BleepingComputer.com: Fake Google Search

Okay I posted in the malware forum before this and according to my helper it's not malware. During the malware hunt I ran Malwarebytes, SuperAntiSpyware, Combofix, ESET scanner, and possibly a few other programs. I am currently running Windows 7 and Google Chrome.



Uploaded with ImageShack.us

This is what pops up when I try to search from the bar at the top of Google Chrome. (I think it's called the address bar) However, if I go directly from Google and search it looks like this.



Uploaded with ImageShack.us

Please notice how in the first picture there is no URL at the top and it says "Google Search" in the tab while there is a URL in the second picture and the name of the keyword I typed in is listed in the tab. There is something preventing me from using the actual Google when I search from the address bar and it is frustrating because it is very convenient to search directly from the address bar. Thank you in advance for the help.

Can you link to your malware removal topic where he had you run the scans?

not doubting he told you that, he just seems like malware would be the main cause of something like this.

http://www.bleepingcomputer.com/forums/topic401793.html/page__p__2277736#entry2277736

There you go. I thought so too when I first discovered this problem.

Lets try a few basic things.

Open up command prompt (start -> run (or search in Vista/7) -> type "cmd" (without quotes) and press enter.

In the black box that appears please type the following commands:

ipconfig /flushdns
ipconfig /release

Leave the command prompt open for now.

2. Now remove any proxy servers listed inside chrome. To do that, do the following: Open Chrome, click the "wrench" (right side), select "Options", "Under the Hood", and then "Change proxy settings". Click the "LAN Settings" box, and delete any address in either "address" box. Uncheck "Use a proxy server for your LAN" if it is checked. (If the settings are already like this, skip this step)

In command prompt, type the following and press enter:

ipconfig /renew

3. Download and run this file.

If that doesn't fix the problem please post back the following:

In command prompt, type the following

tracert www.google.com

Right click in command prompt and select "mark". Highlight everything in the window and press "enter". Come back here and paste it in your next reply.


----
EDIT: Guess I should've stated that it isn't malware, as people below pointed out.

This post has been edited by NpaMA: 18 June 2011 - 07:00 AM

The results are identical. One is a search 'powered by google' through your ISP. The other is a search from the google website. Two ways to get the same results but look slightly different. No malware involved.

My ISP does the same thing if I bypass the google home page and search from the address bar.

I only use Chrome so I wouldn't know, and would prefer to keep using Chrome Sorry I am not experienced with computers...what do you mean by add-ons? This problem does not occur on my other computer so I have been frustrated. The search results do differ occasionally actually. It is a relief to know it isn't malware though.

I couldn't figure out how to have all the commands run at once..I apologize if this complicates things but here is what I got. Thank you for your help!



Microsoft Windows [Version 6.1.7600]
Copyright © 2009 Microsoft Corporation. All rights reserved.

C:\Users\Joanna Huang>ipconfig /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\Joanna Huang>ipconfig /release

Windows IP Configuration

No operation can be performed on Wireless Network Connection 2 while it has its
media disconnected.
No operation can be performed on Local Area Connection while it has its media di
sconnected.

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::9d80:176f:224a:c58b%13
Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter Local Area Connection* 9:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{8E66EF04-76BE-4AFD-9BAF-732841367BC6}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter Local Area Connection* 13:

Connection-specific DNS Suffix . :
IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:288e:693:b8a3:3c1c
Link-local IPv6 Address . . . . . : fe80::288e:693:b8a3:3c1c%20
Default Gateway . . . . . . . . . : ::

Tunnel adapter isatap.{82A4052B-360A-46F9-B23D-44F7C5D5869B}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{0971C9A0-5EF9-4006-B583-0534F8AF2AF6}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

C:\Users\Joanna Huang>ipconfig /renew

Windows IP Configuration

No operation can be performed on Wireless Network Connection 2 while it has its
media disconnected.
No operation can be performed on Local Area Connection while it has its media di
sconnected.

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::9d80:176f:224a:c58b%13
IPv4 Address. . . . . . . . . . . : 192.168.1.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter Local Area Connection* 9:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{8E66EF04-76BE-4AFD-9BAF-732841367BC6}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter Local Area Connection* 13:

Connection-specific DNS Suffix . :
IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:288e:693:b8a3:3c1c
Link-local IPv6 Address . . . . . : fe80::288e:693:b8a3:3c1c%20
Default Gateway . . . . . . . . . : ::

Tunnel adapter isatap.{82A4052B-360A-46F9-B23D-44F7C5D5869B}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{0971C9A0-5EF9-4006-B583-0534F8AF2AF6}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

C:\Users\Joanna Huang>tracert www.google.com

Tracing route to www.l.google.com [74.125.224.113]
over a maximum of 30 hops:

1 <1 ms 1 ms <1 ms 192.168.1.1
2 9 ms 16 ms 8 ms 10.92.192.1
3 8 ms 8 ms 9 ms acr01mtpkca-gbe-1-23.mtpk.ca.charter.com [96.34.
96.168]
4 9 ms 15 ms 8 ms 96-34-96-89.static.unas.ca.charter.com [96.34.96
.89]
5 15 ms 10 ms 15 ms crr02mtpkca-tge-0-3-0-6.mtpk.ca.charter.com [96.
34.98.66]
6 13 ms 11 ms 14 ms bbr01mtpkca-tge-0-1-0-1.mtpk.ca.charter.com [96.
34.2.64]
7 * 17 ms 11 ms 96.34.3.93
8 17 ms 14 ms 16 ms 74.125.51.245
9 78 ms 11 ms 10 ms 209.85.248.185
10 25 ms 13 ms 16 ms 64.233.174.192
11 20 ms 26 ms 26 ms 64.233.174.205
12 22 ms 20 ms 27 ms 209.85.250.61
13 23 ms 19 ms 19 ms 64.233.174.109
14 24 ms 31 ms 24 ms 74.125.224.113

Trace complete.

C:\Users\Joanna Huang>

This post has been edited by Naichi: 17 June 2011 - 03:37 PM

There is no need to run all those as its not a redirect, it is what Animal explained.

I was not having him run those because of malware, it was to reset any IP's his ISP's software may have added to the hosts file (happens alot when people run the "setup" CDs from ISPs) and to clear his DNS cache to see if its making it to Google's Servers or if it's being stopped inside of his ISP's network.

Same with proxy server.


---
On topic.

You are making it to a google server. As they stated it is most likely caused by your ISP. Look around on their user portal for a "opt out" link or something similar. Or you could try different DNS servers which may or may not work. It's not malware, which I guess I should've stated in my other post.

This post has been edited by NpaMA: 18 June 2011 - 06:59 AM

Thank you!

Okay thanks! I have no idea what an ISP is so I guess I'll just deal with this BTW, I'm a girl Thank you again for your help!

ISP = Short for Internet Service Provider, it refers to a company that provides Internet services, including personal and business access to the Internet.
The company you pay to get your Internet.

Ladies get

Oh okay...sorry for preventing this topic from closing but it works fine on my other computer. I am pretty sure I have the same ISP for both. Is there any other fix or is that it? I could use my other computer but...laptops are more convenient.

Haha thank you but I'm a dumb one