cancel
Showing results for 
Search instead for 
Did you mean: 

All Browser searches have been hijacked...Google, Yahoo, etc.

I am having a problem with Google searches, Yahoo searches, etc. I believe the problem originated during a Wikipedia search.

The resulting search page has bogus "ad page" links associated with the results.

I have tried following the advice I have found in several places and have installed (in addition to existing Mcafee and Spysweeper) in order of installation:
Hijack this
SuperAntiSPyware
MalwareBytes AntiMalware

And run complete scans with each application. I still am getting bogus searches with all browser search software.

Is there any help available to resolve this problem?

BTW, is this a "Windows only" problem or is it also a problem with Apple?

Thanks in advance for you assistance.
7 Replies
Grif
Level 10
Report Inappropriate Content
Message 2 of 8

RE: All Browser searches have been hijacked...Google, Yahoo, etc.

It's malware.. Please follow the instructions below:

Please disconnect all of your computers from your network, then follow the instructions below on ALL of the connected computers:

Look for the file below and if there...:

C:/Windows/system32/wdmaud.sys

Delete it (or move/rename) and Reboot.
_____________

Next,
1.click start-->run-->devmgmt.msc-->ok
2.on the device manager, click view-->select show hidden devices/drivers.
3. then click on "non plug and play drivers/devices", and find TDssserv.sys
4. right click it, then select disable, then restart the computer.
5. then check if the problem still persists. good luck!
________________

Next, On a friend or family member's computer, download the Malwarebytes installer and update files from the links below, copy them to a CD or flash drive, then transfer the files to the problem machines and use them.. I use the sites below to download the installer file and the manual updater:

Once downloaded and before transferring them to the problem machine, rename the program installer "mbam-setup.exe" file to something else like "Gogetum.exe", then copy the installer file and the update file to a CD or flash drive.. Transfer the file to the problem machine, then install the "Gogetum.exe" file, then run the update to get the program current.. After that, run a full system scan and delete anything it finds.

Malwarebytes Installer Download Link (Clicking on the links below will immediately start the download dialogue window.)
http://www.besttechie.net/tools/mbam-setup.exe

Malwarebytes Manual Updater link
http://www.malwarebytes.org/mbam/database/mbam-rules.exe

Next, download the SuperAntispyware program and the manual updater from the links below. After running the Malwarebytes tool above, if you still can't download and install it directly from the problem machine, download it on a friend or family member's computer as well.:

SuperAntispyware
http://www.superantispyware.com/

SuperAntispyware Manual Updater
http://www.superantispyware.com/definitions.html
____________

In a few situations, in order for the program to run, it was also necessary to rename the main "mbam.exe" file also after installing it.. It resides in the C:\Programs Files\Malwarebytes Antimalware folder.

Hope this helps.

Grif

RE: All Browser searches have been hijacked...Google, Yahoo, etc.

Grif,

Thank you so much for your assistance. Browser searches are back to normal.

I followed the directions as best I could (there was no file TDssserve.sys in step 3 of the directions "3. then click on "non plug and play drivers/devices", and find TDssserv.sys")

I noticed when I floated over the file C:/Windows/system32/wdmaud.sys that the little yellow popup box said Miekiemoes rules (Mickey Mouse Rules?)

At any rate, I was able to find some additional information at http://miekiemoes.blogspot.com/2009/01/miekiemoes-rules-yeah-right.html

Thanks again for all of your assistance.

~Gaberax
kulak
Level 7
Report Inappropriate Content
Message 4 of 8

Same problem but with Vista

Grif,

I have this exact problem with Vista but the file that is listed above is not in the system32 directory. Is there a fix for Vista?

Thanks
Greg
Grif
Level 10
Report Inappropriate Content
Message 5 of 8

RE: Same problem but with Vista

Have you run Malwarebytes and SuperAntispyware per the instructions above yet? If not, please do..

Hope this helps.

Grif
kulak
Level 7
Report Inappropriate Content
Message 6 of 8

RE: Same problem but with Vista

Grif,

I have and both either do not run or run and then after a minute or two the system screen just goes blank and I have to reboot?


Now it only reboots in safe mode and blue screens frequently.

Looks like I may have to do a reboot and rebuild the system. I thought Vista would be more stable but for me at least it has been less stable than XP :mad:

Greg
Grif
Level 10
Report Inappropriate Content
Message 7 of 8

RE: Same problem but with Vista

You may have other issues.. Both programs should also run in Safe Mode..

Because it's rebooting so regularly, you issue may be hardware related.. You don't state whether your computer is a laptop or a desktop, but either way, please try cooling the machine off while running it.. If it's a desktop, remove the side cover and use compressed air to blow out all the dust from around the processor, heat sink, power supply, and all vents and fans.. Leave the cover off and point a house fan at the innards and run the computer like that.. See if it helps.

If it's a laptop, then you'll want to blow out all the vents and such and try a cooling pad..

Of course, formatting the drive and reinstalling the Recovery Discs so it's back to a factory condition will help ONLY if it's software related.. Now it's time to do some troubleshooting.

Hope this helps.

Grif

All Browser searches have been hijacked...Google, Yahoo, etc.

My searches have been hijacked as well, but only on Firefox, not Internet Explorer (which I don't really use anymore).

I tried following the instructions outlined by by Grif, but it failed to work. I got to:

3. then click on "non plug and play drivers/devices", and find TDssserv.sys

I could not go any further as TDcccerv.sys did not show up.

Any further suggestions?

Thanks,

John

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community