Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google redirect solved


  • Please log in to reply
3 replies to this topic

#1 copotay

copotay

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:03:20 PM

Posted 28 February 2010 - 12:32 PM

I am posting this for everyone's knowledge, hopefully in the right place, about these long URL's that are showing up from the main Google page that appear to be malicous browser redirects. This does not occur on everyones computer. This should not be confused to mean that you are not infected I am just providing information on my experience thinking that I was infected when I was not.

Situation: Firefox and IE8: When I would search off of the main google page for instance "test", I get the results, and upon clicking a link in my browser for "http://www.test.com/" it redirects to this shown below for a split second but then goes to the correct page:

/url?sa=t&source=web&ct=res&cd=1&ved=0CAsQFjAA&url=http%3A%2F%2Fwww.test.com%2F&rct=j&q=test&ei=W1iBS_zZKqH2Mrax0IsK&usg=AFQjCNH21KLjC0CBkjon2DwD_CZ0HApLMw

This occurs from the main google page and when clicking a link in the results it gives a double mouse click sound, (a redirect), before going to the chosen page showing the correct url. If you hover over the link it will not show this redirect link in the status bar, it only appears in the status bar when you right click, left click and hold, or if you look at the properties of the link it will be displayed in the properties window. It appears to be something related to a mousedown event. I had deleted all cookies and temp files and it would still do this.

With the help of the experts here we ran through a weeks worth of tests using all of the search and repair tools finding nothing. I had a clean computer, so why was this happening.

Through my travels I found several links regarding google using Ajax software to track searches and even found Google employees posting in blogs telling webmasters that their logs would start showing these long URLs just like the one I have posted above. So this is what I did to fix it.

A workaround, it is definitely google using scripting. You have to stop the active scripting. Go to Internet Options/Security and press Local Intranet. Press "Sites", a window pops up then press advanced. Add www.google.com to the sites list. Now press close. Press custom level while still having Local Intranet chosen. Scroll down towards the bottom and DISABLE active scripting. That's it. Now none of googles scripting runs when you search. Goodbye long URLs and tracking information. Dont ask about Firefox, which I did not use in the first place just downloaded it to see if it would do it on Firefox which it did, because I could not find how to restrict sites in Firefox, but I had read through my travels that there is some kind of addon scripting that will disable google's scripting.

Again to reinterate, do not take for granted that this is the only thing that could be causing a redirect, you very well could have a rootkit infection and only the experts here can help you with it after viewing your logs of what they tell you do check. My redirect was not to some malicous or other search page it was to the correct page I was clicking on, it would just do a quick google redirect through a google server then to the page.

Hope this helps somebody because it drove me crazy.

BC AdBot (Login to Remove)

 


#2 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,313 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:20 AM

Posted 28 February 2010 - 12:48 PM

Thanks for sharing this.

However, I want to make one note:

This is NOT the solution for google redirects to malicious sites. For everyone who is experiencing that problem, it is still best to post a new topic to get help with that if you are unable to find a solution.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#3 ossilix

ossilix

  • Members
  • 47 posts
  • OFFLINE
  •  
  • Local time:04:20 PM

Posted 01 March 2010 - 12:36 PM

I started noticing the same thing recently, although in my browser the Google redirects do sometimes show in the status bar when you hover over a link. (I'm using Firefox 3.0.18.)

#4 copotay

copotay
  • Topic Starter

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:03:20 PM

Posted 01 March 2010 - 01:35 PM

It would do the same thing in my Firefox too, in IE8 it would only show on hover after I right clicked the link to see the properties. I know alot of posts I read about this issue was that people were complaining about right clicking a link, after a search, to copy and paste into a post and it was giving them this long url that thay had to cut down. My aggravating issue was the hesitation of the redirection while it hit googles severs first then hit the right page. A second or two I know does not seem like a lot, but I surf quick and it aggravated me not to mention it made me think I was infected. IE8 is way slower than Firefox and so you don't see the delay as bad. Again though I wanted to make sure my computer was clean and free from malicous activity as Elise says before I figured out this is what it was.

I will tell you this, I uninstalled IE8 before doing an SP3 upgrade and it reverted back to IE6, then after the install I went and installed IE8 again. I did this because according to microsoft if you upgrade to SP3 with IE8 installed, you cannot revert back to IE6 if you ever want to, so it suggests to uninstall IE8 first, then go SP3.

Anyway between installs, after the SP3 upgrade, I checked to see if IE6 was giving me the same url before going with IE8 again, it was not, worked like a charm no redirect. Then I went ahead and installed IE8, back to square one, the long urls with redirects.

Here are some links that talk about it:

http://smackdown.blogsblogsblogs.com/2009/...-tracking-urls/

Here is googles explanation to webmasters:

http://analytics.blogspot.com/2009/04/upco...com-search.html

Edited by copotay, 01 March 2010 - 01:37 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users