Google Hijack Problem

[johnstone]

I have just finished removing spyware from my machine (Azesearch) and everthing seemed to be fine after the removal.

Only one problem. Google has been hijacked. When I go to the google website I get a fake page up and when I type in a search term it comes up with lots of adult sites everytime.

I have tried Adaware and Webroot Spy Sweeper and both can't find anything.

I have also scoured the net trying to find a way to get google back but have had no luck.

Is there anyone out there who can help or has experienced the same problem.

Thanks

Peter

 

[The Dark Elf]

check your hosts file in your windows directory, the IP for google will have been changed so its directing it somewhere else instead when you type in the address.. you'll probably find a bunch of others have been changed like that also.

 

[johnstone]

Thanks for the help.

How do I access the host directory and delete these?

 

[The Dark Elf]

Thanks for the help.

How do I access the host directory and delete these?

go to winnt\system32\drivers\etc\hosts (that should be where its located) take it into notepad and look through it. Depending on the kind of anti-spyware you've got installed, you might have a long list of site names pointing at 127.0.0.1. eg: this is the start of mine

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1 babe.the-killer.bz
127.0.0.1 babe.k-lined.com
127.0.0.1 did.i-used.cc
127.0.0.1 coolwwwsearch.com
127.0.0.1 coolwebsearch.com
127.0.0.1 hi.studioaperto.net
127.0.0.1 www.webbrowser.tv
127.0.0.1 www.wazzupnet.com
127.0.0.1 gueb.com
127.0.0.1 kabex.com
127.0.0.1 www.hityou.com

and it goes on like that page after page after page. So if yours is like that, search for google in it, it shouldn't even be in the list so if it appears check the IP next to it, it'll be something out there (don't test it or you might get infected again) just delete anything suspicious like that. then try again with going to google in your browser, you might need to force a refresh Ctrl+F5 if it doesn't appear correctly first time, and also clear your cache and history and cookies, just to be sure.

 

[johnstone]

Thanks a lot Dark Elf It worked a treat!

The host file was full of references to Google so I just deleted them all and google is back to normal.

Once again thanks....I thought I was going to be at this all day!

 

[The Dark Elf]

Thanks a lot Dark Elf It worked a treat!

The host file was full of references to Google so I just deleted them all and google is back to normal.

Once again thanks....I thought I was going to be at this all day!

hehe glad you got it sorted

spybot btw has some options you can set which backs up your hosts file and protects it from being edited by rouge apps, aswell as takes a list of the more troublesome sites and redirects them all to your own ip, so even if something tries to cause trouble by sending you to one of them to pick up more spyware, it can't find the site. Which is neat