Non-Pool: Help! Google search hijacked??

[CUTiger78]

Just noticed this while searching for "Florida +pool service" (without the italics) - Google only returned about 1,000 results. That didn't seem right. So I searched same w/ Bing - 73,000,000 results. Now that seems right.

Any ideas? Running an anti-spyware app now, but it ran this morning on it's automatic setting. BTW, I'm running IE 8 on Vista.

I love my Google, but if it's been hijacked, I'll have to switch to Bing.

Thanks!

 

[Bama Rambler]

Did the results make sense?
Let the antivirus run and see what it finds.

 

[Buford]

try putting a pace between the + and pool, it should bring your google results up to 48million; for some reason Bing doesn't recognize the +

 

[CUTiger78]

Thanks, guys. I think the trouble was what both of you suggested.

Dave - No, the results didn't make sense. They were some really strange web sites. MS Security Essentials found a Java-based trojan and fixed it. Ran the search again and came up with the same number of results, but they were all normal looking.

Buford was apparently right about the syntax. A space after the + yielded ~47M results.

Breathing a sigh of relief. Tracking down and fixing malware can be a time-consuming PITA!

Cheers!

 

[Ohm_Boy]

Search engine poisoning like that is likely a sign of a rootkit infection - your antivirus won't fix it. I recommend that you download TDSSKiller from Kaspersky.com and run it. Here is a direct link to the .zip file on Kaspersky's website. http://support.kaspersky.com/downloads/ ... killer.zip Download the zip file, and run the tdsskiller.exe in the archive.

 

[CUTiger78]

I recommend that you download TDSSKiller from Kaspersky.com and run it.

Ran it. No threats found, so I hope I'm in the clear.

 

[Ohm_Boy]

Awesome. Between that and MSSE, you should be good. Also, MalwareBytes AntiMalware is a good tool to run every now and then too. malwarebytes.org

 

[Lershac]

Ohm boy is right on the money. I see that Crud every day. Safe mode, tdsskiller, MBAM, and a cool how-to website... www.bleepingcomputer.com (go to the spyware removal tab).

The other cause is sometimes spyware edits your hosts file in C:\windows\system32\drivers\etc\hosts and inserts manual entries for google (and bing, and yahoo, and alot of other search engines) and redirects you to look-alikes that fool ya.

Glad it turned out to be a search syntax issue tho.