X
Tap here to go to the mobile version of the site.

Support Forum

FF is redirected with a "http://www.results5.google.com/"

Posted

From what I've read, it's the widespread "Google redirect trojan". Except that there seems to be solutions for PC and not for MAC. Oh, the irony.

Not sure how or when, as I am not aware of having installed anything voluntarily. It is now affecting Firefox, as well as Safari.

This happened

Every time Firefox opened

Not really sure

User Agent

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4

From what I've read, it's the widespread "Google redirect trojan". Except that there seems to be solutions for PC and not for MAC. Oh, the irony. Not sure how or when, as I am not aware of having installed anything voluntarily. It is now affecting Firefox, as well as Safari. == This happened == Every time Firefox opened == Not really sure == == User Agent == Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4

Additional System Details

Application

  • User Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4

More Information

Morbus 135 solutions 2340 answers

Hi Ric.

Try reading this:

http://support.mozilla.com/en-US/kb/Searches+are+redirected+to+another+site

Hopefully it will be helpful.

Hi Ric. Try reading this: http://support.mozilla.com/en-US/kb/Searches+are+redirected+to+another+site Hopefully it will be helpful.

Question owner

that happens with safari as well. is it a google probem?

that happens with safari as well. is it a google probem?
Morbus 135 solutions 2340 answers

Huh... Unlikely. It's probably just the trojan. You should contact Apple support for that :\

Huh... Unlikely. It's probably just the trojan. You should contact Apple support for that :\

Question owner

@Morbus Thank you so much for your response. Unfortunately, I'm not finding much help with those instructions so far. Removing or disabling plug-ins is not doing it. In those forums (Spyware Warrior, etc), the preferred method of detection for these critters seems to be the HijackThis logs. These, as you know, are only available for PC's. The "MAC has no virus" mantra seems to be overshadowing the solution.

@Unbekannt Since this concerns you too, I think. Whatever got in, has moved to my Safari, as well. I personally hate Safari, I think it still has a way to go. So I would recommend Google Chrome, if not FFox. That's neither here nor there, really. The point is that this "Google Redirect" bug, whatever it is, is now affecting both my browsers.

@Morbus Thank you so much for your response. Unfortunately, I'm not finding much help with those instructions so far. Removing or disabling plug-ins is not doing it. In those forums (Spyware Warrior, etc), the preferred method of detection for these critters seems to be the ''HijackThis'' logs. These, as you know, are only available for PC's. The "MAC has no virus" mantra seems to be overshadowing the solution. @Unbekannt Since this concerns you too, I think. Whatever got in, has moved to my Safari, as well. I personally hate Safari, I think it still has a way to go. So I would recommend Google Chrome, if not FFox. That's neither here nor there, really. The point is that this "Google Redirect" bug, whatever it is, is now affecting both my browsers.

Question owner

same - tried running DNSChanger Removal Tool for a similar redirect - it only fixed that one - still left with the results5 one.

same - tried running ''DNSChanger Removal Tool'' for a similar redirect - it only fixed that one - still left with the ''results5'' one.

Question owner

i'm on a Mac btw...

i'm on a Mac btw...

Question owner

Uninstalled FFox and Safari. Re-installed FFox clean...and voila! Just like old times.

Obviously the little bastard is safely hidden somewhere in my system and away from harm.

Uninstalled FFox and Safari. Re-installed FFox clean...and ''voila!'' Just like old times. Obviously the little bastard is safely hidden somewhere in my system and away from harm.

Question owner

I had the same problem and called Mac Tech support. They had me go into system preferences, then network, then click advanced, then click DNS then delete the entry that was there which was in pale grey (192.168.1.1 which happens to also be the router DNS). They had me put in 208.67.222.222 and 208.67.220.220. That seems to have stopped the redirects. I am not positive because they were sporadic but haven't had a redirect in the last 30 minutes.

I had the same problem and called Mac Tech support. They had me go into system preferences, then network, then click advanced, then click DNS then delete the entry that was there which was in pale grey (192.168.1.1 which happens to also be the router DNS). They had me put in 208.67.222.222 and 208.67.220.220. That seems to have stopped the redirects. I am not positive because they were sporadic but haven't had a redirect in the last 30 minutes.

Question owner

I've posted this message already in a other mozilla forum but I will post it here also. I also had the problem being redirected. First thing was I couldn't find out what's wrong on my system, still now I'm not sure where the virus/trojan resides. In the second step I tried to find out who is the owner of the domain http://results5.google.com and http://results5.google.de. Interesting because this domain doesn't exist. Curious, isn't it? When you type any address, like http://google.com the DNS Server will forward your request to get the IP-Address behind this domain. This is the way how your PC/Mac know which is the address you want to get displayed in your browser. We know the domain http://results5.google.com doesn't exist, how is it possible you get forwarded to this address? Because you have a DNS-Server which can resolve this domain and lead you to addresses which are not known or registered in the WEB. I'm using a Mac and having a look at the Network Preferences -> Advanced -> DNS I realize I have 2 DNS Server Entries in grey. So far I click in the window the entries disappear. Before disappearing, I noticed this IP-Addresses: 85.255.115.26 and 85.255.112.25. I try to find out where those addresses belongs to. You also can check that at http://cqcounter.com/whois/. You will find out this addresses belong to a company in the Ukraine. The organization name is Promnet Ltd. How can you solve the problem? 1. Ask your ISP for the right DNS-Server. DON'T use the automatic entries from your modem/router, this hardware can be infected!! 2. At a Mac put this entries in Network Preferences -> Advanced -> DNS. Click "OK" and in the Main Window of the Network Preferences "Apply". To check just type the URL http://results5.google.com and you will see, you get the message "Failed ..." To check the wrong DNS-Server, just entry the bad DNS-Servers: 85.255.115.26 and 85.255.112.25 and then go to the URL http://results5.google.com and you realize the domains can be resolved and your searches are redirected again. Having the right DNS entry in your network connection can't harm your PC/Mac but the virus/trojan is still there. I didn't find evildoer yet and I'm still searching ...

I've posted this message already in a other mozilla forum but I will post it here also. I also had the problem being redirected. First thing was I couldn't find out what's wrong on my system, still now I'm not sure where the virus/trojan resides. In the second step I tried to find out who is the owner of the domain http://results5.google.com and http://results5.google.de. Interesting because this domain doesn't exist. Curious, isn't it? When you type any address, like http://google.com the DNS Server will forward your request to get the IP-Address behind this domain. This is the way how your PC/Mac know which is the address you want to get displayed in your browser. We know the domain http://results5.google.com doesn't exist, how is it possible you get forwarded to this address? Because you have a DNS-Server which can resolve this domain and lead you to addresses which are not known or registered in the WEB. I'm using a Mac and having a look at the Network Preferences -> Advanced -> DNS I realize I have 2 DNS Server Entries in grey. So far I click in the window the entries disappear. Before disappearing, I noticed this IP-Addresses: 85.255.115.26 and 85.255.112.25. I try to find out where those addresses belongs to. You also can check that at http://cqcounter.com/whois/. You will find out this addresses belong to a company in the Ukraine. The organization name is Promnet Ltd. How can you solve the problem? 1. Ask your ISP for the right DNS-Server. DON'T use the automatic entries from your modem/router, this hardware can be infected!! 2. At a Mac put this entries in Network Preferences -> Advanced -> DNS. Click "OK" and in the Main Window of the Network Preferences "Apply". To check just type the URL http://results5.google.com and you will see, you get the message "Failed ..." To check the wrong DNS-Server, just entry the bad DNS-Servers: 85.255.115.26 and 85.255.112.25 and then go to the URL http://results5.google.com and you realize the domains can be resolved and your searches are redirected again. Having the right DNS entry in your network connection can't harm your PC/Mac but the virus/trojan is still there. I didn't find evildoer yet and I'm still searching ...