Spyware presents fake Google homepage?

Got that crap recently, too.
It ads some porn related keyword search links to the "Google home page".

It altered c:\windows\default.css, c:\windows\system32\drivers\etc\hosts, and added tons of entries in registry.

Neither AdAware nor HijackThis weren't able to find it.

I am not sure whether it is related or not, but many entries in the registry were related to coolwwwsearch.com "search engine".

There were some other URLs there, too, which I don't remember now.

cheeter

that is such a good idea wish i tghought ofnit

I just had this shit infecting my computer the past few days. I've never seen anything like it. I'm very computer literate, and know I've not installed any software that would have caused this. Must have been from spyware. I went to google.com today and there was a page explaining that I was "infected" with this. I edited my hosts file, ran Adaware again (it didn't detect it previously) and I seem to be OK, for now.

Both an extremely disturbing advent in the world of spyware and internet security, and also a fairly clever hack..

I had the same problem and after running spybot s&d it brought up a list a mile long.

HOW CAN I GET RID OF THE HORRIBLE GOOGLE FAKE SEARCH BAR !!! H E L P M E !!! Yes from Coolwwsearch, THAT IS WHERE IT CAME FROM, I USED THIS COOL SEARCH, I am very computer literate and I cannot get rid of this HELP ME SOMEONE!!!

yeah i've got this as well. Norton doesn't pick it up and after deleting the entires in the 'hosts' file it seems to go away, however it also sticks a IBar with pornographic entries on it, (links etc.) i think i got it off something i downloaded from kazaa or some other link. ah well.

i use google.ca as a homepage on IE. i was just displayed the google "you are not allowed to access google because there is software on your computer that doesn't allow google to run..." (paraphrase - i should have copied the page.) it recommended editing the hosts file, checking out a spyware eliminating program, and research (using a search engine - ha ha) "spyware", "scumware"...

my comments: be honest - it could be that we were surfing porn last week and indiscriminately clicked "yes" instead of "no" when asked to download porn surfing software...even by mistake. i run adware regularly with only ever doubleclick and fastclick showing up as suspect (nhl.com perpetrator). same today. so - i figure it could be the porn sites crazy popup software, as i use no enhanced browser programs, toolbars, am not a gamer, and have never clicked on that infernal monkey. the funny thing is, the google webpage with spyware information is telling us that a program has been installed on our computers that purportedly does what the page is doing - redirecting us from accessing google. so which is it? to be cautious - i edited the hosts file with # entries before each line, instead of deleting it - just in case it was a bogus redirected message by the spyware itself. there were at least 25 google entries, and all other entries were search engines. so i #'d THEM ALL. seems to work too - and no more host files for lycos, hotbot, msn, altavista,...

i'll mention one other recent disturbing occurance. i know my computers very well, so it's a valid observation and MAY have something to do with the porn and spyware. i left a browser window open on www.cursor.org - an alternative media source. two hours later my monitor was black. moved the mouse, enter, spacebar, ctrl+alt+del, esc, turned monitor off and on again, jumped up-and-down. still black. 5-second forced reboot, and all is well. maybe the reboot installed the spyware, but i think more likely the us gov't monitors anyone investigating non-mainstream media sources, and was scrutinizing my hard-drive. (maybe the gov't installed the spyware - that's fitting. don't blame the porn sites, blame bush!)

cheers, and happy non-paranoid surfin'.
j

Good post jer.

I haven't been infected with any Google.com hijacking scumware yet, but I recently noticed that my "domain not found" page has suddenly been hijacked by some site.

I have just started using Spybot instead AdAware. It found a many things that AdAware didn't. It also comes with a tool that adds a bunch of known scumware URLs to your hosts file (these are sites know to install scumware) - so that future attempts to install scumware from those sites will be blocked (a good idea for porn surfers everywhere). Here is the URL:

http://www.safer-networking.org/

2 days ago when opening google with Kmeleon, it would open a page with a script and go nowhere. Last night it redirected me to the "fake Google page". IE works (but it has the toolbar - which did not bother me)
I checked and found the new entries in the host file, I removed them, I run Spybot which got rid of some more garbage and found them again but I overlooked the fact that there were 2 "host" files (one in c:/winnt, and another in c:/winnt/system32/drivers/etc - which is the one that Spybot was checking). Got rid of those too... problem half solved (IE still has the toolbar)...

but has anyone seen this

http://drorshalev.brinkster.net/dev/NSNVBackFake/

and how is this related to it? how did it point to the PROPER google before I cleaned the host file?

berillio

just helped my neighbor with this. she has kids and says they tend to click 'yes' on all that spyware pop crap.

Anyway, she had the same thing jer had. I did the same as jer and the problem went away.

I was VERY suspicious about the solution though because the page you went to instead of google.com didn't look professional and I was wondering how the site I was on knew where I wanted to go when apparently the spyware was controlling it. know what I mean??

In other words, why would an unwanted program that took over your browser send you to a webpage that shows you how to bypass the unwanted program??

Another weird thing was I could not find anything about this subject on McAfee or Microsoft or (the real) Google. This must be new.

Dee, I do know what you mean. My theory is that the Google Toolbar is tracking where you surf and is recognizing that Google.com is not resolving to the right IP address range. Essentially, I think Google's own spyware (the toolbar) is presenting this message. Can anyone confirm? Do you have the toolbar installed? Also a screen shot of that "fix your hosts file" message would be interesting to see...

I get the same thing only when I got to remove the ref to google from c:/winnt/system32/drivers/etc but I have no host dir and don't know what else to do ran ad aware nothing any suggestions?

All three machines on my LAN started giving me the "Are you trying to get to google?" page recently. The stuff about removing google entries from your hosts file doesn't pan out in my case. There are no entries like that. Here is the text from the page I an seeing.

Another thing to note is that if I access the net via a proxy server, all works just like it should so the problem is definately local.

Are you trying to get to Google?
Your computer is running software that doesn’t allow you to use Google.
You’re seeing this page because your computer is trying to send you to a website that is pretending to be Google. Over the past few weeks, you may have seen a website that looks like Google, but launches pop-up windows and does not work like Google. That page is not affiliated with Google in any way and is intended to deceive you.

Why is this happening?
Most likely a program was installed on your computer automatically and without your knowledge when you downloaded an otherwise harmless piece of software. Or you may have been tricked into clicking on a disguised download button while visiting a website.

What can I do about it?
This problem can be fixed fairly easily, but will require that you make changes in a file that is part of your computer’s operating system. You should always be cautious when making these kinds of adjustments, as they may affect the performance of your computer. If you are not comfortable doing this yourself, you may want to print out this page and show it to someone whose technical knowledge you trust.

What steps do I take?
The first step is to remove the entry for Google from your hosts file. This entry is telling your computer where to send your computer instead of to Google.

In Windows, open the Notepad program. You can do this by going to the Start menu in the lower left of your screen, selecting “Programs,” then “Accessories,” then “Notepad.”

In the Notepad menu, click on “File,” then “Open.” You will see a new window asking which file to open. You may need to change "Files of type" to "All Files" instead of "Text Documents". The actual file to open is listed below:

If your computer is running Windows XP, Window NT, or Windows 2000, the file is located in the folder found by following this path:

My Computer >Local Disk(C) >Windows >System32 >Drivers >etc >hosts

If your computer is running Windows 98, Second Edition or Windows ME, the file is located in the folder found by following this path:

My Computer >Local Disk(C) >Windows >hosts

Once you have opened this file, remove entirely any line of text that contains “google.com”, “www.google.com” or other Google domains (such as “google.co.uk”). To remove the text, highlight it by dragging your pointer across the line while holding down the mouse button. Once the text is highlighted, hit the Backspace or Delete button, then save the file by going to the File menu and clicking “Save.” You can now exit Notepad.

What else can I do?
You might want to try software that attempts to detect and uninstall programs like this one. While we do not have a relationship with anyone who offers this software and we cannot endorse a particular product, the most popular programs for doing this seem to be Spybot Search and Destroy and LavaSoft's AdAware. The particular program affecting your computer is relatively new, so these products might not be able to detect and repair this type of problem yet.

The next step is to learn more. You can visit http://www.doxdesk.com/parasite/ to review information about a number of known self-installing software programs. Several articles on the web may be helpful, such as

· http://www.theage.com.au/articles/2003/04/14/1050172507212.html
· http://news.com.com/2100-1023-877568.html
· http://news.com.com/2100-1023-257592.html

Investigate individual programs using search engines. Try keywords such as "spyware," "scumware," and "adware."
Once you’re informed, take action. Help your family and friends avoid these annoying programs. If you can find the site that installed this software on your computer, let them know how you feel about it. You might also want to track down companies that benefit from having your web visits redirected, and share your feelings with them.

Finally, it's quick and easy to file a complaint with the Federal Trade Commission (FTC). This U.S. government agency handles complaints about deceptive or unfair business practices. To file a complaint, visit: http://www.ftc.gov/ and click on "File a Complaint Online", or call 1-877-FTC-HELP. Or write to:

Federal Trade Commission
CRC-240
Washington, D.C. 20580

If your complaint is against a company in another country, you can file it at http://www.econsumer.gov/.

Thanks Blairjac. It's good to finally see the page that people are seeing. It's strange you HOSTS file seems clean but you are having the problem. Are you getting to the real Google home page (is the scumware info page just being shown in error)? Are you running the Google Toolbar?

HI,
I am running the google toolbar, but uninstalling it made no difference what page came up when attempting to go to www.google.com.

I, like dee, couldn't figure outhow, if my machine was being directed to a fake site, I was seeing the page I was getting. Almost as if I was reaching google but they were serving me the "how to fix it page". The page did not look professional enough to be google.

When I pinged www.google.com the name resolved to 64.191.95.139 A reverse dns lookup yielded some add related company with a large range of ip's of which the above ip was part of.

I figured out what was going on. I did indeed have entries in my hosts file. They were on the "gateway" for my LAN and since all my clients point at my "gateway" for dns resolution, all clients were displaying the same symptoms. I cleaned up the hosts file on the gateway and all machines on my network are cured.

The big question for me now is how the heck someone or something gained the neccessary priveleges to edit my hosts file. I saved all the "bad entries" that were in my hosts file and will add them to the end of my message. The very first entry is perhaps the most interesting.

BlairJac

127.127.127.127 elite
64.191.95.139 www.google.com
64.191.95.139 google.com
64.191.95.139 www.altavista.com
64.191.95.139 altavista.com
64.191.95.139 search.yahoo.com
64.191.95.139 uk.search.yahoo.com
64.191.95.139 ca.search.yahoo.com
64.191.95.139 jp.search.yahoo.com
64.191.95.139 au.search.yahoo.com
64.191.95.139 de.search.yahoo.com
64.191.95.139 search.yahoo.co.jp
64.191.95.139 www.lycos.de
64.191.95.139 www.lycos.ca
64.191.95.139 www.lycos.jp
64.191.95.139 www.lycos.co.jp
64.191.95.139 alltheweb.com
64.191.95.139 web.ask.com
64.191.95.139 ask.com
64.191.95.139 www.ask.com
64.191.95.139 www.teoma.com
64.191.95.139 search.aol.com
64.191.95.139 www.looksmart.com
64.191.95.139 search.msn.com
64.191.95.139 ca.search.msn.com
64.191.95.139 fr.ca.search.msn.com
64.191.95.139 search.fr.msn.be
64.191.95.139 search.fr.msn.ch
64.191.95.139 search.latam.yupimsn.com
64.191.95.139 search.msn.at
64.191.95.139 search.msn.be
64.191.95.139 search.msn.ch
64.191.95.139 search.msn.co.in
64.191.95.139 search.msn.co.jp
64.191.95.139 search.msn.co.kr
64.191.95.139 search.msn.com.br
64.191.95.139 search.msn.com.hk
64.191.95.139 search.msn.com.my
64.191.95.139 search.msn.com.sg
64.191.95.139 search.msn.com.tw
64.191.95.139 search.msn.co.za
64.191.95.139 search.msn.de
64.191.95.139 search.msn.dk
64.191.95.139 search.msn.es
64.191.95.139 search.msn.fi
64.191.95.139 search.msn.fr
64.191.95.139 search.msn.it
64.191.95.139 search.msn.nl
64.191.95.139 search.msn.no
64.191.95.139 search.msn.se
64.191.95.139 search.ninemsn.com.au
64.191.95.139 search.t1msn.com.mx
64.191.95.139 search.xtramsn.co.nz
64.191.95.139 search.yupimsn.com
64.191.95.139 uk.search.msn.com
64.191.95.139 search.lycos.com
64.191.95.139 www.lycos.com
64.191.95.139 www.google.ca
64.191.95.139 google.ca
64.191.95.139 www.google.uk
64.191.95.139 www.google.co.uk
64.191.95.139 www.google.com.au
64.191.95.139 www.google.co.jp
64.191.95.139 www.google.jp
64.191.95.139 www.google.at
64.191.95.139 www.google.be
64.191.95.139 www.google.ch
64.191.95.139 www.google.de
64.191.95.139 www.google.dk
64.191.95.139 www.google.fi
64.191.95.139 www.google.fr
64.191.95.139 www.google.com.gr
64.191.95.139 www.google.com.hk
64.191.95.139 www.google.ie
64.191.95.139 www.google.co.il
64.191.95.139 www.google.it
64.191.95.139 www.google.co.kr
64.191.95.139 www.google.com.mx
64.191.95.139 www.google.nl
64.191.95.139 www.google.co.nz
64.191.95.139 www.google.pl
64.191.95.139 www.google.pt
64.191.95.139 www.google.com.ru
64.191.95.139 www.google.com.sg
64.191.95.139 www.google.co.th
64.191.95.139 www.google.com.tr
64.191.95.139 www.google.com.tw
64.191.95.139 google.at
64.191.95.139 google.be
64.191.95.139 google.de
64.191.95.139 google.dk
64.191.95.139 google.fi
64.191.95.139 google.fr
64.191.95.139 google.com.hk
64.191.95.139 google.ie
64.191.95.139 google.co.il
64.191.95.139 google.it
64.191.95.139 google.co.kr
64.191.95.139 google.com.mx
64.191.95.139 google.nl
64.191.95.139 google.co.nz
64.191.95.139 google.pl
64.191.95.139 google.com.ru
64.191.95.139 google.com.sg
64.191.95.139 www.hotbot.com
64.191.95.139 hotbot.com

Thanks again blairjac, that is helpful information. I decide to visit http://64.191.95.139 to see what happens. It presents a very short page with the following:

Are you looking for a search engine?
If you are seeing this page, it is because you have downloaded a malicious program that is keeping you from visiting the page you intended.

Please visit the following URL for information on fixing this problem:

http://www.tweakxp.com/forum/forum_posts.asp?TID=3367

My guess is that page was shorten to the huge amount of traffic that it was getting. The link now points to a forum thread that included an explanation about how to fix the problem. The forum site, bombarded with traffic, put up a plain text page in place of the original thread, that includes instructions for modifying the hosts file. Here is a page on the forum site that explains what happened to them: http://www.tweakxp.com/readNews.aspx?id=2048.

My new theory about this is as follows. The writer of the program is essentially a "nuisance" virus writer. The kind of hacker that creates a a virus simply to highlight a hole in Microsoft software - but has no intent to delete hard drives, etc. I believe the page at the above IP address was probably placed there by the creator of the program. The intent, IMO, was to draw attention to this vulnerability in Windows operating systems - hence the upfront message about how to fix the problem rather than a fake google home page. Programs that modify the HOSTS file have been around for some time, though nothing seems to have been done to patch the problem. I belive this person decided to draw attention to the problem in a big way, writing a program that spread quickly and - instead of fooling maybe 75% of the victims be presenting a fake google - immediately educated the the victims about the vulnerability. That's just speculation, but that I what think is going on.

My network is fully firewalled and stealthed so the malicious app must have come down as or in a web page. If it was just some sort of script, then no biggie cause I'm fixed now but if it is a trojan of some sort, then I gotta wonder, where is it hiding, and is it done playing around with my system?

Glad to find your conversation. I had the same problem, but with no toolbar. (I also do not use the Google bar.) I have not been to porn sites, do use a firewall and spyware, do not click to accept anything that I don't understand... I wonder how it came in. You almost want to think it came in through Google since that is the one site that we know we all visited. What do you think of the 127.127.127.127 elite entry in the hosts file(s)?

Mark, you may have seen it in the news by now, but the "domain not found" site is a different issue. Verisign installed a new redirect -- people don't like it. In fact, they are suing Verisign. You can read more at http://news.com.com/2100-1038-5083161.html or just search in news.google.com (now that you can get back there).

Thanks for info, anonymous. Yes, I ahev since realized that the "domain not found" problem was not scumware, but rather Versign brazen attempt to steal traffic. I think they will back down from this.

My take on the "elite" entry is that it represents some sort of handle or signature of the program creator. That kind of thing is common with virii.

I had the same experience about a week ago. As a workaround I had found alternate URLs ("naked" IP numbers) for google, but kept checking back at google.com, until I eventually saw the text message describing the bug and the fix. And yep, my "hosts" file had a bunch of sites on it that I found I was no longer able to access.

Creepy.

Have since downloaded some Windows updates that purport to be security updates for IE6. Let's hope Billy-boy Gates learns to fix the security vulnerabilities in his software.

Creepy.

Hello everybody,

I have the same problem, and I have delete all the entries in my Host file, but the problem isn't solved.
Programs like Ad-aware or Spybot didn't fint anythink.

I have solved the problem when (via a french portal http://www.universurf.fr/outils/dns.php) I have make a search after the IP adress off google or altivista (wich have the same probleme) to see that the IP adress is not the same of these who are stored in the URL off the shortcut

So delete your entry in your favorites and make a new one. I think that only the URL is infected.

Bye

I need help!

All right, I got that "Are you looking for Google?" webpage about a week ago, downloaded Spybot, cleared up my hosts file and everything worked fine. I go to go to Yahoo.com yesterday but it says page not found. I go to Google.com and it says "Are you looking for Google?" I go to lycos.com and it says "Are you looking for a server?"

Well, I accidentally deleted EVERY file from that notepad thing (where it has hosts, imhosts, network, etc.) So I try Spybot and that got rid of some stuff. Thing is, I'm connected to the Internet but can't go to any webpages while using my laptop (I'm using someone else's right now). Any way on how to fix this? I thought copying the hosts, imhosts etc files from this laptop to mine might help but I'm having no luck! Spybot can't find this thing and I thought I should be able to surf the 'Net by now. What do I do?

This thing has been dubbed...The Qhosts trojan
here is a link to Symantec's Qhosts removal page
Hope it helps!

Thanks, BlairJac. But I think that is only one of the recent ones reported. Note the description:

Trojan.Qhosts is a Trojan Horse that will modify the TCP/IP settings to point to a different DNS server.

Which is different than modifying the hosts file. QHosts may answer the cases where victim foudn that they had clean HOSTS files, but still had the problem (but remember to help for a HOSTS file hiding in the winnt/help/ directory). From the varied report I have read, I think there is more than one scumware app spreading right now. At least Symantec finally nailed down one of them.

Hi Mark,
there may well be more than one "thing" going around, however the link I posted does refer to the "hosts" file (in addition to the registery) although the list of domains added does not include all of the domains I found added to my hosts file. I am currently running on an os installation other than the one I had the trojan trouble with but next time I boot into the other os, I will check to see if the registry mods mentioned in the symantec page are present.

Nice chating with you,
BlairJac

Thanks fort he clarification, BlairJac. When I first scanned the page I missed the following line:

Modifies the Hosts file to point many different URLs to the IP, which the Trojan's creator specifies

i found that if you go into local settings of everyone (in xp) and remove all in content.ie5 folder except for config file and index it disappeared. i then to make sure downloaded tool for qhost to check it and it found nothing. the internet was much faster after that.

Thanx alot ;) u guys for helping me to be free from hijackers its all in the INFECTED HOSTS file ~_~

I have a similar problem but it is not the hosts file or Qhosts virus, when I go to "www.gogle.com.au" I get a single "o" top left hand corner of the page and if I go to "www.google.com" I get "gle>" again top left hand corner of the page. The *.Gif files that provide these images (ie the "o" and the "gle>") look to be from the google page (you know down the bottom after you do a search eg "Gooooooogle>").

I have scanned my computer for virus infection ADware, Spyware, scumware, checked registry entries related to the removal of Qhosts and other simlar virus/scumware but to no avial.

Can someone please help me this is driving me nuts!!!!!!!!!

If you can't help me remove this please let me know who created this problem so I can find them and remove there head from there body!!!

just a quickie to say the hosts fixed seems to have worked for me...Spybot and Adaware didn't seem to find anything pertaining to this (but I did get rid of a load of other crap).

Damn those odious little ba..bast...blighters!

any idea as to why google toolbar needs to be checked everytime IE6 window opens ? Locking toolbars doesn't help. It works fine in on XP user settings but not the other one on my machine.

I think the reason you get the "Are you looking for a search engine?" page is because someone found this hijacker and turned in there ip address to there isp and there isp is now displaying the removeal instructions instead of pointing you to the fake google :) I hope justice was well served.

I've ads infecting Money 2003 (and maybe a reporting program since closing is now a lot slower.0 Ad-aware and spybot find nothing. Any suggestions?

i want to load google as a home page. thanks

i want to load google as a home page. thanks

OK, I am a bit slow on most of the computer related things, but I have had a problem with google since August. My toolbar/search bar from google is kaput. I even tried typing in www.google.com and I get sent to a page telling me that there is no listing for that web page. If anyone has ANY sugestions, please e-mail me...I am pretty desperate.
ps-make sure to tell me how to fix it in simple words. :)
Thanks.

Found a discussion of this problem over at:

http://www.computercops.biz/postt9576.html

The problem seems to be fixed by running CWshredder (which inexplicably finds nothing... though the problem does indeed go away, as I can also attest to.)

http://www.merijn.org/files/cwshredder.zip

-Bill

when i type in www.google.com, all i get is the 'o' and when i type in www.google.com.au, a gif image of a polish flag appears. i find this very odd , is it a trojan , why and how is this happening and does anyone know how to fix it ? :-( i'm going nuts lol

Hey I have the problem. Initially, I suspected a virus named Qhost, but it was not. Then I checked my host file. Nothing looks perfect. I think it is a new kind of virus or spyware which we have yet to know

I've got this same problem. I have three adware/spyware detectors -- Spyhunter, Spybot, and Spysweeper --, and none get rid of it. Of course, NAV doesn't either. I'm giong to try some of the methods listed here.

Okay, it appears hijack this and cwshredder did the best job. Nothing in my hosts made a difference (although there were a couple suspicious entries). I'll probably send that guy some money. Annoying that none of the adware/spyware software I own made a bit of difference.

btw, according to merijn, the problem comes from a MS vulnerability.

Today, My page was hijacked. I ran spyware addware did nothing for my google fake page problem. For a second I though Google started running sponsered links. If I click the second page Google seems to run fine, but slow.

just found this conversation. I had the same issue where no entries in the host file, but the first page on google was a fake. Also noticed pop-ups more frequently.
CWS.Searchx was removed by CWshredder.

All is back to normal now. Apparently it is possibly a vulnerability in MS Java virtual machine.

when i go to google, I thought i was going to the right google homepage, but when I do a search the computer hangs for a bit and then I get a popup with my search phrase in several advertisements. Additionnally the results page just shows the same thing, and then I click next to get to page 2, and it brings me REAL RESULTS to my search and it says its on page 1. What type of hack is this and how to I get rid of it. Its like a fake search engine intergrated with the real one.

Hey dan, I had the *exact* same problem today. Download the CWShredder program listed above and it'll fix it right up.

I found myself experiencing the same difficulties
and yes, it was determined to be caused by CoolWebSearch and CWS affiliates when visiting Google. It looks
just like a Google first page but is all ads, accompanied by a pop up. If you are interested in learning more
about CoolWebSearch, you can read more at
http://www.spywareinfo.com/~merijn/cwschronicles.html

If you are experiencing problems generated by CoolWebSearch or its
affiliates, you will most likely want to remove it from your computer. If
Ad-aware and SpyBot did not successfully remove the program, I suggest
that you download the 'CWShredder' program to stop the redirects to
CoolWebSearch from happening in the future. It can be downloaded at
http://www.spywareinfo.com/~merijn/files/cwshredder.zip ('CWShredder')This fixed it for me, and I didn't have to root around in the Registry or host file or anything. Good luck!

This is regarding scumware called "Coolwwsearch" which installed itself on my system and which screwed up my computer as follows: google homepage (odd behaviour; loss of "o"s at the bottom of the page); sluggish running of computer and IE; extremely long time to boot up; frequent crashes; notifications of hardware problems; loss of 256 MB RAM!!!, which was not anymore recognized in my system. Finally managed to get rid of the scumware by following these procedures: 1. clean system with 'Window Washer'; 2. clean hidden index.dat file with 'Complete Internet Cleanup'(Note: the hidden index.dat file is nowhere accessible otherwise; another gift of scumware master Bill Gates); 3. run 'Spybot'; 4. reboot; 5. run 'CWShredder'. The last program is the most important one, as it gets rid of 'Coolwwsearch' completely. While the last mentioned 2 programs are free, the first 2 offer a trial period. After the exercise my computer is now 'as new'; i.e. runs like a turbo jet and even my 256 MB Ram is back!! And I had already arranged for repairs by my dealer. Lightning on all scumware!

Whoo Hoo! Had the same problem. Install and run CWshredder.

Both sypware and Adaware work best when together in my opinion. They both find different things. I found this really cool program called Ccleaner. If does a little of the same as both previously mentioned programs as well as a whole lot more (even cleans applications of logs and such). It is freeware and I would argue that it is one of my favorite programs. It cleans so many things that it would take a web page to explain as well as fixed missing/corrupt file issues. I found it so good that I had sent it to techtv with the hopes that many others could join the rank of privacy that I enjoy. I hope that this can help someone!

I would like to send you some links to publications about my
criminal case.
Would you like to review materials and give your opinion what possible
to do now. I have consequences hard to live now.
My case are getting public attention now as an example of miscarriage
of justice. I could not defend myself, because I did not have enough
money for computer expert.
Now I have computer expert compant willing to work on Pro bono basis.
They are defeating 75% cases. This case may become high profile case

I was forced to confess for possession of child porn. I got browser
hijackers while browsing the web. I was redirected to illigal sites
against my will. Some illigal pictures were found on my hard drive only after
recovering in unallocated clusters, without dates of files
creation/download.
I do not know how can courts press widely on people to convict them,
while whole Internet is a mess.
This is publication in Wired news

http://www.wired.com/news/infostructure/0,1377,63391,00.html

This is publication in Theregester

http://www.theregister.co.uk/2004/05/13/browser_hijacking_risks/

This is article in Washington Times, May 22, 2004
There is information about my case.

http://www.washtimes.com/commentary/20040521-084242-5633r.htm

This is publication in Globe and Mail

http://www.globeandmail.com/servlet/story/RTGAM.20040617.gttwhijac17/BNStory/Technology/

This is my story in www.inquisition21.com

http://www.inquisition21.com/article~view~7~page_num~3.html

Article in Crime research center:

http://www.crime-research.org/news/07.22.2004/506/

The same case overturned:

http://www.mnsun.com/story.asp?city=apple_valley&story=139174

I would like to send you some links to publications about my
criminal case.
Would you like to review materials and give your opinion what possible
to do now. I have consequences hard to live now.
My case are getting public attention now as an example of miscarriage
of justice. I could not defend myself, because I did not have enough
money for computer expert.
Now I have computer expert compant willing to work on Pro bono basis.
They are defeating 75% cases. This case may become high profile case

I was forced to confess for possession of child porn. I got browser
hijackers while browsing the web. I was redirected to illigal sites
against my will. Some illigal pictures were found on my hard drive only after
recovering in unallocated clusters, without dates of files
creation/download.
I do not know how can courts press widely on people to convict them,
while whole Internet is a mess.
This is publication in Wired news

http://www.wired.com/news/infostructure/0,1377,63391,00.html

This is publication in Theregester

http://www.theregister.co.uk/2004/05/13/browser_hijacking_risks/

This is article in Washington Times, May 22, 2004
There is information about my case.

http://www.washtimes.com/commentary/20040521-084242-5633r.htm

This is publication in Globe and Mail

http://www.globeandmail.com/servlet/story/RTGAM.20040617.gttwhijac17/BNStory/Technology/

This is my story in www.inquisition21.com

http://www.inquisition21.com/article~view~7~page_num~3.html

Article in Crime research center:

http://www.crime-research.org/news/07.22.2004/506/

The same case overturned:

http://www.mnsun.com/story.asp?city=apple_valley&story=139174

Well i have this file which is called shredder or something like that. it gets rid of some shit off ur computer which alot of ad aware programs cant find

Ok can anyone help me? When i go to open a link in google, half the time the page that's opened up is some page called buy-search. Does that mean i'm using the fake google? It's like that buy-search has taken over "domain/url not found".

The page is actually search-space dot cc (the buy-search page) and i've also noticed that 1. Google has little ads at the top of it and 2. that if I don't press the stop button immediately after a page has loaded in ie, then it will redirect itself to some other page (think it's find.org or something like that) and sometimes won't load pages at all. Am downloading spyware/adware removal programs at the moment. Will let you know if they fix it but if not, any help on these matters will be appreciated.

I am having similar problem with the goole spoof page. However, mine does not show up unless I click on a hotlink from e-mail. I can send myself an e-mail with a link back to my homepage and it does the same thing as clicking on a link from other trusted e-mail sources. I have ran xsoft spydetector and found nothing. Panda Titanium finds nothing either. Any suggestions?

Brian

This is the option: :lol: :lol: :lol:

Donwload System Hijack Scanner
this is included in bps spyware remover
http://www.bulletproofsoft.com/index.html

run the scanner

Press internet explore & netscape
Jou see a lot of *shit*
If you see HBO *delete it*
only leave the things you know its good.

It worked for me i hope for u2
My spy ip= 69.169.???.??? i could not remember

The remove option :lol: :lol: :lol: :lol: :lol:

Download System Hijack Scanner
this is included in bps spyware remover
http://www.bulletproofsoft.com/support.html

run The Hijack scanner
:twisted:

clik "internet explore & netscape

Delete the HBO keys
Delete al the thing you dont trust :D

The hack is over :D:D

i had the 69.196.??.? could not remember
but the hosts file thing didn't work for me
trust me do my thing its al over :twisted:

dan

when i go to google, I thought i was going to the right google homepage, but when I do a search the computer hangs for a bit and then I get a popup with my search phrase in several advertisements. Additionnally the results page just shows the same thing, and then I click next to get to page 2, and it brings me REAL RESULTS to my search and it says its on page 1. What type of hack is this and how to I get rid of it. Its like a fake search engine intergrated with the real one.

i have exactly the same problem and i've tried everthing the bulletproof thing the host, ad aware ,spybot and even CWshredder. butt the problems is still there...

Sander try BHODemon.

BHODemon did the trick for me!

It recognized it and it was some kind of BHO hack :evil:
Txs Nomad you probably helped a lot of people...and me :D :D

When I use google toolbar to do a search I get an HTTP 404 Page cannot be found message. If I go to the google homepage it doesn't have i'm feeling lucky button. Anyone know why?

it aint even on their

This is NOT from Google...Google is just one of the many guises this trojan takes. I have not yet found a way of removing it permanently other that to reload completely.

BEAWRE This torjan acts as a gateway to far more destructive softeware..I know..Ive had it on ethree computers in two days.

I got this trojan by clicking what I thought to be a Microsoft message bubble in the lower right hand side of a cleanly reloaded machine.

One more point...there is no google reference in my hosts file...this thing comes from lots of places no doubt.

Got the fake google redirect 404 error. Opened windows\drivers\hosts with notepad and deleted everything. After that internet explorer search and google search worked properly.

Thanks Heaps Blair, youre a legend dude!
Helped me with the google.com host problem, went to the host file and deleted all the entries and my browser ran sweet!
Thanks Again, YOURE A LEGEND!

I cam to put all of you out of misery. to get rid of this simple but clever ad all u have to do is delete the HOSTs file in ....system 32/drivers/ETC/hosts. This is not detected by anti-spyware and antivirus etc. I tool me about 4 hrs to find it thanks to my friend and computer genious ISLAM
FINALLY!!

I cam to put all of you out of misery. to get rid of this simple but clever ad all u have to do is delete the HOSTs file in ....system 32/drivers/ETC/hosts. This is not detected by anti-spyware and antivirus etc. It took me about 4 hrs to find it thanks to my friend and computer genious ISLAM
FINALLY!!

all u guys have to do is delete the "HOSTS" in ....system 32/drivers/ETC to fet rid of the clever but simple spyware kinda thing thanks to my Freind and computer genious ISLAM !!!
FINALLY got rid of it YES!!

open the c:\windows\system32\drivers\etc hosts file in wordpad and then delete all the stuff you find there, save it and close. simple as that !

Has any of you experienced the following:

In 'History', a list of Google searches lists often used terms as well as never used terms, the pages are obviously visited (even twelf on one term) and on some 'never visited pages' one can even see how far has been clicked on options.

It is hard for me to believe that such intelligent spyware exists.

So: it is NOT about a fake Google page, and it is not a returning problem neither.

ASAP

Tried that fix and iot worked but now the toolbar has come back :cry:

I got this thing that is messing up google it also may be attacking my Norton 2006 SW.. my Windoctor will not launch.. online I can scan with the CD. GRRRRR

Hello all! Very nice site and very informativity!

Very good design,i really like this site!

Hello all! Very nice site and very informativity!

Excellent site. It was pleasant to me.

I have just found your website great

Hey there guys! I am surfing through different guestbooks and my job is to find the Top 100 websites on the net, to addition I have to make a report on the average sites too. So, here I am leaving this messege. If you see this, then your site has been automatically entered in the competition. Good Luck!!!

Very good site, congratulations!

Very interesting site ! Good work ! Ñongratulations :)

I love this site so so so much :) Cool site!!

I love you so much! Great place to visit!

À good site, good short contents of the good work. I have loved your site :D

Very interesting site, beautiful design, thank.

Yo have nice site, admin! keep up good work man!

Yo have nice site, admin! keep up good work man!

It is healthy, I shall come on your site more often, thank.

I love you so much! Great place to visit!

I think your site is very good and complete, but the information you have here

Hello all! Very nice site and very informativity!

It is healthy, I shall come on your site more often, thank.

Keep a good work man!

A fantastic site, and brilliant effort. A great piece of work.

Yo have nice site, admin! keep up good work man!

Very nice design ;) Good work,webmaster!

It is healthy, I shall come on your site more often, thank.

I love this site so so so much :) Cool site!!

À good site, good short contents of the good work. I have loved your site :D

It is healthy, I shall come on your site more often, thank.

À good site, good short contents of the good work. I have loved your site :D

Hello all! Very nice site and very informativity!

I think your site is very good and complete, but the information you have here

Very good site, greate content !!

Hello admin, nice site you have!

Yo have nice site, admin! keep up good work man!

I love you so much! Great place to visit!

Your site is very very cool !! I love it :) Respect !

It\'s a very good site !! Very nice work, admin :) Good luck !

I have loved your site for its useful and funny content and simple design.

At you the excellent site, a lot of useful info and good design, thank.

practitioners

Hello admin, nice site ! Good content, eautiful design, thank !

Great work,webmaster! Cool site!

Nice site and design! Very informativity site! Thanks.

35mm slr camera

bunk beds

Your site is very very cool !! I love it :) Respect !

Cool site! Thank you for great work!

Hello! I like this site,thanks!

Your site is very nice :) Respect to admin !

Your site is very nice :) Respect to admin !

2007 toyota camry

free nokia ringtones

Very nice design ;) Good work,webmaster!

free polyphonic ringtones

Very good site, greate content !!

Very interesting site and beautiful design !! Thank.

Very interesting site and beautiful design !! Thank.

Your site is very nice :) Respect to admin !

Yo have nice site, admin! keep up good work man!

I think your site is very good and complete, but the information you have here

Cool site with nice design! Thx!

Hello admin, nice site ! Good content, eautiful design, thank !

I think your site is very good and complete, but the information you have here

A fantastic site, and brilliant effort. A great piece of work.

I think your site is very good and complete, but the information you have here

It\'s a very good site !! Very nice work, admin :) Good luck !

A fantastic site, and brilliant effort. A great piece of work.

betting gambling

I think your site is very good and complete, but the information you have here

Great work,very informatitvity! Fantastish site!

ericsson ringtones

motorola ringtones

keypress ringtones

Free downloadable ringtones

Computer desks

A fantastic site, and brilliant effort. A great piece of work.

Very good site, greate content!! 120e motorola ringtones

Keep a good work man!

Very interesting site and beautiful design !! Thank.

Yo have nice site!keep up good work man! Free ringtones for samsung

Very good site, greate content !!

Hello admin, nice site ! Good content, eautiful design, thank !

Very interesting site, beautiful design, thank.

Hi,great site!keep up good work man! free motorola ringtones

At you the excellent site, a lot of useful info and good design, thank.

Very interesting site,good content! cellular ringtones

Hello admin, nice site you have!

Hello! Good site - very informativity. bluetooth wireless headphones

It is healthy, I shall come on your site more often, thank.

À good site, good short contents of the good work. Ñongratulations !

It's a very good site !!Very nice work! air conditioner

You have many friends that post in your guestbook! animal post card

It's a very good site !! nice site and very informativity! free samsung ringtones

I love this site so so so much :) Cool site!!

Hello admin, nice site ! Good content, eautiful design, thank !

It\'s a very good site !! Very nice work, admin :) Good luck !

Very nice design and colors,webmaster! nextel i730 ringtones

Hi!Very nice site and very informativity! verizon vx3200 ringtones

It's a very good site!Very nice work! nextel ringtones

Keep a good work man!

Hello admin, nice site ! Good content, eautiful design, thank !

Hello admin, nice site you have!

Hello ! This is very [url=http://www.google.com/bb497]good[/url] site !!

It\'s a very good site !! Very nice work, admin :) Good luck !

Hi ! Your site is very interesting. Thank you.

I have loved your site for its useful and funny content and simple design.

At you the excellent site, a lot of useful info and good design, thank.

Very interesting site and beautiful design !! Thank.

Yo have nice site, admin! keep up good work man!

Very interesting site, beautiful design, thank.

Very nice design ;) Good work,webmaster!

Keep a good work man!

Cool web-page! Keep up this work! infrared wireless headphones

I love you so much! Great place to visit!

Very interesting and professional site! Good luck!

Hello! Very interesting and professional site.

preved

All of the above are scammers; linking to their PAY TO REMOVE websites.

Fucking gaynal bastards.

BHODemon does absolutely NOTHING, wtf does it actually do apart from displaying a empty list? There's no scan for virus option on there... You open it and have the thing just stare at you like a gormless twat!

Crap.

All theses links you are all offering arn't free scan and remove programs.

You're all linking to MORE adware that scams you into buying a product you don't even need in the first fucking place.

Link us to free legit sites, not your own bullshit which you probably work for in the first place. Scams.

Magic purse WebMoney! Doubles everything, that on it send!

Money it is possible to send NO MORE than TWO times.

So, you send the sum from 1,99 $ up to 19,5 $ on a Z-purse, or from

1,36 up to 18,42 euros on a Е-purse and within day receive the sum, of

2 times it is more than that, that you have sent!

Here numbers of these Magic purses:
Z159545772737
E243054212044

it is possible.