Google SERPS spyware

Ok, I've somehow managed to acquire the nasty spyware that moves all the Google Serps down and adds results at the top (usually to ebay but not always). I've tried all the usual removal programs (S&D, Adaware, Bazooka, PestPatrol, and various others) with no luck. Have also posted the HijackThis log at spywareinfo.com and have followed the instructions given me there - still have it. Don't even know what it is, so I can't even investigate. Maybe its too new for anything to detect. Anyone out there have any words of wisdom? Maybe you just encountered it and defeated it? Or at least know its name? I know this SEO Chat isn't a spyware forum, but I've tried that, and now I'm turning to my buds for help.

Hey Donna,

Posted on this recently, and did a good amount of research on it as well. I really really hate this kinda trash. And I know you do to. Webpronews even did a story on it.

Check out posts here:

http://www.seroundtable.com/archives/000556.html

http://forums.searchenginewatch.com...read.php?p=2810

plus there is about 2-3 other posts on this in the forum, do a search for "adware google results" or"spyware google"

:smile:

Ben

I feel your pain... I also got infected by some spyware. Took me a week to ged rid of most of it, but traces of it still pop up sometimes.

I am now doing a backup of my stuff... and I'll be formating this weekend...

Thanks guys. Yep, I read those earlier today. Sounds like others are experiencing it, but haven't found the magic words to make it disappear. Abracadabra didn't work. So, I'll keep plugging along to try and dump the danged thing.

Donna, CWShredder and Spy Sweeper I think are the two programs known to get rid of these spyware. You might try those, CWShredder in particular, because the program that hijacked your browser is mostly like a CWS browser trojan or something. It will alter the setting, hide itself in another file, and basically reinstall itself once you restart you computer. Some damn smart malicious adware, that is pretty scary. I am still trying to pinpoint the exact cause.

But here is the link to CWShredder:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Also, be sure to check you HOSTS file on your C: drive for anything out of the ordinary. You can also check in your internet explorer settings, in the restricted or trusted sites section for anything fishy. Sometimes these vicious adware programs can change those settings too.

Yep, Phoenix tried cwshredder and spy sweeper. Nothing found. Hosts file is clean as a whistle. Here is an example of what I get when I do a search for "keyword phrase" (i've put spaces in the url manually). I see the normal serps for a second, and then I see a refresh of the page, with the serps moved down, and this ad (usually) on top. Heck, maybe it's not spyware - maybe Google itself is doing this, but I doubt it. If they are, though, I'll be even more aggravated.

Look for keyword phrase at eBay - The World's Online MarketplaceFind it at eBay - Over 5 million items for sale! The most fun buying and selling on the web! Try it, you'll love it!...
www . eBay . com - 28k - Cached

Ok, just wanted to post the solution to my problem here in case anyone else ever needs it. There is a file called cmcfg32.exe that resided in my c:\winnt\system32 folder. That needed to be deleted. First, I had to reboot into safe mode and then "fix" it via Hijack This. Then, without rebooting, I had to delete the file. Once I rebooted into normal mode after deleting the file, my normal serps have returned! Woohoo!

That's insane. I'm sure we will have to deal with this phenomenon a lot more.

Thanks for the tip tho. I'll keep my eyes out. I wonder how you got infected with this.

I wish I knew how my pc got infected (though I suspect it has something to do with my teenager). If I find out what it may be, I'll post it.

I'm actually having the same issue with the ctrstats. However, I do not have the cmcfg32.exe file. I'm guessing I have a different form of it. I've run SpyBot, CWShredder, and HijackThis without any luck. I've had this problem for about 5 days now. If anyone has any idea, I'd appreciate the help.

Thanks,
Colorado

Have you posted your hijack this file on forums.spywareinfo.com ? They know their stuff and they are the ones who finally helped me find the problem.

I had the same thing happen over here, Hijack This removed the little SOB quickly.

Thanks for the advice. I'll post it there.