Strange search results in Google

[antioch]

Windows XP2 - fully updated - IE6 - have run a full AV scan, MS Mal
Software, Adaware.
Last night I did a number of searches(not the address bar)in Google, and
when I selected a link, up came the MSN home page every time.
It didn't matter what link I chose on the first search results page, all
would go to MSN(I do not use MSN - only Google).
After clicking on about 12 or more links, I would at last get the correct
page.
I then went back to all the others that I had previously tried, and up would
come the correct site.
Tonight, the same thing is happening, but this time I am getting a site
called
Romemaster.com.
If I exit IE, clear all cookies and TIFs and history, then go back and
search in Google again, the same thing happens.
I have looked on Google for a possible explanation and also the knowledge
base, but nothing - its not an easy error to describe.
Rgds
Antioch

 

[antioch]

Windows XP2 - fully updated - IE6 - have run a full AV scan, MS Mal
Software, Adaware.
Last night I did a number of searches(not the address bar)in Google, and
when I selected a link, up came the MSN home page every time.
It didn't matter what link I chose on the first search results page, all
would go to MSN(I do not use MSN - only Google).
After clicking on about 12 or more links, I would at last get the correct
page.
I then went back to all the others that I had previously tried, and up
would come the correct site.
Tonight, the same thing is happening, but this time I am getting a site
called
Romemaster.com.
If I exit IE, clear all cookies and TIFs and history, then go back and
search in Google again, the same thing happens.
I have looked on Google for a possible explanation and also the knowledge
base, but nothing - its not an easy error to describe.
Rgds
Antioch

I at last found the answer - lots of them.
I thought I would after posting a thread

http://groups-beta.google.com/group/spyware-removal/browse_thread/thread/d860a7712955583e

http://www.castlecops.com/t172506-Hijackthis_Help_quot_up_search_com_quot.html

http://www.pcreview.co.uk/forums/thread-2353216.php

http://answers.yahoo.com/question/index?qid=20061001014639AARYcMj

 

[Robert Aldwinckle]

....

when I selected a link, up came the MSN home page every time.

Tonight, the same thing is happening, but this time I am getting a site
called Romemaster.com.

Looks like you should be posting your own HijackThis! log somewhere? ; )
(not here because of bandwidth and storage reasons for real NNTP
users of this newsgroup.)

FWIW the links you found seem to be more like others reporting the
same symptom than actual solutions for it. E.g. formatting and reinstalling
your OS seems slightly extreme, although I suppose with malware you might
assume that if you have one case of it there might be others lurking undetected
which arrived through the same hole in your security. One thing that I thought
was interesting in one of the HijackThis! logs was the proxy information
being exposed. I have never read about that being used as a vector
but it makes lots of sense, albeit trivially easy for a user to spot if they
were looking for it.

Rgds
Antioch

Good luck

Robert Aldwinckle
---

 

[antioch]

...




Looks like you should be posting your own HijackThis! log somewhere?
; )
(not here because of bandwidth and storage reasons for real NNTP
users of this newsgroup.)

FWIW the links you found seem to be more like others reporting the
same symptom than actual solutions for it. E.g. formatting and
reinstalling
your OS seems slightly extreme, although I suppose with malware you might
assume that if you have one case of it there might be others lurking
undetected
which arrived through the same hole in your security. One thing that I
thought
was interesting in one of the HijackThis! logs was the proxy information
being exposed. I have never read about that being used as a vector
but it makes lots of sense, albeit trivially easy for a user to spot if
they
were looking for it.




Good luck

Robert Aldwinckle

Hello Robert
Thank you for your input -
It happened that last weekend was my three monthly FULL system cleanup
regime so I have not pursued any further with Romemaster.
The MSN has gone - don't get an immediate link to that.
After 3 AV scans and 8/9 other malware,antispy.hijack etc, most picked up 5
nasty bits - only one suggested Romemaster - and you have to pay to get it
removed - most disappointing - I do have a Hijack This Log ready to send.
I will go back to the forums/etc I went to last time and see if there is any
further help(and post that HJ Log in the required site) - though did notice
that two had no follow-up to their logs being posted - and another said they
could see nothing wrong a log.
No, I didn't think the idea of reinstall was very clever at the moment.
I am still getting Romemaster - but only have to exit it twice to get the
correct link selected in Google.
Your last para I am afraid went way above my head :-(
This Romemaster must be in breach of some regulation or whatever?
Is there any way of reporting it - perhaps to Goggle.
Thanks again for the input
Rgds
Antioch

 

[Guest]

HI I got the same romemaster redirect when using IE6 & Google. I eventually
(hopefully) got rid of it by using Spyware Doctor from PC Tools (cost me
29.95US) Well worth it I thought, you don't know what else its up to!!

 

[antioch]

HI I got the same romemaster redirect when using IE6 & Google. I
eventually
(hopefully) got rid of it by using Spyware Doctor from PC Tools (cost me
29.95US) Well worth it I thought, you don't know what else its up to!!

Hi Navajo
Good news - shame it cost money.
Yes I have that one in favourites read to buy should the need arise - couple
of weekends ago I did a scan with ten free scanners for
spyware/malware/hijacking etc.
The Doctor and one other found romemaster. All the others did not sniff it
out.
Needless to say, the other one, like Doctor, wanted money upfront to
destroy.
For the moment I am still playing with it - I did loose it from showing in
Yahoo and MSN browsers(put them on my computer just to see).
The strange thing is that after getting rid of Yahoo and MSN, for a few days
I kept getting MSN pop-up as well as romemaster .
Rgds
Antioch
PS At least I only have to click twice on a site to get rid of romemaster
showing again in any session.