall to “on”. \*\* …I have a _firewall_ in this thing?? [looks around instrument panel] I learned how to drive one a these things on a Windows 3.1, I still don’t know what all these bells ‘n’ whistles **do** … So, wherezit **at**? Criminently ---
**Author:** ![DanBlather](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@DanBlather](https://boards.straightdope.com/u/DanBlather)\ **Post date:** [April 20, 2004, 3:19pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/18 "2004-04-20T15:19:56Z")
I have had so much trouble recently, these malware/spyware folks should be shot. What I found helpful was looking for shortcuts that were recently created in the Windows startup folder and deleting them. Then reboot and do it again. It also helps to stop visiting porno sites. ---
**Author:** ![Tapioca\_Dextrin](https://avatars.discourse-cdn.com/v4/letter/t/3d9bf3/32.png) [@Tapioca\_Dextrin](https://boards.straightdope.com/u/Tapioca_Dextrin)\ **Post date:** [April 20, 2004, 3:44pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/19 "2004-04-20T15:44:04Z")
> [@Duck Duck Goose](#): > > So, wherezit **at**? Go to Control Panel Click on Network Connections Right Click on the connection you are using and choose Properties Click on the Advanced Tab - it’s up there on the top right Check the box that says Firewall I know other people will say that you should download this and that, and that the MS firewall isn’t any good, but it looks like you don’t want to go down that route. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [April 20, 2004, 4:13pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/20 "2004-04-20T16:13:47Z")
> [@Duck Duck Goose](#): > > Okay, are you saying that a BHO named mshkof.dll is the culprit? Because I already know it’s on my system: Spybot Advanced Mode will tell you a list of all the BHO that are there, and “mshkof.dll” is mentioned. But it has a date of 8-22-01, not 4-18-04, and it says “Bundle”, and it says that scary-lookin’ “Windows System 32”, which I know is NOT something that the Average Consumer is supposed to mess with, so I assumed it was something that came with this computer. It’s not? Well, you don’t just blithely delete things from it, but sometimes that’s the only way to fix spyware problems, since the spyware sometimes is put into that folder. The question is whether you want that BHO on your system. BHOs give added functionality to MISE (for example, the Google toolbar is a BHO – perfectly fine). However, it’s also the way a lot of spyware adds itself. Luckily, removing a BHO only removes the functionality of the BHO; it does not affect the operation of MSIE. mshkof.dll is a randomly named BHO, which is never a good thing. Also, making the fix only removes the item from the registry (I know – they say this isn’t a good idea, but only if you don’t know what you’re doing). The second delete actually removes the file. If you’re concerned, ask yourself if you intentionally added this BHOs to your system. Another option if you’re concerned is to download [BHO Demon](http://www.definitivesolutions.com/bhodemon.htm). It will allow you to disable the BHO, but reenable it if it causes problems. [Next page](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845.md?page=2)