# Evil malware has hijacked Google, gives me a page of ads instead of Google hits. **URL:** \ **Category:** Factual Questions\ **Created:** [April 19, 2004, 4:49pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845 "2004-04-19T16:49:10Z")\ **Posts on this page:** 10\ **Page:** 2
**Author:** ![Dead\_Badger](https://avatars.discourse-cdn.com/v4/letter/d/848f3c/32.png) [@Dead\_Badger](https://boards.straightdope.com/u/Dead_Badger)\ **Post date:** [April 20, 2004, 4:34pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/21 "2004-04-20T16:34:20Z")
> [@RealityChuck](#): > > mshkof.dll is a randomly named BHO, which is never a good thing. Also, making the fix only removes the item from the registry (I know – they say this isn’t a good idea, but only if you don’t know what you’re doing). The second delete actually removes the file. Ah! Positive ID: [this](http://sysinfo.org/bholist.php?type=&filter=&count=50&offset=300) site lists the BHO with the class ID you’ve got (the long string after it says “(no name)”) as being a parasite called ClientMan. [This](http://www.doxdesk.com/parasite/ClientMan.html) page has some suggestions for removal (although removing the related BHO in HijackThis is a good start). It sounds like you’ve got either the Tagger or 2in1 version, judging by your description of its behaviour. ---
**Author:** ![Duck\_Duck\_Goose](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@Duck\_Duck\_Goose](https://boards.straightdope.com/u/Duck_Duck_Goose)\ **Post date:** [April 21, 2004, 1:37pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/22 "2004-04-21T13:37:42Z")
Nothing is working. 1. Spybot Advanced Mode has a way to toggle off any BHO. I toggled off the mshkof.dll BHO. It didn’t help. It’s probably from ClientMan anyway, which has ceased showing up in Spybot/Adaware searches, which means it’s off, but it left its BHO behind. 2. I have uninstalled the Google Toolbar. It didn’t help. And now I am getting a popup for the Free 2020 Search Bar\*\*\*\*\* every time I do a Google search, in addition to having to look at a page of Google’s Evil Twin search results. 3. I have sent two e-mails to Google, one to the webmaster and one to Toolbar support, with no response yet. 4. Spybot and Adaware are both giving me consistent cheerful messages to the effect that there’s no spyware on my system. I’m open to suggestions. Meanwhile I’m just using Google Canada. [makes mental note to go learn at least the first verse to “Oh Canada” in gratitude] * * * > [@](#): > > Find lyrics old man river Using the FREE 2020Search Toolbar! > Having trouble finding lyrics old man river? Get the 2020Search toolbar and say “good-bye” to those annoying pop-ups. Many other useful features such as: text highlighter, multi-search engine, drag & drop, e-mail results and more! > > Find lyrics old man river with Free WebSearch Tools > Click here to download WebSearch Tools and search 15 engines for lyrics old man river at once now with FREE Pop-up Blocker, Yellow/White Pages, Free Games, Maps, Skins, Cursors and more! Yeah, right. :rolleyes: Like I’m gonna download any of _that_… ---
**Author:** ![Pleonast](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pleonast/32/1183_2.png) [@Pleonast](https://boards.straightdope.com/u/Pleonast)\ **Post date:** [April 21, 2004, 3:07pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/23 "2004-04-21T15:07:51Z")
_Please do not suggest that I simply switch to a different browser._–Given the amount of trouble you’re having with this, are you really sure you don’t want to try another browser? It’s your decision, but there’s got to be a point where the effort to keep IE clean is greater than the effort to install and learn a new browser. ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [April 21, 2004, 3:22pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/24 "2004-04-21T15:22:38Z")
I keep seeing threads of people whose computers have been hijacked like this but nobody says what they did to get it hijacked and I am very curious because in years of unprotected browsing it has _never_ happened to me. I have no anti-virus or any other anti-hijack program. I just configure my browser tight and use common sense. I have _never_ got a virus or any other crap. Can someone explain to me exactly what steps you did to get this crap? I am just curious to know if I am walking in a mine field unprotected and have just been lucky so far. ---
**Author:** ![olefin](https://avatars.discourse-cdn.com/v4/letter/o/d78d45/32.png) [@olefin](https://boards.straightdope.com/u/olefin)\ **Post date:** [April 21, 2004, 4:39pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/25 "2004-04-21T16:39:51Z")
> [@sailor](#): > > I have no anti-virus or any other anti-hijack program. I just configure my browser tight and use common sense. I have _never_ got a virus or any other crap. > > Can someone explain to me exactly what steps you did to get this crap? > > I am just curious to know if I am walking in a mine field unprotected and have just been lucky so far. You been very, very lucky. I had never had a problem until one day about two months ago. I was searching on Google, I **clicked** on one of the sites. WHAM! I was hit with popups, pages were opening continuously, my homepage had been hijacked… my browser had become useless. I had to run Ad-aware and Spybot both to clear my machine. They found 75 dialers, spy-ware and other junk that had been installed from clicking on that one site! I had been running Spybot and Ad-aware about once a month before and they never found anything. BTW… besides Ad-aware and Spybot I run AVG anti virus, Mailwasher and Zonealarm (and I’m behind my router). In this day and time it is only using common sense to have protection… especially since it’s all FREE! ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [April 21, 2004, 5:03pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/26 "2004-04-21T17:03:00Z")
I still don’t get it. I have had more problems with anti-virus software than anything else . My browser has ActiveX and Java disabled (except for trusted sites). Can you explain to me how a website can hijack my computer? I am truly curious and would welcome a link to such a web page (with appropriate warning, obviously). BTW, I borwse plenty of porn sites which seem to be the worst offenders. I never got any diseases from them. ---
**Author:** ![critter42](https://avatars.discourse-cdn.com/v4/letter/c/7ba0ec/32.png) [@critter42](https://boards.straightdope.com/u/critter42)\ **Post date:** [April 21, 2004, 5:53pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/27 "2004-04-21T17:53:39Z")
> [@sailor](#): > > My browser has ActiveX and Java disabled (except for trusted sites). Can you explain to me how a website can hijack my computer? As I’m sure you’re aware, you answered your own question 😉 YOU can’t. However, that puts you in a very small minority of IE users. I wouldn’t be surprised to learn that 90% of IE users have ActiveX, Java, Jscript, vbscript, etc, enabled on their systems, which leave them open to hijacking **DDG** : Here is [Spyware Guide’s](http://www.spywareguide.com) info on [2020Search](http://www.spywareguide.com/product_show.php?id=640), and how to manually remove it. Don’t know if you’ve tried the steps listed on the page I linked or not, but it’s worth a shot. critter42 ---
**Author:** ![Jurph](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@Jurph](https://boards.straightdope.com/u/Jurph)\ **Post date:** [April 21, 2004, 7:12pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/28 "2004-04-21T19:12:56Z")
I know, you don’t want to hear it. For those who are willing to listen, just a little, though: **Mozilla Firefox** (or **Firebird** , or **Firefly** , or **FireHiOpal** ) is a great browser that has all the functionality of MSIE, comes with a built-in pop-up blocker, a Google search bar, and can be customized to include - mouse gestures - tabbed browsing - ad-blocking functionality that works - an IRC client - Tetris - Minesweeper - Solitaire and way more. I was skeptical, but MSIE was ruining my browsing experience. If you’re security-conscious, but don’t like the idea of cookies flooding onto your machine or pop-ups flying all over the place, try **Mozilla** for a week with its tabbed browsing extensions. No other software is necessary, but Spybot and Ad-Aware are still good ideas. If you’re not convinced it’s the better browser, switch back – but please don’t dismiss it out of hand because you “don’t want the hassle”. It took me maybe an hour to install and customize it with all the extensions I wanted, and has given me trouble-free operation for three months now. ---
**Author:** ![Duck\_Duck\_Goose](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@Duck\_Duck\_Goose](https://boards.straightdope.com/u/Duck_Duck_Goose)\ **Post date:** [April 21, 2004, 11:15pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/29 "2004-04-21T23:15:04Z")
> [@sailor](#): > > I keep seeing threads of people whose computers have been hijacked like this but nobody says what they did to get it hijacked and I am very curious because in years of unprotected browsing it has _never_ happened to me. I have no anti-virus or any other anti-hijack program. I just configure my browser tight and use common sense. I have _never_ got a virus or any other crap. > > Can someone explain to me exactly what steps you did to get this crap? Dude, I wish I knew. All that happened was, I was doing Internet in the wee hours Sunday morning. No porn sites, no downloading weird stuff. The Unaboard, mostly. The Dope. Fathom. [CNN.com](http://CNN.com). The Beeb online. Sites like that, sites I have _always_ visited with no problems. And looking stuff up on Google (“lyrics old man river”), and Google worked fine, no malware hijack (that post where I needed the lyrics to “Old Man River” is dated 4-18-04 1:03 a.m., and I’d have _noticed_ a Google hijack. So it was working fine then.) And I suppose I visited some miscellaneous sites, too, what with browsing and Googling and whatnot, but I certainly never, ever click on “Download this”. And I know all about the tricksy gray official-looking message windows that Gator and Bonzi Buddy give you, tryin’ to getcha to click on “Okay”. I _never_ do that, I never go there. I learned the hard way years ago. And we do not have Kazaa or any of the other notorious “bundlers” installed on our system. And the Better Half looked at his handheld forums before church Sunday, as usual. And then after lunch Sunday my daughter sat down to do computer, and wanted the lyrics to “Numb” for some vitally important AIM conversation she was having, and suddenly it was, “Mommmm!! The computer’s being _stupid_ again!” And it was this totally weird, new, strange, malware Google hijack that neither Spybot nor Adaware would get rid of. I spent most of Sunday afternoon screwing around with it. It came by itself, like The Blob. Nobody downloaded anything, or visited anything, or clicked on anything. It just appeared, shirttailed off some Internet website. Or maybe it just picked us off a list somewhere, I dunno. If I had to guess, I’d say that she must have accidentally clicked “Yes” on _something_ while she was sitting there looking for the lyrics to “Numb”, except that she’s practically-14 and has also learned the hard way to be very, very careful what she clicks on. But she does tend to be very impatient, so I could see her clicking impatiently on some odd popup to get it to “go away”. Anyway, I got a response from Google Toolbar Support. > [@](#): > > Thank you for your note. It sounds as if a third-party web parasite is > affecting your browsing experience. A web parasite is a program that runs > on your computer and changes how your computer works without your informed > consent. Please be assured that this program is not in any way affiliated > with the Google Toolbar, and no third-party software is installed on your > machine when you download the Google Toolbar. > > However, the Google Toolbar uses a feature of Internet Explorer called > browser extensions. Many parasitic programs take advantage of this same > feature to embed themselves into your computer. Because the Google > Toolbar uses browser extensions, we recommend that you take additional > precautions to protect your computer from parasitic software. > > If you are experiencing problems generated by one of these programs, you > will most likely want to remove it from your computer. You can visit > [http://www.doxdesk.com/parasite/](http://www.doxdesk.com/parasite/) to review information about a number of known parasitic software programs, including suggestions on how to remove them. You can also download programs that attempt to detect and uninstall parasitic software. Two examples of these programs are Spybot’s ‘Search > and Destroy’ and Lavasoft’s ‘Ad-Aware.’ They can be downloaded at: > > [http://security.kolla.de/index.php?lang=en&page=download](http://security.kolla.de/index.php?lang=en&page=download) (‘Search and > Destroy’) > [http://www.lavasoft.de/support/download/](http://www.lavasoft.de/support/download/) (‘Ad-Aware’) > > We have no relationship with the organizations who created these programs > and cannot vouch for them ourselves. > > If you feel you were deceived when you installed a program that creates > pop-ups, redirects, or modifies your browser in an unwanted fashion, you > can take action. The Federal Trade Commission (FTC) handles complaints > about deceptive or unfair business practices. To file a complaint, visit: > [ReportFraud.ftc.gov](https://www.ftc.gov/ftc/complaint.htm), call 1-877-FTC-HELP, or write to: > > Federal Trade Commission > CRC-240 > Washington, D.C. 20580 > > If your complaint is against a company in another country, please file > it at [http://www.econsumer.gov/](http://www.econsumer.gov/). > > Thank you for taking the time to contact us and report this problem. We > too are frustrated by the prevalence of this harmful software and are > actively investigating different ways to protect our users. > > Regards, > The Google Team Fine. :rolleyes: I’ll download Spybot and Adaware now, shall I? ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [April 21, 2004, 11:44pm UTC](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845/30 "2004-04-21T23:44:44Z")
I’d suggest you run another hijackthis log and post it at [http://www.spywareinfo.com](http://www.spywareinfo.com) along with a description of the problem. You should get an answer from there. [Previous page](https://boards.straightdope.com/t/evil-malware-has-hijacked-google-gives-me-a-page-of-ads-instead-of-google-hits/240845.md?page=1)