Google Search Being Hijacked To Yahoo Search

Discussion in 'Malware Help (A Specialist Will Reply)' started by Eezak, Dec 12, 2019.

  1. Eezak

    Eezak Staff Sergeant

    Recently my wife's google search seems to have been hijacked somehow and the search results show as Yahoo search.

    I tried switching to a different search engine (Bing) and it too winds up at Yahoo search after clicking the search arrow. And then switching back to google still doesn't work -- it continues to jump to Yahoo search to display the search results.

    Anyone else experienced this or know how to fix it?
     
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    What browser are you using?
     
  3. Eezak

    Eezak Staff Sergeant

    Sorry Tim, I should have mentioned that my wife uses the Firefox browser. When I go to the Firefox setting for preferred search engine it shows Google. If I change it to something else (Bing, specifically) I still get to a search result page that says it's Yahoo (though the address for it it about three lines long). And then if I change it back to Google the resulting search still shows what appears to be Yahoo.
     
  4. Replicator

    Replicator MajorGeek

    Please download and run Hitman Pro. (choose one time scan) remove all found.
    If you dont already have it, down and run CCleaner, custom analyze and remove found.
    Do a registry scan also.

    Reboot, and re-test!
     
    Last edited: Dec 13, 2019
  5. Eezak

    Eezak Staff Sergeant

    Thanks Replicator. I have already tried CCleaner but will run Hitman Pro tomorrow. and then run CCleaner again on custom analyze (are there particular settings I should use -- not sure I've run custom analyze before).
     
  6. Replicator

    Replicator MajorGeek

    Probably best to run the latest version in default settings!

    Always works sweet for me :)
     
  7. Eezak

    Eezak Staff Sergeant

    Followed both of Replicator's suggestions, doing scans with Hitman Pro and CCleaner (freshly downloaded and installed). Both found a few items (tracking cookies and a handful of registry entries) but the problem remains.

    I opened a new Firefox browser tab and typed in Google.com and used the search window there and got this result (searching for "Octopus"):
    -----------------------
    https://www1srchopenpagetool.info/s...gsp_lovelytabff_19_50_ssg08&q=octopus+species

    Hmm. We’re having trouble finding that site.

    We can’t connect to the server at www1srchopenpagetool.info.

    If that address is correct, here are three other things you can try:

    Try again later.
    Check your network connection.
    If you are connected but behind a firewall, check that Firefox has permission to access the Web.
    ------------------------
    I appreciate the suggestions, Replicator, but not sure it's worth going through gauntlet of the more detailed and demanding procedure of the other malware forum here in this case because...

    I expect to be upgrading our computers in the next few days, at long last, to Windows 10 after backing up important data (text manuscripts and pictures mostly). My understanding is that changing to Windows 10 must be a clean install, not an "upgrade" install which makes me optimistic that in the process we'll lose the search hijacker.

    What do you think?
     
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Replicator likes this.
  9. plodr

    plodr MajorGeek Super Extraordinaire Moderator Staff Member

  10. Eezak

    Eezak Staff Sergeant

    Thanks Tim and plodr. To clarify, I didn't mistype that "openpagetool" web address. That's part of the message that pops up when I click on "Search" attempting to use the Google search engine. So I guess that's at least a part of what the hijack is doing to screw things up? Maybe?

    Perhaps I'll try Tim's suggestion and save my wife's bookmarks, then install a fresh copy of Firefox. Or more likely I'll back up her bookmarks and install Windows 10 with a new copy of Firefox, hoping none of her bookmarks are infected.

    Thanks everyone for your observations and suggestions. Will try to remember to report back at least once more on the outcome, whichever suggestions I follow. Rather a busy time for us as for most this time of year. Happy Holidays!
     
  11. plodr

    plodr MajorGeek Super Extraordinaire Moderator Staff Member

    Better idea is to clean the computer of the search hijack that it has. It might affect a clean copy of Firefox if it is not cleaned off the computer.
    Have you run Malwarebytes?

    Download MBAM on a clean computer, put it on a USB stick and take it to the infected computer to run on that.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds