Fake Google

[bedbugy]

does any one know how to remove an infection that has taken hold in google searches and other searches i use firefox and find that the searches are all fake

must have got the infection when i downloaded firefox latest update

[MKAsok]

Try this. You might also want to do a full scan with whatever anti-virus you have installed.

[Supernova]

Scan your computer for viruses/malware, make sure it's clean. Then follow the instructions given below. Note: You must close Firefox before making these changes.

1. Navigate to %ProgramFiles%\Mozilla Firefox\searchplugins

2. Open the google.xml file with notepad

3. Replace the ENTIRE code with the one below and save the file (not 'save as')

<SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">
<ShortName>Google</ShortName>
<Description>Google Search</Description>
<InputEncoding>UTF-8</InputEncoding>
<Image width="16" height="16">data:image/png;base64,AAABAAEAEBAAAAEAGABoAwAAFgAAACgAAAAQAAAAIAAAAAEAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADs9Pt8xetPtu9FsfFNtu%2BTzvb2%2B%2Fne4dFJeBw0egA%2FfAJAfAA8ewBBegAAAAD%2B%2FPtft98Mp%2BwWsfAVsvEbs%2FQeqvF8xO7%2F%2F%2F63yqkxdgM7gwE%2FggM%2BfQA%2BegBDeQDe7PIbotgQufcMufEPtfIPsvAbs%2FQvq%2Bfz%2Bf%2F%2B%2B%2FZKhR05hgBBhQI8hgBAgAI9ewD0%2B%2Fg3pswAtO8Cxf4Kw%2FsJvvYAqupKsNv%2B%2Fv7%2F%2FP5VkSU0iQA7jQA9hgBDgQU%2BfQH%2F%2Ff%2FQ6fM4sM4KsN8AteMCruIqqdbZ7PH8%2Fv%2Fg6Nc%2Fhg05kAA8jAM9iQI%2BhQA%2BgQDQu6b97uv%2F%2F%2F7V8Pqw3eiWz97q8%2Ff%2F%2F%2F%2F7%2FPptpkkqjQE4kwA7kAA5iwI8iAA8hQCOSSKdXjiyflbAkG7u2s%2F%2B%2F%2F39%2F%2F7r8utrqEYtjQE8lgA7kwA7kwA9jwA9igA9hACiWSekVRyeSgiYSBHx6N%2F%2B%2Fv7k7OFRmiYtlAA5lwI7lwI4lAA7kgI9jwE9iwI4iQCoVhWcTxCmb0K%2BooT8%2Fv%2F7%2F%2F%2FJ2r8fdwI1mwA3mQA3mgA8lAE8lAE4jwA9iwE%2BhwGfXifWvqz%2B%2Ff%2F58u%2Fev6Dt4tr%2B%2F%2F2ZuIUsggA7mgM6mAM3lgA5lgA6kQE%2FkwBChwHt4dv%2F%2F%2F728ei1bCi7VAC5XQ7kz7n%2F%2F%2F6bsZkgcB03lQA9lgM7kwA2iQktZToPK4r9%2F%2F%2F9%2F%2F%2FSqYK5UwDKZAS9WALIkFn%2B%2F%2F3%2F%2BP8oKccGGcIRJrERILYFEMwAAuEAAdX%2F%2Ff7%2F%2FP%2B%2BfDvGXQLIZgLEWgLOjlf7%2F%2F%2F%2F%2F%2F9QU90EAPQAAf8DAP0AAfMAAOUDAtr%2F%2F%2F%2F7%2B%2Fu2bCTIYwDPZgDBWQDSr4P%2F%2Fv%2F%2F%2FP5GRuABAPkAA%2FwBAfkDAPAAAesAAN%2F%2F%2B%2Fz%2F%2F%2F64g1C5VwDMYwK8Yg7y5tz8%2Fv%2FV1PYKDOcAAP0DAf4AAf0AAfYEAOwAAuAAAAD%2F%2FPvi28ymXyChTATRrIb8%2F%2F3v8fk6P8MAAdUCAvoAAP0CAP0AAfYAAO4AAACAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAQAA</Image>
<Url type="application/x-suggestions+json" method="GET" template="http://suggestqueries.google.com/complete/search?output=firefox&client=firefox&hl={moz:locale}&q={searchTerms}"/>
<Url type="text/html" method="GET" template="http://www.google.com/search">
 <Param name="q" value="{searchTerms}"/>
 <Param name="ie" value="utf-8"/>
 <Param name="oe" value="utf-8"/>
 <Param name="aq" value="t"/>
 <!-- Dynamic parameters -->
 <Param name="rls" value="{moz:distributionID}:{moz:locale}:{moz:official}"/>
 <MozParam name="client" condition="defaultEngine" trueValue="firefox-a" falseValue="firefox"/>
</Url>
<SearchForm>http://www.google.com/firefox</SearchForm>
</SearchPlugin>

4. Delete the search.json file in your Firefox profile folder.

[bedbugy]

sorry to say not one of the above cleared the problem

spybot did remove a malware

and the other by superernova failed i still have a fake google

[RedCardinal]

Try malwarebytes.org - free and very effective.

[bangkokburning]

try malware bytes and hijackthis (but you have to know what you are doing here). post a log to a tech group and remove items as needed.

if you have broadband, you may just want to reformat.

[siamect]

....i still have a fake google

You have to explain what you mean with the fake... People are trying to help you but there is absolutely nothing in your post that describes what your problem is.

I doubt that you have got the thing infected when you update Firefox... You are most likely not the only one updating Firefox but you are the first one to report fake google... Whatever that means...

Martin

[Tim207]

I have fixed this problem with a program called combofix. Google "google hijack combofix" and you should get all the info you need to fix your problem. BTW: To get around the problem temporarily you can copy and paste the links underneath the google results into the address bar to get to the webpages you want. You can also check your internet options to see if a proxy server is being used (just uncheck the box for use a proxy server if it is checked).

Be careful with combofix. Once you start it don't touch anything until it is done. It may take a while but be patient, even moving your mouse over the window may cause it to hang.

For those who are asking for clarification, and I am assuming this is his problem because it is going around, when clicking on google search results your browser is redirected to different webpages. I have fixed this on 3 computers so far, all after java updates. Whether it came in the sun java packages or the computers were infected with something else that redirected the java download to come from a site with infected files I don't know. Or it could have just been coincidence.