# Gah! #$%&@# Browser Hijacker **URL:** \ **Category:** Factual Questions\ **Created:** [March 1, 2009, 10:13pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924 "2009-03-01T22:13:38Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![zut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zut/32/2875_2.png) [@zut](https://boards.straightdope.com/u/zut)\ **Post date:** [March 1, 2009, 10:13pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/1 "2009-03-01T22:13:38Z")
When clicking through on the results from a Google search, my browser is getting hijacked. It will jump to the correct page, but then immediately redirect to some crappy “search” site. Hitting the “back” button on the browser will send me to the page I want, so it’s not like it’s the end of the world, but it’s damn annoying. (This happens in both IE and Firefox.) So far I’ve:[ul] [li]run Ad-Aware (then downloaded the newest definition files and rerun the scan)[/li][li]run Spybot Search & Destroy (with the newest definition files)[/li][li]run a McAfee virus scan[/li][li]downloaded AVG and run a scan with that (because I was getting sick of McAfee anyway)[/li][li]run the Kaspersky online scanner (suggested in [this thread](http://boards.straightdope.com/sdmb/showthread.php?t=500859))[/li][li]downloaded and run Microsoft malicious software removal tool[/ul][/li] Spybot found one potential thing, which I deleted. AVG found another, which I deleted. Kaspersky found another, which I deleted. The others didn’t find anything important. However, the malware is still there. Suggestions? ---
**Author:** ![Freudian\_Slip\_1](https://avatars.discourse-cdn.com/v4/letter/f/f475e1/32.png) [@Freudian\_Slip\_1](https://boards.straightdope.com/u/Freudian_Slip_1)\ **Post date:** [March 1, 2009, 10:40pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/2 "2009-03-01T22:40:56Z")
I had this happen a few months ago. Unfortunately (not being a superuser kinda guy anymore), I had to take it to a repair shop. It cost 200 bucks :mad: ---
**Author:** ![samclem](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@samclem](https://boards.straightdope.com/u/samclem)\ **Post date:** [March 1, 2009, 10:52pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/3 "2009-03-01T22:52:18Z")
There’s some seriously devious things out there in the last few months. The latest, bestest, free thing you can download is [malwarebytes.com](http://malwarebytes.com) It’s the Bee’s Knees. ---
**Author:** ![aldiboronti](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@aldiboronti](https://boards.straightdope.com/u/aldiboronti)\ **Post date:** [March 1, 2009, 11:08pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/4 "2009-03-01T23:08:35Z")
There’s also [Hijack This](http://www.majorgeeks.com/download5554.html). You can download the program, run it, and then paste the logfile into the site below for instant analysis. [http://www.hijackthis.de/](http://www.hijackthis.de/) ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [March 1, 2009, 11:37pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/5 "2009-03-01T23:37:42Z")
You most likely will need another non-infected computer to download updates for your AV and spyware removal tools, or to download new ones (such as malwarebytes). Many versions of this nasty are specifically blocking access to updaters and anti-malware sites. If you can’t get the programs mentioned using the links provided, and don’t have another computer with which to get them, PM me and I’ll send you some alternate links. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [March 1, 2009, 11:57pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/6 "2009-03-01T23:57:03Z")
Just be careful you are not infected with the[latest permutation of the Virut trojan](http://vil.nai.com/vil/content/v_154029.htm); look in your task manager for a process named “reader\_s”. It infects dozens of legitimate Windows .exe files, and if you run MalwareBytes, it may remove them, rendering your computer unbootable. I’ve had this happen once already. Be sure to back everything up before you attempt to remove this nasty. So far, I have not located a scanner that will remove it safely. The recommended action is, [nuke and pave.](http://miekiemoes.blogspot.com/2009/02/virut-and-other-file-infectors-throwing.html) ---
**Author:** ![zut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zut/32/2875_2.png) [@zut](https://boards.straightdope.com/u/zut)\ **Post date:** [March 2, 2009, 2:12am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/7 "2009-03-02T02:12:22Z")
> [@samclem](#): > > The latest, bestest, free thing you can download is [malwarebytes.com](http://malwarebytes.com) > > It’s the Bee’s Knees. Great idea. Tried it, did a full system scan, and it found some “My Web Search” thing. That sounded promising, but I removed it, and my browser is still being hijacked. Scanned again, found nothing, still hijacked. So… ultimately not the answer. > [@aldiboronti](#): > > There’s also [Hijack This](http://www.majorgeeks.com/download5554.html). You can download the program, run it, and then paste the logfile into the site below for instant analysis. Oops. Forgot to say in the OP that I did that, too. There was nothing in the logfile that wasn’t there two months ago last time I ran HJT. So not that either. > [@ZipperJJ](#): > > You most likely will need another non-infected computer to download updates for your AV and spyware removal tools, or to download new ones (such as malwarebytes). Many versions of this nasty are specifically blocking access to updaters and anti-malware sites. This doesn’t seem to be the case. I downloaded AVG, MalwareBytes, the MS malware program, and Kaspersky without any trouble, and without any problem accessing their sites. > [@Fear\_Itself](#): > > Just be careful you are not infected with the[latest permutation of the Virut trojan](http://vil.nai.com/vil/content/v_154029.htm); look in your task manager for a process named “reader\_s”. It infects dozens of legitimate Windows .exe files, and if you run MalwareBytes, it may remove them, rendering your computer unbootable. Yikes! No “reader\_s” luckily. A little more info: this is apparently tied to IP 209.85.171.7, as I get a brief “waiting for 209.85.171.7/x/?..etc etc” in the status bar while the redirect is establishing itself. Dnnno if this is meaningful. ---
**Author:** ![Lungfish](https://avatars.discourse-cdn.com/v4/letter/l/d78d45/32.png) [@Lungfish](https://boards.straightdope.com/u/Lungfish)\ **Post date:** [March 2, 2009, 2:31am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/8 "2009-03-02T02:31:29Z")
The IP 209.85.171.7 belongs to [Google](http://en.utrace.de/whois/209.85.171.7). ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [March 2, 2009, 3:24am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/9 "2009-03-02T03:24:59Z")
OK. If Malwarebytes doesn’t work, move on to [SuperAntispyware](http://www.superantispyware.com/). I’ve had some very good success with it when Malwarebytes didn’t do the trick. ---
**Author:** ![samclem](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@samclem](https://boards.straightdope.com/u/samclem)\ **Post date:** [March 2, 2009, 3:34am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/10 "2009-03-02T03:34:51Z")
> [@RealityChuck](#): > > OK. If Malwarebytes doesn’t work, move on to [SuperAntispyware](http://www.superantispyware.com/). I’ve had some very good success with it when Malwarebytes didn’t do the trick. Before you try that, perhaps run Malwarebytes in Safe Mode? Do you know how to do that? ---
**Author:** ![Zakalwe](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zakalwe/32/270_2.png) [@Zakalwe](https://boards.straightdope.com/u/Zakalwe)\ **Post date:** [March 2, 2009, 3:36am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/11 "2009-03-02T03:36:06Z")
> [@zut](#): > > Great idea. Tried it, did a full system scan, and it found some “My Web Search” thing. That sounded promising, but I removed it, and my browser is still being hijacked. Scanned again, found nothing, still hijacked. So… ultimately not the answer. Boot your computer disconnected from the 'Net. Get your files off. Nuke it and reload. I got this thing two months ago and that’s where I ended up. _My Web Search_ had completely embedded into the system and was loading trojans in. Here’s a quick test to see if this is happening to you… 1. Boot off the net. 2. Do a file search for all .com, .exe, and .sys created or modified in the last few days. 3. Making sure that none are Windows system files, delete them. 4. Reconnect and reboot. Work for a while. 5. Start back at step one - if there are a bunch of new results in the search, then the virus has been reloading itself. I tried all of the above solutions as well as some others (like PandaScan). None could stop this little bastard. Sorry. ---
**Author:** ![Markxxx](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@Markxxx](https://boards.straightdope.com/u/Markxxx)\ **Post date:** [March 2, 2009, 5:38am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/12 "2009-03-02T05:38:57Z")
Did you try running those programs from safe mode? ---
**Author:** ![clayton\_e](https://avatars.discourse-cdn.com/v4/letter/c/c57346/32.png) [@clayton\_e](https://boards.straightdope.com/u/clayton_e)\ **Post date:** [March 2, 2009, 5:49am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/13 "2009-03-02T05:49:43Z")
I had the problem once, it sent me to a fake [google.com](http://google.com) (looked like google, not google, wouldn’t let me go many other places). I had to go search through my AIM logs to figure out how I fixed it, it was with hijack this. Apparently it was spread over AIM, actually, because as soon as I started talking to someone on AIM about what the hell was going on (asked them to look at a few random websites like CNN and the like to see if they were getting the same problem) they were able to see those sites for a minute or two then _they_ got the problem too. Eventually, from my AIM logs, it looks like I used hijackthis and recommended it to them as well. ---
**Author:** ![Baraqiyal](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Baraqiyal](https://boards.straightdope.com/u/Baraqiyal)\ **Post date:** [March 2, 2009, 5:59am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/14 "2009-03-02T05:59:33Z")
This happened to me recently and it was pretty annoying. No anti-malware/anti-virus program fixed the problem. Finally I did a system restore from a previous state and that fixed the problem. (Start-\>Programs-\>Accessories-\>System Tools-\>System Restore) ---
**Author:** ![Kevbo](https://avatars.discourse-cdn.com/v4/letter/k/e47774/32.png) [@Kevbo](https://boards.straightdope.com/u/Kevbo)\ **Post date:** [March 2, 2009, 6:10am UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/15 "2009-03-02T06:10:18Z")
Some bad stuff going around. A cow-orker just had me look over his laptop. The bastage tricked him into installing it by claiming it was a firefox update. Never could ID it. It somehow blocked malwarebytes from installing. It also locked out sytem restores. It is a company laptop, so I’ll let our IT guy mess with it…he’s really good, and it wouldn’t be good for me to be the one that made things worse. ---
**Author:** ![Zakalwe](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zakalwe/32/270_2.png) [@Zakalwe](https://boards.straightdope.com/u/Zakalwe)\ **Post date:** [March 2, 2009, 12:31pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/16 "2009-03-02T12:31:18Z")
> [@Markxxx](#): > > Did you try running those programs from safe mode? Yep. The problem is that some of the files it infects are Windows system files, so the damn thing is running even in Safe mode (or least it sure acts like it is). ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [March 2, 2009, 2:04pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/17 "2009-03-02T14:04:29Z")
> [@Baraqiyal](#): > > This happened to me recently and it was pretty annoying. No anti-malware/anti-virus program fixed the problem. Finally I did a system restore from a previous state and that fixed the problem. (Start-\>Programs-\>Accessories-\>System Tools-\>System Restore) System Restore is a good tool if and only if you know when you were infected. Otherwise, you’ll just be restoring the virus. ---
**Author:** ![Shadez](https://avatars.discourse-cdn.com/v4/letter/s/90ced4/32.png) [@Shadez](https://boards.straightdope.com/u/Shadez)\ **Post date:** [March 2, 2009, 2:13pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/18 "2009-03-02T14:13:33Z")
I have had the same problem for a few weeks, and two days ago I downloaded GooredFix.exe. I have not had the problem for the last few days. Here is this [thread](http://forums.majorgeeks.com/showthread.php?t=182559) about what to do. Basically I just ran option 2 based on some other thread’s recommendation to do so. However, please feel free to google GooredFix.exe and decide for yourself; I am not sure if 2 days of no problems is enough to say it is fixed, and I am most decidedly an amateur in this. I basically eventually found it by googling phrases like “google searches redirect to Topica”, etc. I did have Virtumonde last month (which should tell you how amateurish I am at protecting my computer), which seems to have caused this recently. ETA: it was fixed after doing option 2 - I did nothing after that point. ---
**Author:** ![zut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zut/32/2875_2.png) [@zut](https://boards.straightdope.com/u/zut)\ **Post date:** [March 3, 2009, 12:42pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/19 "2009-03-03T12:42:30Z")
> [@RealityChuck](#): > > OK. If Malwarebytes doesn’t work, move on to [SuperAntispyware](http://www.superantispyware.com/). I’ve had some very good success with it when Malwarebytes didn’t do the trick. OK. Tried that, and it came up with some low-level stuff (cookies, mostly), but didn’t fix the main problem. > [@samclem](#): > > Before you try that, perhaps run Malwarebytes in Safe Mode? Do you know how to do that? Good idea. I reran both SuperAntispyware and Malwarebytes in Safe mode. Malwarebytes again ID’d MyWebSearch (hmm…), but again the problem is still there. > [@Baraqiyal](#): > > This happened to me recently and it was pretty annoying. No anti-malware/anti-virus program fixed the problem. Finally I did a system restore from a previous state and that fixed the problem. (Start-\>Programs-\>Accessories-\>System Tools-\>System Restore) OK, that’s next on the list. > [@RealityChuck](#): > > System Restore is a good tool if and only if you know when you were infected. Otherwise, you’ll just be restoring the virus. Well, unless this particular thingy was dormant for some time, it’s just been this last weekend that anything showed up. Is there a downside to setting a system restore to last weekend? ---
**Author:** ![zut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zut/32/2875_2.png) [@zut](https://boards.straightdope.com/u/zut)\ **Post date:** [March 3, 2009, 11:51pm UTC](https://boards.straightdope.com/t/gah-browser-hijacker/487924/20 "2009-03-03T23:51:23Z")
> [@Baraqiyal](#): > > This happened to me recently and it was pretty annoying. No anti-malware/anti-virus program fixed the problem. Finally I did a system restore from a previous state and that fixed the problem. (Start-\>Programs-\>Accessories-\>System Tools-\>System Restore) > [@zut](#): > > OK, that’s next on the list. …And that (knock on wood) seems to have worked. We’ll see, but meanwhile thanks to y’all in this thread. [Next page](https://boards.straightdope.com/t/gah-browser-hijacker/487924.md?page=2)