# Has my computer been hijacked, or is it Google? **URL:** \ **Category:** Factual Questions\ **Created:** [January 3, 2009, 2:50am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669 "2009-01-03T02:50:01Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Lynn\_Bodoni](https://avatars.discourse-cdn.com/v4/letter/l/e47c2d/32.png) [@Lynn\_Bodoni](https://boards.straightdope.com/u/Lynn_Bodoni)\ **Post date:** [January 3, 2009, 2:50am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/1 "2009-01-03T02:50:01Z")
So, lately, when I google, I am getting a lot of advertising and commercial sites. I’ve run AdAware, AVG, and Hijack THIS, and I am still getting the commercial sites instead of the answers I wanted. Comments? Advice? HELP?!? ---
**Author:** ![Markxxx](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@Markxxx](https://boards.straightdope.com/u/Markxxx)\ **Post date:** [January 3, 2009, 2:58am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/2 "2009-01-03T02:58:28Z")
What are you trying to search, and how are you trying to search it? ---
**Author:** ![Lynn\_Bodoni](https://avatars.discourse-cdn.com/v4/letter/l/e47c2d/32.png) [@Lynn\_Bodoni](https://boards.straightdope.com/u/Lynn_Bodoni)\ **Post date:** [January 3, 2009, 3:06am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/3 "2009-01-03T03:06:40Z")
I use Mozilla Firefox, on Windows XP Home, and I am searching for answers to various riddles. It’s not one particular riddle, it’s a group of them. Also, when I just did a vanity search on Google, I found that many of the same sites are listed as the last time, but clicking on a link will redirect me to a commercial page, trying to sell me insurance or whatever. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [January 3, 2009, 3:08am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/4 "2009-01-03T03:08:47Z")
I’d suggest downloading and running malwarebytes from [http://malwarebytes.org](http://malwarebytes.org) jus to make sure your computer is clean. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [January 3, 2009, 3:10am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/5 "2009-01-03T03:10:08Z")
When you ran hijackthis, did you analyse the log by eye, or did you use this web page? [http://www.hijackthis.de/](http://www.hijackthis.de/) ---
**Author:** ![Bender44](https://avatars.discourse-cdn.com/v4/letter/b/b487fb/32.png) [@Bender44](https://boards.straightdope.com/u/Bender44)\ **Post date:** [January 3, 2009, 3:11am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/6 "2009-01-03T03:11:48Z")
While I’m sure its something innocuous, it almost sounds like something I happened to read in last month’s [Wired.](http://www.wired.com/techbiz/people/magazine/16-12/ff_kaminsky?currentPage=1) > [@](#): > > About a week later, an AT&T server in Texas was infiltrated using the Kaminsky method. The attacker took over [google.com](http://google.com)—when AT&T Internet subscribers in the Austin area tried to navigate to Google, they were redirected to a Google look-alike that covertly clicked ads. Whoever was behind the attack probably profited from the resulting increase in ad revenue. I don’t know enough about what they were talking about in the article to comment intelligently but maybe someone can come along and explain it better. ---
**Author:** ![Kevbo](https://avatars.discourse-cdn.com/v4/letter/k/e47774/32.png) [@Kevbo](https://boards.straightdope.com/u/Kevbo)\ **Post date:** [January 3, 2009, 3:12am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/7 "2009-01-03T03:12:30Z")
I recently had a malware issue that was inseting bogus sites into the top results of google searches. Malwarebytes killed it, but it was pretty nasty in that it installed stuff into my system restore points…so I had to kill off the old restore points. Also, this was on my work computer that sees the web through a nannyware proxy server that won’t allow access to known trojan sites, much less porn and such, so it didn’t come in via the usual vectors. The proxy server was what clued me into the problem…the top google search results kept getting blocked. ---
**Author:** ![Myglaren](https://avatars.discourse-cdn.com/v4/letter/m/f1d935/32.png) [@Myglaren](https://boards.straightdope.com/u/Myglaren)\ **Post date:** [January 3, 2009, 3:21am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/8 "2009-01-03T03:21:28Z")
Sounds like a redirect or even a schnide Google page - are you sure it really is Google? there is at least one emulator out there. Get [Spybot Search & Destroy](http://www.filehippo.com/download_spybot_search_destroy/) and use the advanced tools. Use the Immunize function, the resident `Tea-Timer’ and download the hosts file from Spybot S&D (Safer Networking) If it isn’t to late, lock the homepage for IE against hijacking. Get [SuperAntiSpyware (free)](http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE) and run it. Also grab [Avast!](http://www.avast.com/eng/avast_4_home.html) and install it, run a boot scan. ---
**Author:** ![Lynn\_Bodoni](https://avatars.discourse-cdn.com/v4/letter/l/e47c2d/32.png) [@Lynn\_Bodoni](https://boards.straightdope.com/u/Lynn_Bodoni)\ **Post date:** [January 3, 2009, 6:35am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/9 "2009-01-03T06:35:19Z")
I am running Malwarebytes right now. I usually use the Google thingy on the upper right corner of my browser, I’ll try typing it in by hand next. I almost never use IE, I use Firefox. I looked at the Hijack This list by eye, and will try looking at that website when MWB is done. I have up-to-date versions of AdAware and AVG. I will try the other websites, too, if this doesn’t work. THANK YOU for your help and suggestions. ---
**Author:** ![GusNSpot](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gusnspot/32/436_2.png) [@GusNSpot](https://boards.straightdope.com/u/GusNSpot)\ **Post date:** [January 3, 2009, 7:54am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/10 "2009-01-03T07:54:31Z")
I never thought a virus would dare to attack your computer Lynn. Hope you get it killed. The virus that is. I really need to get back down there and give you a hard time. 😉 Gus ---
**Author:** ![squeegee](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/squeegee/32/14537_2.png) [@squeegee](https://boards.straightdope.com/u/squeegee)\ **Post date:** [January 3, 2009, 8:08am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/11 "2009-01-03T08:08:34Z")
I had something like this happen to me, Lynn, about 12 months ago. Google searches appeared to give good results, but clicking on any of the first half-dozen or so hits would hijack me to spam sites (XXX! Girls Girls Girls! Viagra!). I ran all the proper tools, and never did track down the problem, and eventually reinstalled Windows. Good luck! ---
**Author:** ![SmartAleq](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/smartaleq/32/163_2.png) [@SmartAleq](https://boards.straightdope.com/u/SmartAleq)\ **Post date:** [January 3, 2009, 8:48am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/12 "2009-01-03T08:48:35Z")
If you get really stuck and can’t get rid of whatever’s ailing you consider heading to [Support.com](http://www.support.com/), I know they’re good because my SO works for them… 😛 They use remote access to rip out whatever malware, crapware and virus you might be harboring, up to and including some extremely nasty rootkits. It’ll cost you, but if they can’t fix it, it’s free. ---
**Author:** ![Avumede](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/avumede/32/7235_2.png) [@Avumede](https://boards.straightdope.com/u/Avumede)\ **Post date:** [January 3, 2009, 1:15pm UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/13 "2009-01-03T13:15:46Z")
Is it all searches that return spammy results, or just some? If it is some, can you give us an example that we can try and replicate? ---
**Author:** ![BarnOwl](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@BarnOwl](https://boards.straightdope.com/u/BarnOwl)\ **Post date:** [January 3, 2009, 3:10pm UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/14 "2009-01-03T15:10:53Z")
> [@Lynn\_Bodoni](#): > > I am running Malwarebytes right now. I did too, on my laptop. (Using my desktop at the moment.) Results **Objects Scanned: 118242 Objects Infected: 0 Time: 53 min 59 seconds** But it is **Currently Scanning : C:\WINDOWS\Installer\MSIB.temp** And it’s apparently hung up, with an hour glass poised over the window. I’ll probably abort the scan or close the window—unless someone here suggests I do something else—like emailing the mfr, which I also did. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [January 3, 2009, 3:51pm UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/15 "2009-01-03T15:51:58Z")
[Bleeping Computer](http://www.bleepingcomputer.com/forums/lofiversion/index.php/t108972.html) indicates that that particular file is a sign of an infection. I’d close Malwarebytes and then delete the file. If it doesn’t delete, reboot in safe mode and try it. ---
**Author:** ![Casserole](https://avatars.discourse-cdn.com/v4/letter/c/b77776/32.png) [@Casserole](https://boards.straightdope.com/u/Casserole)\ **Post date:** [January 3, 2009, 5:26pm UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/16 "2009-01-03T17:26:15Z")
Definitely malware. Google **will** put some sponsored ad results at the top, but they’d never hijack that many results, that inconspicuously. If it is not a problem at your level (i.e. not malware), it could be at the ISP’s DNS level. It’s a long shot, though, but it could happen. > [@](#): > > > [@](#): > > > > About a week later, an AT&T server in Texas was infiltrated using the Kaminsky method. The attacker took over [google.com](http://google.com)—when AT&T Internet subscribers in the Austin area tried to navigate to Google, they were redirected to a Google look-alike that covertly clicked ads. Whoever was behind the attack probably profited from the resulting increase in ad revenue. > > I don’t know enough about what they were talking about in the article to comment intelligently but maybe someone can come along and explain it better. DNS Servers work as relays, on the assumption that every website is accessible within several “hops”, similar to the “six degrees of separation” theory. When you type in anything _other_ than an IP address, like “[google.com](http://google.com)”, your computer contacts your ISP’s DNS server and asks “what is ‘[google.com](http://google.com)’'s IP address?”. If your ISP knows, great. If not, it will reply “I’ll get back to you. In the meantime, I’ll ask [another IP]”. With this sort of attack, a hacker (or cracker) might gain access to the DNS server of an ISP and alter their records so that the DNS server “knows” where “[google.com](http://google.com)” is, but is not actually correct! For all intents and purposes, until the DNS server checks with another server (all DNS servers have backups, this is why your router connects to two), [google.com](http://google.com) could point to a faulty IP. At least, this is how I see it. ---
**Author:** ![LC\_Strawhouse](https://avatars.discourse-cdn.com/v4/letter/l/e19adc/32.png) [@LC\_Strawhouse](https://boards.straightdope.com/u/LC_Strawhouse)\ **Post date:** [January 3, 2009, 5:56pm UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/17 "2009-01-03T17:56:22Z")
Same thing happened to me last week and I tried a bunch of antivirus programs, first AVG Anti-Virus, then Spybot Search & Destroy, AdWatch and Malaware. Firefox was fixed early in the process but IE was fixed only after using Malaware (the fourth program by that point). So keep trying one anti-virus program after another until it works, and make sure their virus definitions are up to date. ---
**Author:** ![Patch](https://avatars.discourse-cdn.com/v4/letter/p/a183cd/32.png) [@Patch](https://boards.straightdope.com/u/Patch)\ **Post date:** [January 5, 2009, 3:23am UTC](https://boards.straightdope.com/t/has-my-computer-been-hijacked-or-is-it-google/479669/18 "2009-01-05T03:23:15Z")
I get crap like this. I tried running a search for mercury + bullets, as the topic came up and I was poking about for info, and I get descriptions that match, [but the web page links don’t match](http://img.photobucket.com/albums/v728/patchbunny/corruption.jpg). Ran Stopzilla, SD&D, AVG, and Malwarebyte. No clue what’s happening. I got nailed by AntivirusPro2009 before Thanksgiving, and had a hell of a time trying to peel it off my system, but AFAIK it and all the malware/spyware it uploaded is gone.