Is it my computer or is Google being "hijacked?"

[fiddler]

This may sound like a stupid question, but has anyone else experienced this:
I'm doing a search on Google and when I click on the listings that I think are relavent within the top ten of the search, I end up not on the page promised in the listing, but on another site entirely that often has nothing to do with what I'm looking for. I have to back-track to the listing page, then literally type or copy/paste the URL shown in the listing to get where I want to be. The further I go in the search - say pages 2-10, I don't have that problem, just with the first page.

At first, this was a minor annoyance, happening only once in a while. Now it is happening with every click! Anyone know what's going on?

[usearchme]

Sounds like spyware to me or a virus, have you scanned wiht spybot etc ? as my google is working fine

Woc

[wige]

It definitely sounds like malware to me. I would uninstall and reinstall your anti-malware software (Avast is really good for this - its free for home use and has an on-boot scan it will run after being installed for the first time).

[morestar]

Originally Posted by fiddler

This may sound like a stupid question, but has anyone else experienced this:
I'm doing a search on Google and when I click on the listings that I think are relavent within the top ten of the search, I end up not on the page promised in the listing, but on another site entirely that often has nothing to do with what I'm looking for. I have to back-track to the listing page, then literally type or copy/paste the URL shown in the listing to get where I want to be. The further I go in the search - say pages 2-10, I don't have that problem, just with the first page.

At first, this was a minor annoyance, happening only once in a while. Now it is happening with every click! Anyone know what's going on?

yes do a virus scan and you will see that you've been hit with something. The exact same thing happened to me and it really freaked me out. But yes, just virus scan it and you'll be ok once you find the culprit...

Oh and this might be interesting: http://www.seofaststart.com/blog/google-proxy-hacking

[wpriley]

I think your browser settings have been comprised sending your browser requests through a third-party proxy server which is sending your search requests to sponsored sites where the perpetrator has a revenue sharing arrangement. It's easy to check. In Firefox go to Tools > Options > Advanced > Network > Connection Settings. If a proxy server is enabled that is unfamiliar to you, change back to "no proxy". This should take care of the issue assuming a piece of resident malware on your computer does not reenable the spoofed proxy server.

IE settings are likely similar.

Good luck.

[weegillis]

Try the same search on multiple SEs and see if the same result occurs. This will tell you, a) if it's related only to Google; and, b) whether it might be malware on your machine.

[deepsand]

Is this happening on all searches?

If not, please provide us with examples of those where it does happen.

[Ravenhawk]

Yes you have been hijacked by malware, I would suggest the following to find and fix.

Download and run
ComboFix from here A guide and tutorial on using ComboFix
Download and run Malwarebytes from here Malwarebytes.org

after these run your other malware programs reinstall and update your antivirus programs this should get it.

You could have been hit like I was last week by a drive by downloading.
Good luck.

[Clint1]

Originally Posted by fiddler

This may sound like a stupid question, but has anyone else experienced this:
I'm doing a search on Google and when I click on the listings that I think are relavent within the top ten of the search, I end up not on the page promised in the listing, but on another site entirely that often has nothing to do with what I'm looking for. I have to back-track to the listing page, then literally type or copy/paste the URL shown in the listing to get where I want to be. The further I go in the search - say pages 2-10, I don't have that problem, just with the first page.

At first, this was a minor annoyance, happening only once in a while. Now it is happening with every click! Anyone know what's going on?

Strange that no one has asked for an example of what you're searching for when you see this so others could check it. While it could be malware, it's most odd for malware to be so specific with one SE.......but it could also be G's typical allowance of black-hat techniques to special treatment sites. I see it all the time. They say they don't allow it, yet they constantly allow certain sites to do their page cloaking and deceptive redirects. Yesterday I was searching for something using G, I read the result, clicked on the link, and I was sent to page that required a login to read it! That's illegal by their own admission, yet they allow it. Happens all the time to me. They also allow similar BH techniques at WMW, Bizrate, Epinions, and other types of useless "portals".

So post the example and let others see if they get the same result.

[Hsekhar]

The URLs of the sites would help the users a bit. Also You should scan your PC with either Kaspersky or Nod32 to find out if there are any malware on your system.

[Clint1]

I also don't see where anyone mentioned HijackThis. It's free and takes only about 5 seconds to scan. If you do happen to have a common hijack problem it may find it and correct it. If you are not familiar with it, DO NOT let it "fix" anything! Just post the results here.

[deepsand]

It's also possible that the OP was clicking on AdWords listings, rather than organic ones.

[shakir]

better first clear all the cach and hostory then open new try.. also using kaspersky clear the PC

[deepsand]

Why is nearly everyone here assuming that malware is to blame?

[almer]

Originally Posted by deepsand

Why is nearly everyone here assuming that malware is to blame?

That's easy Deepsand.

Occam's razor: “Of several acceptable explanations for a phenomenon, the simplest is preferable.”

Given the information provided, it's either this or another evil G-plot.

[nickoran]

Originally Posted by almer

That's easy Deepsand.

Occam's razor: “Of several acceptable explanations for a phenomenon, the simplest is preferable.”

Given the information provided, it's either this or another evil G-plot.

Nice! lol

Yer defo sounds like malware, odd that others dont seem to have noticed it either, things like this often spread and get heard of quite quickly.

[Clint1]

Originally Posted by deepsand

Why is nearly everyone here assuming that malware is to blame?

Yeah. What I find most odd, is what happened to the OP?

[morestar]

in my case it was malware and the problems were the same.

[deepsand]

Originally Posted by almer

Occam's razor: “Of several acceptable explanations for a phenomenon, the simplest is preferable.”

Given the information provided, it's either this or another evil G-plot.

But, in this case it's not the most simple; the most simple is that the OP was clicking on AdWords links, not organic ones.

Given the lack of necessary specifics, any conclusions involving hijacking are mere speculation.

[weegillis]

Originally Posted by Clint1

What I find most odd, is what happened to the OP?

This is what happens most often in the forums. Folks post their problems but never the solutions. We are going to be guessing at this one until we hear back from fiddler.

[deepsand]

Surprisingly, given the nature and focus of the site, this behavior on the part of supplicants is rampant on TechRepublic as well.

There, in the Q&A forum, there is a mechanism whereby the OP can easily click to mark helpful responses, which frequently goes unused. Worse yet is the fact that most don't bother reading instructions, and end up posting their questions in the general Discussions forum.

Even when PMed for feedback and/or additional information, exceedingly few respond, with the result that many of those there who have significant technical knowledge & experience to share have simply given quit trying to help.

[thindenim]

It's definitely spyware. I saw it on a clients machine a couple of years ago and a search and destroy from Spybot fixed it.

[fiddler]

Sorry to have taken so long to get back to you all on this, but I have read and followed your suggestions concerning malware. I have Norton 360 running on my computer, plus I routinely use (as in every other day or so) CCleaner, Spybot, SpywareBlaster, and a couple of others (I'm o/c when it comes to this kind of stuff, I guess). I have nearly 2 terrabytes of hard drives on my system and it takes a while (when I'm not occupied with my regular job as webmaster) to go through everything with a fine tooth comb.

While a couple of malicious things were found and removed, they didn't seem to be that threatening. Nothing really spectacular showed up to give me an Ah-ha moment, anyway.

But I thought at first something had worked, as in my test search I was getting to the promised links. (and yes, I was making absolutely sure I wasn't clicking on any AdWords, etc.) But then it started happening again. I'd click on the blue header at the top of the listing, or on the URL at the bottom of the listing, and the only time I could get to the correct link was to copy and paste the URL at the bottom of the listing - clicking on it just took me to some bizarre site that had absolutely nothing to do with my search.

I tested Yahoo and MSN search engines and found them to be working correctly. So I was at a total loss. Then I realized something - have Google Search on my toolbar and when I used that, I was getting the funky links. But if I went to Google-dot-com directly and did a search, everything worked as it should. So, I guess my Google toolbar is corrupt and I'll be uninstalling it.

Thanks for the tips and patience.

[Clint1]

Originally Posted by fiddler

.......I tested Yahoo and MSN search engines and found them to be working correctly. So I was at a total loss. Then I realized something - have Google Search on my toolbar and when I used that, I was getting the funky links. But if I went to Google-dot-com directly and did a search, everything worked as it should. So, I guess my Google toolbar is corrupt and I'll be uninstalling it.

Thanks for the tips and patience.

Thanks for the update. Interesting. Along with tracking your movements and search phrases, that's another reason not to use the G toolbar. It may not be corrupted, that may be normal behavior for it.

[weegillis]

Another reason to just use the search bar that comes with the browser. Toolbars are like bloatware... they offer so much, yet very few users ever utilize more than a smattering of features.

[deepsand]

The stories of problems caused by tool bars are legion. I've a client who has a particular machine on which the Google tool bar persistently, and with no obvious pattern, changes his customized tool bars layout; rather than give up the Google tool bar, he insists on keeping it, and constantly bitching about the problem.

The OPs situation also serves to highlight the importance of never assuming that the seemingly obvious cause of a problem is the true one.

[qh4dotcom]

It's most likely some kind of problem with your computer. That has never happened to me with Google

[Clint1]

Originally Posted by qh4dotcom

It's most likely some kind of problem with your computer. That has never happened to me with Google

(If you're talking about the OP), He already said it was the G toolbar causing it.

[Clint1]

Originally Posted by deepsand

The stories of problems caused by tool bars are legion. I've a client who has a particular machine on which the Google tool bar persistently, and with no obvious pattern, changes his customized tool bars layout; rather than give up the Google tool bar, he insists on keeping it, and constantly bitching about the problem.

The OPs situation also serves to highlight the importance of never assuming that the seemingly obvious cause of a problem is the true one.

Yep, it's also the Ask toolbar as well. I don't remember how or why I actually allowed it on my PC......I think I was trying to find out if Ask had a similar WMT area as G and thought maybe the toolbar would have some info about that. Well, I uninstalled it....TRIED to uninstall it. Even after doing that, every time I tried to search using Ask, they slapped their annoying, obnoxious, invading header bar on EVERY SERP clicked! This is NOT their toolbar, but something even more obnoxious and sinister, and it showed up AFTER the toolbar was removed! I kept clicking "remove permanently", that didn't work. I had to run HijackThis to remove all of its BS, and, also manually delete keys from the Registry that HJT could not remove!

SE Toolbars just plain suck. They are malware, trackware, follow-me-around-ware, hijackers, etc. That should be one of the many things that "internet police" should outlaw internationally--if such a body would ever exist.

[MrGamm]

Originally Posted by fiddler

This may sound like a stupid question, but has anyone else experienced this:
I'm doing a search on Google and when I click on the listings that I think are relavent within the top ten of the search, I end up not on the page promised in the listing, but on another site entirely that often has nothing to do with what I'm looking for. I have to back-track to the listing page, then literally type or copy/paste the URL shown in the listing to get where I want to be. The further I go in the search - say pages 2-10, I don't have that problem, just with the first page.

At first, this was a minor annoyance, happening only once in a while. Now it is happening with every click! Anyone know what's going on?

I haven't experienced your exact issue... but computers are not perfect... why would someone take the time to make a malware program which skews your search results.

Perhaps your personal search history is broken. They are continually slapping on new features and extensions... Google breaks... believe it or not...

Have you tried reporting the bug to Google yourself. They should have someone on staff to listen to your problem.

[deepsand]

Originally Posted by Clint1

SE Toolbars just plain suck. They are malware, trackware, follow-me-around-ware, hijackers, etc. That should be one of the many things that "internet police" should outlaw internationally--if such a body would ever exist.

And, it's getting worse, as more and more software providers push them along with their own downloads.

For months now, every Java update has included the "offer" to install a tool bar of some sort; ditto for most of the Adobe updates. And, the default has the option box for such pre-checked, so that the users get hit with it if they don't take notice and un-check it.

Though I've not seen it myself, I've had reports of Symantec doing likewise.

[Clint1]

Originally Posted by MrGamm

I haven't experienced your exact issue... but computers are not perfect... why would someone take the time to make a malware program which skews your search results.

Perhaps your personal search history is broken. They are continually slapping on new features and extensions... Google breaks... believe it or not...

Have you tried reporting the bug to Google yourself. They should have someone on staff to listen to your problem.

Is it my computer or is Google being "hijacked?"

[Clint1]

Originally Posted by deepsand

And, it's getting worse, as more and more software providers push them along with their own downloads.

For months now, every Java update has included the "offer" to install a tool bar of some sort; ditto for most of the Adobe updates. And, the default has the option box for such pre-checked, so that the users get hit with it if they don't take notice and un-check it.

Though I've not seen it myself, I've had reports of Symantec doing likewise.

Yeah that's infuriating, especially when the boxes are all checked by default, you UNCHECK them, and they still install it! People are stupid enough to install them and use them, and that further propagates the slanderous harmful myths about the satan-spawned G PR indicator on the toolbar.

[MrGamm]

The PR indicator doesn't really do a whole lot as far as interference goes. But I recently added an extra layer of firewall to my system and I was quite frankly surpised at how many blocks from Google down in California happened. Why are they continually connected to my computer like that anyways? The PR toolbar works just fine with the firewall on...

I also noticed that google has recently changed the way they serve thier search results. They are wrapping thier text links in javascript. This used to only be the case with thier paid advertisements. It could very well be an issue with google causing your problem as they are changing their systems to accommodate the single user rather than the whole... personal preferences, profiling, ect...

Why not try shutting off personal search histories or blocking cookies from them or simply try turning javascript off and examine the links on the page to ensure what you are clicking is the correct thing.

That being said... I have experienced significant issues to my websites with virus scanners which ghost users to the website. The software does it to try and find phising scams, but I can see no reason why those softwares should have any permission to follow my clients into their password protected areas. (not that they get inside because it's password protected, but they couldn't find a phish using that technique anyways.) I can't remember the names of the anti-virus software. It wasn't symantic, or google or the other brands mentioned so far.

[Clint1]

Originally Posted by MrGamm

The PR indicator doesn't really do a whole lot as far as interference goes. But I recently added an extra layer of firewall to my system and I was quite frankly surpised at how many blocks from Google down in California happened. Why are they continually connected to my computer like that anyways? The PR toolbar works just fine with the firewall on....

That's the way all of those SE toolbars work! They are constantly checking on the users' surfing habits and everything you do on the net is tracked by them. They're no good.

I also noticed that google has recently changed the way they serve thier search results. They are wrapping thier text links in javascript. This used to only be the case with thier paid advertisements. It could very well be an issue with google causing your problem as they are changing their systems to accommodate the single user rather than the whole... personal preferences, profiling, ect...
Why not try shutting off personal search histories or blocking cookies from them or simply try turning javascript off and examine the links on the page to ensure what you are clicking is the correct thing.

I haven't noticed that here, I still see them as basic HTML non-tracking links (unlike Y). I never use their basic homepage for SERP checks. G.com is also in my Restricted Sites zone with all cookies blocked. I found a way of using preferences and keeping them without having to suck on a G Cookie. Use this URL:
google.com/search?as_q=+&num=10&hl=en&newwindow=1&btnG=Google +Search&as_epq=&as_oq=&as_eq=&lr=lang_en&as_ft=i&a s_filetype=&as_qdr=all&as_nlo=&as_nhi=&as_occt=any &as_dt=i&as_sitesearch=&safe=off
Don't forget to put http://www. in front of that, I removed it there so you could see the URL's contents. That is set for English, safe search off, links opening in a new window, and 10 results per page.

One click to the Advanced Search page:
google.com/advanced_search?q=the&hl=en&lr=lang_en&safe=off&ne wwindow=1
(and again, add http://www. to the beginning). A word of at least 3 letters has to be entered in order for the text boxes to show, so I used "the". You can leave that in since that's going to be part of any webpage, or just remove it before searching. It would work better if I could find a way to put a space after "the" so one could just simply click after that and start typing. Just putting a space, or %20 or &%20 doesn't work, nor does +, I'm still working on that.

[wige]

Actually, the only time a search engine toolbar sends data back is if you enter a search term or if you use Google and have the pagerank module enabled. The only exception is toolbars that warn about blacklisted sites. This can be tested fairly easily to confirm with your specific toolbar, and security and privacy enthusiasts usually give these utilities a thorough working over.

As far as privacy when clicking a search engine result, you have no privacy at all. Even if you disable cookies, the link goes to an interstitial page which records your IP, the ID code assigned to you by your ISP, which item you clicked, what your search term was, etc.

[MrGamm]

Originally Posted by wige

Even if you disable cookies, the link goes to an interstitial page which records your IP, the ID code assigned to you by your ISP, which item you clicked, what your search term was, etc.

Yes... of course... I truly believe that this year morseo than previous years that the concepts of privacy, proxies, firewalls, open relays and cookies have more importance than before.

There is nothing wrong with a happy consumer but an aware consumer is even better.

It is worth it to take the time to read a search engines privacy policy. It is your legal right to know.

For instance... This search engine is interested in your "confidential medical information, racial or ethnic origins, political or religious beliefs or sexuality."

Privacy Glossary ? Google Privacy Center

And this search engine has recently begun to partner with China to censor it's content with a political agenda. These are all important things to be aware of.

BBC NEWS | Technology | Google censors itself for China

Just my two cents...

[Clint1]

Originally Posted by wige

Actually, the only time a search engine toolbar sends data back is if you enter a search term or if you use Google and have the pagerank module enabled. The only exception is toolbars that warn about blacklisted sites. This can be tested fairly easily to confirm with your specific toolbar, and security and privacy enthusiasts usually give these utilities a thorough working over.

Dunno, I've gotten toolbars "sniffs & probes" firewall warnings when not even using them to search.

As far as privacy when clicking a search engine result, you have no privacy at all. Even if you disable cookies, the link goes to an interstitial page which records your IP, the ID code assigned to you by your ISP, which item you clicked, what your search term was, etc.

Yep. There's little privacy at all anytime you're on the net, unless you use an IP cloaker which would help. But I still don't want their tracking Cookies on my PC if I can avoid it. Only reason I mentioned it was "MrGamm" mentioned them.