Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google search url highly suspicious


  • Please log in to reply
4 replies to this topic

#1 ms.s.

ms.s.

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:27 AM

Posted 23 November 2011 - 11:08 AM

Hi all, the other night I started noticing my google search results had extra information attached to it. This morning, using a work computer I tried to same results and the url was fine so I know this is an issue just with my personal computer. Instead of typing all the weird stuff I get here I've just attached a screenshot.

All my antivirus and antispyware (malwarebytes, AVG, spywareblaster) is coming back clean, but something is definitely wrong.

Is this a search results hijacking or did I just press the wrong setting somewhere...?

Attached Files



BC AdBot (Login to Remove)

 


#2 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 34,764 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:01:27 AM

Posted 23 November 2011 - 03:48 PM

In layman's terms it's the code for how the Chrome browser renders the page. Did you use a Chrome browser at work or different browser? I'm not sure if there is a setting to 'hide' that code. I see the see the same code using Chrome doing the same search. I see a different and longer code in Opera which is my default browser doing the same search.

https://www.google.com/#hl=en&cp=6&gs_id=q&xhr=t&q=search&tok=Gac98oSTnbbmML6jvYRKlQ&pf=p&sclient=psy-ab&site=&source=hp&pbx=1&oq=search&aq=0&aqi=g4&aql=&gs_sm=&gs_upl=&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=d238e37135e52e60&biw=1242&bih=854

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+

#3 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,854 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:27 AM

Posted 23 November 2011 - 04:06 PM

and this is what I get using my Firefox browser for that same search:

http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=search&btnG=Search&gbv=1&ei=jl_NTouSFaOo2wXH3MiRDw

Note that I have Javascripts, cookies, referral codes etc. disabled by default in my browser. If I didn't, the link could very well look different.
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#4 ms.s.

ms.s.
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:27 AM

Posted 23 November 2011 - 05:48 PM

Cool, I feel much better. What was confusing is that the same search at work (see attached) gives a different url (but the same results).

So does that mean on my personal comp I just have some settings off?

I'm only being extra cautious because a while before I noticed the url change, chrome blocked a website that , later on, loaded just fine. So when I saw all the extra parameters in the url I immediately started checking for spyware.

Attached Files



#5 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,854 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:27 AM

Posted 24 November 2011 - 08:54 PM

A number of things can affect what the URL looks like.

http://www.google.com/#sclient=psy-ab&hl=en&biw=1366&bih=561&source=hp&q=search&pbx=1&oq=search&aq=f&aqi=g4&aql=&gs_sm=e&gs_upl=1259l2002l0l3189l6l4l0l0l0l1l1041l3682l6-2.2l4l0&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=337d5922ed4f0202

This is what the URL looks like for me with that search this evening with Javascripts for Google enabled.

Now, I disable the javascripts and I get this:

http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=search&btnG=Search&gbv=1&ei=bfPOTrHuPIbg2QW0wZXIDw

Same browser, same computer, same search. Only difference is that one has Javascripts enabled for Google and the other does not.

Now, given that one search you made was at work, and one at home, there will be differences in the URL based on your location. I suspect that there are also some additional restrictions on your computer at work. This too will affect what the URL looks like. That does not mean that one is compromised and the other not. It's simply different.

Edited by Orange Blossom, 24 November 2011 - 08:56 PM.

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users