/customsearch/community?hl=en
/customsearch/community?hl=en
1/16/10
Original Poster
Google user

Google Search Hijacked - How to fix this?

I keep ending up on a Google custom search that I didn't sign up for (intentionally) - through price-advisor.com 
Google (the company): you've done a great job with documentation enabling others to create custom searches, but how about some simple instructions on how to get rid of this INTRUSIVE redirection/hijack?? As far as I'm concerned, this is SPYWARE - it is something I did not download or sign up for anywhere, and so for the past few days, I've been wondering why search results looked different...
Ironically, when searching google for a fix, nothing useful comes up, so I guess I'll go use Firefox.

2010-01-15
I keep ending up on a Google custom search that I didn't sign up for (intentionally) - through price-advisor.com  using MSIE
Google (the company): you've done a great job with documentation enabling others to create custom searches, but how about some simple instructions on how to get rid of this INTRUSIVE redirection/hijack?? As far as I'm concerned, this is SPYWARE - it is something I did not download or sign up for anywhere, and so for the past few days, I've been wondering why search results looked different...
Ironically, when searching google for a fix, nothing useful comes up, so I guess I'll go use Firefox.
Community content may not be verified or up-to-date. Learn more.
All Replies (81)
troycurt
1/21/10
troycurt
Isn't there someone out there that has had this same problem?
I have the same thing happening on my computer. Do we have to give up Google for good?
Mine just goes to a different search page that I do not have any control over.
1/21/10
Original Poster
Google user
The Search Hijack Fix:
Go to "Manage Search Providers" (last item in pulldown menu of search bar on MSInternetExplorer) and you will see an extra google entry which you can simply delete. I had two which looked the same, so I just deleted them both and changed my default to Bing to give that a try...
 
I figured it out for myself since there is no actual support on this support forum. It turns out to be an easy fix, but that's not really the point...
 
mindspew
3/19/10
mindspew
It would seem logical that someone sympathetic to Microsoft or within Microsoft created or abetted this malware. After all, isn't Microsoft benefiting from the problem and hoping users will switch to BING.
Chiedu7
5/18/10
Chiedu7
I am beginning to suspect that this is a MICROSOFT plot, becos my FIREFOX has been HI-Jacked, My Chrome wont work but funnily my IE is unaffected by this browser hi-jacker!

This link might help

http://help.lockergnome.com/security/modules.php?name=Forums&file=viewtopic&p=51254#51254
perk1961
5/29/10
perk1961
struggled with this issue for a week.  Downloaded Malwarebytes and it didnt fix it, but after todays update it found and quarantined the search hijack.  here is the log it gave me.  Malwarebytes is awesome. its at  malwarebytes.org. Ive tried other ones. AVG is pretty good, Hitman 3.5 is pretty good. I havent had good luck with spyware doctor. I'm a malwarebytes fan.    Ive used malwarebytes on several occasions and on several PC's and it works the best in my opinion. When it doesnt fix something right away, after a couple of days of getting updates, it does.. and it's free. The upgraded (paid) version is the one that will protect your PC and does auto updates, I think. And if I wasnt on a company laptop I'd buy their paid version just to say thanks for getting me out of several jams. Also-  for those who dont know this...BE CAREFUL about downloading spyware detection software. Its often spyware itself, just posing as a fix.

Heres the log file it gave me today after finding "1" infection in my registry, that others did not find.

---------------------------------------------------------
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4154
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

5/29/2010 3:43:22 PM
mbam-log-2010-05-29 (15-43-22).txt

Scan type: Quick scan
Objects scanned: 153171
Time elapsed: 11 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.


Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

robh123
7/22/10
robh123
I fixed it in Firefox by closing firefox, removing the offending code from google.xml (C:\program files\Mozilla Firefox\searchplugins) and deleting search.json (in my firefox profile folder) (firefox rebuilds the file when you restart the browser).

I also had the aforementioned registry error, but strangely only in the IE folder
Kent_Diego
9/12/10
Kent_Diego

I just fixed the Google search hijacked on my computer. I had to edit the hosts file to fix. The hosts file had lines:
212.117.178.25 www.google.com
212.117.163.43 search.yahoo.com

I tried Malwarebytes, SuperAntiSpyware, AdAware!, and CureIt! but none of them found this. Also look at your Tools>Internet Options>Connections to be sure no proxies have been added.

Economic Computing
10/30/10
Economic Computing
Hi, I had this exact same problem, here is what I did: #1 - Run regedt32 (windows registry editor). Search for 'google.com' - you will see one or two of the hijacked CSE URL, delete the value that you see (not the key). This will prevent IE from having the problem, although it persists in Firefox. to remove from Firefox as well... #2 - In the Program Files/Mozilla Firefox/searchengine directory, find google.xml and remove the CSE line (or delete the file altogether if you don't know enough HTML to remove the problem URL) #3 - Unfortunately there is no way to get around this, you need to uninstall Firefox then reinstall. You can keep all your settings, but you do need to uninstall the program itself. As far as the cause... this seems to be a problem in the Firefox executable itself, somehow it can be configured to permanently and unchanageably force the CSE, even when no remnant of that CSE URL exists in any other file or registry key or setting. Hopefully Mozilla takes this one seriously because in my research I have been seeing a LOT of people having this issue! Also I hope Google sues price-advisor.com; quite frankly I'd like to sue them myself to recoup my losses for all the time it took me to get rid of their hijack.
kenbb
11/23/10
kenbb
I found that my default search provider had been changed / hijacked to some provider I'd never heard of.  I changed the default search provider back to Google through Firefox's about:config and that fixed the problem. 
DuffSpy
1/9/11
DuffSpy
Same problem with me also
 Ran a small app called tdsskiller
  http://support.kaspersky.com/downloads/utils/tdsskiller.zip
   Seems to have worked
     Good luck
70 MORE
Debra Rodriguez
10/7/18
Debra Rodriguez
What if that box was not checked? Other ideas?

 
This question is locked and replying has been disabled. Still have questions? Ask the Help Community.

Badges

Some community members might have badges that indicate their identity or level of participation in a community.

 
Expert - Google Employee — Googler guides and community managers
 
Expert - Community Specialist — Google partners who share their expertise
 
Expert - Gold — Trusted members who are knowledgeable and active contributors
 
Expert - Platinum — Seasoned members who contribute beyond providing help through mentoring, creating content, and more
 
Expert - Alumni — Past members who are no longer active, but were previously recognized for their helpfulness
 
Expert - Silver — New members who are developing their product knowledge
Community content may not be verified or up-to-date. Learn more.

Levels

Member levels indicate a user's level of participation in a forum. The greater the participation, the higher the level. Everyone starts at level 1 and can rise to level 10. These activities can increase your level in a forum:

  • Post an answer.
  • Having your answer selected as the best answer.
  • Having your post rated as helpful.
  • Vote up a post.
  • Correctly mark a topic or post as abuse.

Having a post marked and removed as abuse will slow a user's advance in levels.

View profile in forum?

To view this member's profile, you need to leave the current Help page.

Report abuse in forum?

This comment originated in the Google Product Forum. To report abuse, you need to leave the current Help page.

Reply in forum?

This comment originated in the Google Product Forum. To reply, you need to leave the current Help page.