Google search links "hijacked" to other sites when clicked, huh ?

  • Thread starter Thread starter Courtney Thomas
  • Start date Start date
C

Courtney Thomas

All of a sudden, when I click on the displayed links after a Google search,
the links are not followed, but rather
other sites, such as various commercial and porn, are jumped to instead.

I used AVG's virus software and it found one Trojan, "Dropper.Generic.HSB",
which it removed, but the hijacking
is still going on.

What's wrong and how's it cured, please ?

Thank you,
Courtney
 
From: "Courtney Thomas" <[email protected]>

| All of a sudden, when I click on the displayed links after a Google search,
| the links are not followed, but rather
| other sites, such as various commercial and porn, are jumped to instead.
|
| I used AVG's virus software and it found one Trojan, "Dropper.Generic.HSB",
| which it removed, but the hijacking
| is still going on.
|
| What's wrong and how's it cured, please ?
|
| Thank you,
| Courtney
|



If you are using any version of Sun Java that is prior to JRE Version 5.0 update 10,
then you are strongly urged to remove any/all versions.
There are vulnerabilities in them and they are actively being exploited.

It is highly suggested that you update to the latest version which is Sun Java JRE/JSE
Version 5.0 Update 10

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.5.0_10

http://java.sun.com/javase/downloads/index.jsp
http://www.java.com/en/download/manual.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102622-1


For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/
http://www.lavasoft.de/ms/index.htm

* SpyBot Search and Destroy v1.4
http://security.kolla.de/
http://www.safer-networking.org/microsoft.en.html

* SuperAntiSpyware
http://www.superantispyware.com/superantispywarefreevspro.html

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *
 
David said:
...
If you are using any version of Sun Java that is prior to JRE Version 5.0 update 10,
then you are strongly urged to remove any/all versions.
There are vulnerabilities in them and they are actively being exploited.

It is highly suggested that you update to the latest version which is Sun Java JRE/JSE
Version 5.0 Update 10
Click to expand...

I have Version 1.5.0 (build 1.5.0_09-b03) Doing the update didn't
bring in the new version. What am I supposed to do?
 
[This followup was posted to microsoft.public.win2000.general and a copy
was sent to the cited author.]

All of a sudden, when I click on the displayed links after a Google search,
the links are not followed, but rather
other sites, such as various commercial and porn, are jumped to instead.

I used AVG's virus software and it found one Trojan, "Dropper.Generic.HSB",
which it removed, but the hijacking
is still going on.

What's wrong and how's it cured, please ?
Click to expand...

You need more than anti-virus scanning. Many do a poor job with adware
that has probably infected your computer. Two free, and well known, ad
scanners you can try are:
Ad-Aware SE:
http://www.lavasoft.com/
AwAware also has a paid version that has a resident scanner and
protection.

Spybot Search & Destroy
http://www.spybot.info/
If you use IE for browsing (bad idea), then Spybot has 'immunization'
that can stop some forms of infection.

There are also several others out there. You need to be careful as some
'cleaners' are adware/trojans themselves!
 
Please see interleaved comments below, and the end of my comments-1 will be
indicated by:

END_OF_COMMENTS-1
**********************

David H. Lipman said:
From: "Courtney Thomas" <[email protected]>

| All of a sudden, when I click on the displayed links after a Google search,
| the links are not followed, but rather
| other sites, such as various commercial and porn, are jumped to instead.
|
| I used AVG's virus software and it found one Trojan, "Dropper.Generic.HSB",
| which it removed, but the hijacking
| is still going on.
|
| What's wrong and how's it cured, please ?
|
| Thank you,
| Courtney
|



If you are using any version of Sun Java that is prior to JRE Version 5.0 update 10,
then you are strongly urged to remove any/all versions.
There are vulnerabilities in them and they are actively being exploited.

It is highly suggested that you update to the latest version which is Sun Java JRE/JSE
Version 5.0 Update 10

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.5.0_10
Click to expand...

Under that dir, I have: <----------
JRE1.5.0_09 <----------
JDK1.5.0_09 <-----------
J2RE1.4.2_10 <-----------
http://java.sun.com/javase/downloads/index.jsp
http://www.java.com/en/download/manual.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102622-1


For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/
http://www.lavasoft.de/ms/index.htm

* SpyBot Search and Destroy v1.4
http://security.kolla.de/
http://www.safer-networking.org/microsoft.en.html
Click to expand...

I've already installed/run these 2, which removed ~175 nasties.
<---------------------

* SuperAntiSpyware
http://www.superantispyware.com/superantispywarefreevspro.html

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *
Click to expand...


I've also already run this one too. It found one Trojan horse:
Dropper.Generic.HSB <--------------------------------

END_OF_COMMENTS-1
**********************
 
From: "Courtney Thomas" <[email protected]>

< snip >

|
| Under that dir, I have: <----------
| JRE1.5.0_09 <----------
| JDK1.5.0_09 <-----------
| J2RE1.4.2_10 <-----------
|

< snip >

Too many versions. Remove them all.

Are you a Java Developer ? If yes just use v5 update 10 developemnt version.
Otherwise just install JRE v5 update 10.
 
David,

When I try to remove JRE1.5_09 from C:\ProgramFiles\Java\ I get the message
that "jusched.exe" cannot be removed because "source file may be in use".

Is this "normal" ?

Should I just ignore JRE1.5_09 and install JRE v5update10 anyway and then
try to delete JRE1.5_09, or what ?

Appreciatively,

Courtney
 
From: "Courtney Thomas" <[email protected]>

| David,
|
| When I try to remove JRE1.5_09 from C:\ProgramFiles\Java\ I get the message
| that "jusched.exe" cannot be removed because "source file may be in use".
|
| Is this "normal" ?
|
| Should I just ignore JRE1.5_09 and install JRE v5update10 anyway and then
| try to delete JRE1.5_09, or what ?
|
| Appreciatively,
|
| Courtney
|


You *must* do this via the Control panel applet "Add/Remove Progtrams".
 
David said:
From: "Courtney Thomas" <[email protected]>

| David,
|
| When I try to remove JRE1.5_09 from C:\ProgramFiles\Java\ I get the message
| that "jusched.exe" cannot be removed because "source file may be in use".
|
| Is this "normal" ?
|
| Should I just ignore JRE1.5_09 and install JRE v5update10 anyway and then
| try to delete JRE1.5_09, or what ?
|
| Appreciatively,
|
| Courtney
|


You *must* do this via the Control panel applet "Add/Remove Progtrams".
Click to expand...

I've been following this from the sidelines and I'm curious: if it's
necessary to remove update 09 (and earlier) to run update 10, why
doesn't update 10 remove them automatically when it installs?
 
From: "Sid Knee" <[email protected]>


|
| I've been following this from the sidelines and I'm curious: if it's
| necessary to remove update 09 (and earlier) to run update 10, why
| doesn't update 10 remove them automatically when it installs?

A question that has been asked, over and over.

At most the answer is if a Java Applet has a dependency on a particular version. However,
this should NOT be the case.

Sun is screwed up. Over the past several months we have seen numerous bug error and
vulnerability notifications in Sun Java. This is very problematic as some malware can
actually seek out a vulnerable version of Sun Java on a PC using multiple versions. Even if
a non-vulnerable version is installed.

So this is a BIG question.
Why does a new version get installed w/o uninstalling older version ?

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102622-1
 
David said:
So this is a BIG question.
Why does a new version get installed w/o uninstalling older version ?
Click to expand...

Thanks, Dave. I see that better minds than mine are asking the same
question.
 
Back
Top