Google Search Results Containing Malware

[Dennis Oakley]

Hi Johanna,

I just wanted to make you aware of something I came across lately in Google searches. Not sure if it's just me or if anyone else has had a problem.

When doing Google searches for variety of leatherwork topics the results will show a link to leatherworker.net but when clicked on it it takes you to a different site that has malware and locks the browser into the site. I end up using Task Manager to kill the browser. For instance, tonight I did a search for "Leather guitar strap kit" and the 6th link said "Tandy guitar strap kit - Patterns and Templates - leatherworker.net". When clicked on it takes the browser to a different website, popups come up, and it locks the browser into a loop where you can't close without installing something.

This has happened to me a dozen times over the past two weeks, only on links pointing to this site. Also happened to me on more than one pc, my home pc and my office pc.

Really strange.

[Northmount]

Hi Johanna,

I just wanted to make you aware of something I came across lately in Google searches. Not sure if it's just me or if anyone else has had a problem.

When doing Google searches for variety of leatherwork topics the results will show a link to leatherworker.net but when clicked on it it takes you to a different site that has malware and locks the browser into the site. I end up using Task Manager to kill the browser. For instance, tonight I did a search for "Leather guitar strap kit" and the 6th link said "Tandy guitar strap kit - Patterns and Templates - leatherworker.net". When clicked on it takes the browser to a different website, popups come up, and it locks the browser into a loop where you can't close without installing something.

This has happened to me a dozen times over the past two weeks, only on links pointing to this site. Also happened to me on more than one pc, my home pc and my office pc.

Really strange.

Works fine for me. You likely have a root kit virus, pointing you to a rouge DNS server. Search for malwarebytes and install it and run a scan. Also download tdsskiller from support.kasper.com/5350 install it and run it to detect and fix. I had a similar thing a month or so ago, also related to google searches, but couldn't get any results from a google search.

Hope this helps

Tom

[veedub3]

I have experienced that a few times lately too but I use Avast so when I attempt to click on the link, Avast alerts me of possible Malware and blocks the site from loading so my system is not harmed. Being that you your system was "locked in a loop" as you stated I do think that you may need a better Antivirus software installed. Avast.com has a free version that will do the job. Before installing I do think you will need to clean up your computer, if you do not have any experience go to bleepingcomputers.com which is a site dedicated to helping people cleanup their computer from viruses and they will get you straightened out.

On the other side of this: I am a member of many forums and the moderator on several, and we have been getting these types of messages from members on several of the forums I am a part of and I honestly think it is more likely the website/Google that has been hacked not necessarily a virus on the users computer. (Although in the posters case I do think his computer is infected if it locks up the computer) I for one have gotten a Malware message when attempting to click on a link found in a Google search, and I know for a fact as an X-computer technician my computer is not infected. This only happen to me a few times when searching on Google, I did the exact same search on Yahoo and Bing and the links opened fine. If I had a virus on the computer it would do this regardless of what website/search provider I used, but it only does this when I click on a leatherworker.net link. Google is aware of these issues because people are screaming about it in the Google groups but of course they are pointing the finger at the user and doing nothing to help.

Karina

[Johanna]

Karina I have to agree that it's a Google problem and not necessarily a person's computer. When I got your original message, Dennis, I investigated immediately. The site and server are clean. I did a search using the terms you mentioned, and the first time I clicked the link I got a weird page, and the status bar indicated I was on LW. But the page doesn't exist here. Strange. So I did it again on my daughter's computer, no problem. My son's computer on a different network, all okay, tried my computer again and the link went straight to LW like it was supposed to. Now I'm wondering what the devil is happening, so I start Googling common LW search terms. Every LW link came up clean on all the computers, so now I can't duplicate the problem, but I saw the odd page too- said 404 and was shrouded in gray. (should have screen capped it for submission to Google!) If anyone experiences this again, please let me know as much detail as you can. I filed a ticket with Google to have them investigate after I started Googling for other examples of this kind of thing. Like Karina said, Google is aware of the issue because they have all sorts of folks fussing about redirected links.

bleepingcomputer.com and geekstogo.com are excellent resources for people looking to make sure their computers are clean. I know the admins there, and they have top-of-the-line help to assist you.

~J

[Feraud]

Hi. Just a quick note. This past week or so I notice emails received based on subscribed threads contain faulty links.

I click the "The topic can be found here" link in the email and it directs me to some spammy-type site. I have to close the browser and re-click the subscription link to get to the Leatherworker site thread.

Not sure if anyone else is experiencing this?

Thanks

[Johanna]

I would like to see one of those emails, and if you know how to copy the headers, I would appreciate it. No one else has reported anything like that, and I am not aware of any problems with the mailserver. Thanks for your help.

~J

admin@leatherworker.net

[Feraud]

I went back to find a recent email where this occurred and wouldn't you know it, the links bring me directly to the thread! Oh well, I shouldn't complain as things are working fine now.

If it happens again I will forward the email.

Appreciate the reply!

[wokka]

I've had this happen across multiple forums, it happens when you click a link either from email, or even a google search sometimes.

it takes you to a page asking you to fill out a survey before it will take you to the link destination, and when you try and go back, one of those annoying pop-ups comes up asking if you really want to leave the page.

I deleted cookies and ran spybot and managed to get rid of it for a while, but then it popped back up tonight.

kinda wished I screencapped it

[Cyberthrasher]

Actually, I just had this happen yesterday from a google search that linked to a thread here. The link first sent me to some other site and then when I closed it and clicked the link again it took me to the appropriate thread here. So, Joanna, I think if you do a google search for stuff that will come up with results on the forum and then sporadically click them, you may be able to reproduce it on occasion. Next time it happens to me I'll do a better job at documenting what's going on for you.

[Beaverslayer]

I use an application called MyWOT and it lets me know which Google results are trusted or questionable by placing icons beside each result, even Google Images. It also works inside Facebook as well.

I just did a Google search as others have done above, and clicked on one of the recommendations from Google that was not trusted, it sent me to this website: NOTE: DO NOT CLICK THIS LINK OUT OF CURIOSITY http://om55nh8.onmypc.info/joomla/

It brings up some survey scam. I just clicked the above link from inside my post, and it brought up "Adult Friend Finder" website, MyWOT shut it down right away, and brought up a screen informing me of the dangers of accessing this site. It gives you the option of entering and even rating the site.

I also clicked many of the results listed as "Trustworthy" and none of them were a problem.

So, to be safe while surfing and searching, I'd suggest you go to http://www.mywot.com/en/download and download and install their free software, I think you'll appreciate the added security.

Edited January 8, 2013 by Beaverslayer