X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

The first time I select a Google Search result, I am redirected by googleleads.g.doubleclick.net to another website. When I go back one page and select the same result again, I am directed to the correct website!

Posted

This does not happen with every Google search. When it does happen, it is always the first time I select a result no matter which result I select. Always when I go back one page and select the result again or another result I am directed to the correct website.

I only use Firefox so don't know what happens with other browsers IE Google Chrome or whatever.

I have several examples since December 2010 including two today 7th March 2011.

Chosen solution

sledge81, you probably picked up some Malware. That IP address has something to do with whalemutation.com. I see that domain name as being blocked by NoScript, so nothing loads for me. When I allow that domain a crappy website loads after a redirect; hit the Back button, another redirect and a different crappy web site loads. That's a redirect farm.

Install, update, and run these programs in this order. They are listed in order of efficacy.
(Not all programs detect the same Malware, so you may need to run them all to solve your problem.)
These programs are all free for personal use, but some have limited functionality in the "free mode" - but those are features you really don't need to find and remove the problem that you have.
Note: If your Malware infection is bad enough and you are mis-directed to URL's other than what is posted, you may have to use a different PC to download these programs and use a USB stick to transfer them to the afflicted PC.

Malwarebytes' Anti-Malware - http://www.malwarebytes.org/mbam.php
SuperAntispyware - http://www.superantispyware.com/
AdAware - http://www.lavasoftusa.com/software/adaware/
Spybot Search & Destroy - http://www.safer-networking.org/en/index.html
Windows Defender: Home Page - http://www.microsoft.com/windows/prod.../default.mspx
Also, if you have a search engine re-direct problem, see this:
http://deletemalware.blogspot.com/2010/02/remove-google-redirect-virus.html

If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:
http://www.spywarewarrior.com/index.php
http://forum.aumha.org/
http://www.spywareinfoforum.com/
http://bleepingcomputer.com

Read this answer in context 16

Additional System Details

This happened

A few times a week

This started when...

December 2010

Installed Plug-ins

  • Next Generation Java Plug-in 1.6.0_19 for Mozilla browsers
  • Shockwave Flash 10.2 r152
  • 6.0.12.1483
  • RealPlayer(tm) LiveConnect-Enabled Plug-In
  • RealJukebox Netscape Plugin
  • Office Plugin for Netscape Navigator
  • Adobe Shockwave for Director Netscape plug-in, version 11.0
  • npdivxplayerplugin
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • ActiveTouch General Plugin Container Version 105
  • Adobe PDF Plug-In For Firefox and Netscape 8.2.6
  • Default Plug-in
  • Google Update
  • DivX Web Player version 2.0.3.4
  • GEPlugin
  • Yahoo Application State Plugin version 1.0.0.7
  • Windows Presentation Foundation (WPF) plug-in for Mozilla browsers
  • Adobe Acrobat Plug-In Version 7.00 for Netscape
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • Npdsplay dll
  • DRM Store Netscape Plugin
  • DRM Netscape Network Object

Application

  • User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13 GTB7.0 ( .NET CLR 3.5.30729)

More Information

one example today 7th March:
I searched chepstow castle from the air
http://www.google.co.uk/search?hl=en&source=hp&biw=1476&bih=1018&q=chepstow+castle+from+the+air&btnG=Google+Search&aq=f&aqi=&aql=&oq=chepstow+castle+from+the+air
I selected Wales Balloon Rides, enjoy views of Wales on a hot air balloon flight
http://www.baileyballoons.co.uk/our-flights/where-we-fly/south-wales.html
and off we go ...
http://feed.bizzclick.com/click.php?id=9eeZ-2wP-v98DYLInfvexYZVFl0pvvCTx3dugDljX20CPFGpGFKw5Kx2ovqkZitAoVVCJKorEb_QCux5b1Qy5MflkKafo5kCH2ht2w%2C%2C
then this ...
http://bridge2.admarketplace.net/ct?version=1.0.0&enURL=EVR1DO588zqvJAHgE0ckEiiYmKpVR1QgtMNiXFqghFBVWSzuO74RxIVVR/PlY2ffyiQWoIZbrETil605v4XgxTGmYpWExgSpYTEfTa9TUeXFSmxWsa7F+xPEPHnqYTl5j5VfOdv04t+wE+IbOLnYHM7xudzXk/TiIoafkL9VAqpoIuUx2czM0A==&queryid=3973866667&adid=3973872711&invid=6733264&ampsc=90&ampsctid=1&upid=&orgkw=chepstow%20castle%20from%20the%20air&fs=w-xml-02&pb=790.0&txid=121015000&advn=teambath.com&iic=116295;6733261;6733262;6733263;6733264&cp=0.2700,1770083360,537901984,0,pub_bizzclick-1832-1,chepstow%20castle%20from%20the%20air,backfill_conducive/l=COND
then this ...
http://bridge2.admarketplace.net/ct?ctcookie_value=1299494131864.0690FDE74BF3DAFAC4FC9C3D9E68D62E&version=1.0.0&enURL=EVR1DO588zqvJAHgE0ckEiiYmKpVR1QgtMNiXFqghFBVWSzuO74RxIVVR/PlY2ffyiQWoIZbrETil605v4XgxTGmYpWExgSpYTEfTa9TUeXFSmxWsa7F+xPEPHnqYTl5j5VfOdv04t+wE+IbOLnYHM7xudzXk/TiIoafkL9VAqpoIuUx2czM0A==&queryid=3973866667&adid=3973872711&invid=6733264&ampsc=90&ampsctid=1&upid=&orgkw=chepstow%20castle%20from%20the%20air&fs=w-xml-02&pb=790.0&txid=121015000&advn=teambath.com&iic=116295;6733261;6733262;6733263;6733264&cp=0.2700,1770083360,537901984,0,pub_bizzclick-1832-1,chepstow%20castle%20from%20the%20air,backfill_conducive/l=COND
this ...
http://399_1456114410.admarketplace.com/?sid=NUEmXTQIB2QvUyRVQQEuOEUbEjkyHSFcJxEEfn4FcQwKXHx0SUVDa2Yefwp%2BXQJqfgJzBwZQeH5JT0V0ZgB7F2peG3t7AjUF
this...
http://yell.grapeshot.co.uk/netreachtextads/click.cgi?id=10902&gsid=nmuev8x&url=http%3a%2f%2fwww.teambath.com
to get TEAMBATH University of Bath!
I go back one page ...
http://bridge2.admarketplace.net/bounce?click_id=1402889678&m_width=1600&m_height=1200&b_width=1342&b_height=925&b_top=-4&b_left=-4
Select the same result ...
http://google.ad.sgdoubleclick.net/pagead/nclk?sa=L&ai=1&fadurl=googleads.g.doubleclick.net&u=http%3A%2F%2Fwww.baileyballoons.co.uk%2Four-flights%2Fwhere-we-fly%2Fsouth-wales.html
to get what I want!
Another one?
http://www.google.co.uk/search?hl=en&source=hp&biw=1476&bih=1010&q=Supply+Chain+Asia&btnG=Google+Search&aq=f&aqi=&aql=&oq=Supply+Chain+Asia
http://64.111.211.161/c.php?s=eNodkVmPqkAUhH8QCdOnF-h-8MHh4oobigovN72AKKjXBZwx_eOHuamHqqQqOcn5ThYjQbAFO1v1eha5CDP8axR3DQAiyAeMCfVsQrYvPfxi43B-TXd1Mw4Hb7kLe9YvKKcUEZrnCGklCebK85lGoIXmnP41BeagoaCYCOMZASLXQhTAiMSel3Prd_fz-dUcfbQ4nPppnDlD9ZwuD4fBbFjql5b9x3laqmjdr-Ps7gwXo3-xNG9NoiWdvJw0fK__hOMgT76C6LoiZLS9YVlnKpglnMajpVONR-RSrL8Tst7zwaOl5e7j3laLdpZNL7C7Pepx0B9GNVdNlmicA0y-637YmHh0jFf3Z14Ny3PymbeqPJLsKHF2OwbRrdnuYCKixPlYbtKEFhsHVmxRhptp8CrNymzMw3LPBUJdQVxgzFrBXAzgAkKu333aWmwNMSQ6Pyu5n9QpiVt9qZoU88bsHh2S_7LEavLZqsu81edtFe3ndbqfnGTAmmy_6lmtlOQCSS4ZR0J4QP0OhFAFSMUU4ZZLw5nHQGCiQPjyd9VFBIJj6Gj9AKIWoFY
http://64.111.211.154/c.php?re=1&r=eNodkVmPqkAUhH8QCdOnF-h-8MHh4oobigovN72AKKjXBZwx_eOHuamHqqQqOcn5ThYjQbAFO1v1eha5CDP8axR3DQAiyAeMCfVsQrYvPfxi43B-TXd1Mw4Hb7kLe9YvKKcUEZrnCGklCebK85lGoIXmnP41BeagoaCYCOMZASLXQhTAiMSel3Prd_fz-dUcfbQ4nPppnDlD9ZwuD4fBbFjql5b9x3laqmjdr-Ps7gwXo3-xNG9NoiWdvJw0fK__hOMgT76C6LoiZLS9YVlnKpglnMajpVONR-RSrL8Tst7zwaOl5e7j3laLdpZNL7C7Pepx0B9GNVdNlmicA0y-637YmHh0jFf3Z14Ny3PymbeqPJLsKHF2OwbRrdnuYCKixPlYbtKEFhsHVmxRhptp8CrNymzMw3LPBUJdQVxgzFrBXAzgAkKu333aWmwNMSQ6Pyu5n9QpiVt9qZoU88bsHh2S_7LEavLZqsu81edtFe3ndbqfnGTAmmy_6lmtlOQCSS4ZR0J4QP0OhFAFSMUU4ZZLw5nHQGCiQPjyd9VFBIJj6Gj9AKIWoFY&u=f913e63b1b902d3f422a6a280738bee4&cid=5e7a1c931c101a5431e9cf7f86dc838c&rc=0&pa=&ref1=&ref2=
http://2780.20932.accurately-locate.com/jump1/?affiliate=2780&subid=20932&terms=supply%20chain%20asia&sid=Z270043919%40EzX4MjN0EDNfdTNy8FNz8lM081MyYDOxUTO5ITM&a=vgpt&mr=1&rc=0
http://www.kdirectory.co.uk/results.asp?qry=supply%20chain&rfid=lpp3_62023-2780.20932&bp=supply%20chain&rfs=http%3A%2F%2F2780.20932.accurately-locate.com%2Fjump1%2F%3Faffiliate%3D2780%26subid%3D20932%26terms%3Dsupply%2520chain%2520asia%26sid%3DZ270043919%2540EzX4MjN0EDNfdTNy8FNz8lM081MyYDOxUTO5ITM%26a%3Dvgpt%26mr%3D1%26rc%3D0
I go back one page ...
http://google.ad.sgdoubleclick.net/pagead/nclk?sa=L&ai=1&fadurl=googleads.g.doubleclick.net&u=http%3A%2F%2Fwww.supplychainasia.com%2F
http://google.ad.sgdoubleclick.net/pagead/nclk?sa=L&ai=1&fadurl=googleads.g.doubleclick.net&u=http%3A%2F%2Fgoogle.ad.sgdoubleclick.net%2Fpagead%2Fnclk%3Fsa%3DL%26ai%3D1%26fadurl%3Dgoogleads.g.doubleclick.net%26u%3Dhttp%253A%252F%252Fwww.supplychainasia.com%252F
and get what I want!

sledge81 0 solutions 1 answers

I noticed this problem since earlier this morning. I'm certain I haven't downloaded any new softwares or app. My Norton Antivirus gives me a 'Hack Attempt' when this happens.

The URL I am redirected to is "http://64.111.196.121/rej.php?aid=20165&said=3&keyword=MY SEARCH TERM&d=d2hhbGVtdXRhdGlvbi5jb20&rej=1&b=8"

the-edmeister
  • Top 10 Contributor
  • Moderator
3197 solutions 24404 answers

Chosen Solution

sledge81, you probably picked up some Malware. That IP address has something to do with whalemutation.com. I see that domain name as being blocked by NoScript, so nothing loads for me. When I allow that domain a crappy website loads after a redirect; hit the Back button, another redirect and a different crappy web site loads. That's a redirect farm.

Install, update, and run these programs in this order. They are listed in order of efficacy.
(Not all programs detect the same Malware, so you may need to run them all to solve your problem.)
These programs are all free for personal use, but some have limited functionality in the "free mode" - but those are features you really don't need to find and remove the problem that you have.
Note: If your Malware infection is bad enough and you are mis-directed to URL's other than what is posted, you may have to use a different PC to download these programs and use a USB stick to transfer them to the afflicted PC.

Malwarebytes' Anti-Malware - http://www.malwarebytes.org/mbam.php
SuperAntispyware - http://www.superantispyware.com/
AdAware - http://www.lavasoftusa.com/software/adaware/
Spybot Search & Destroy - http://www.safer-networking.org/en/index.html
Windows Defender: Home Page - http://www.microsoft.com/windows/prod.../default.mspx
Also, if you have a search engine re-direct problem, see this:
http://deletemalware.blogspot.com/2010/02/remove-google-redirect-virus.html

If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:
http://www.spywarewarrior.com/index.php
http://forum.aumha.org/
http://www.spywareinfoforum.com/
http://bleepingcomputer.com

Question owner

Whilst the-edmeister replied to sledge81 rather than myself who raised the ticket, I downloaded Malwarebytes' Anti-Malware and running this sorted it out i.e. redirected the first time I select a result no matter the result that was selected.

A very clever malware giving the impression Google and doubleclick were to blame.

Surprised that Google doesn't post an alert on their blog on this one :)

Modified by george.kearse

cheffess2 0 solutions 1 answers

Helpful Reply

This happened to me too. I noted the beginning of the URL and checked my cookies to see if there were any out there that were similar to the beginning letters of the URL. Sure enough there was one - monstermarketing in my case. Once I deleted the cookie I was no longer misdirected to other web sites.

plongwor 0 solutions 1 answers

I had the same problem, real intermittent redirects. Clever little buggers.

I found the solution on another Firefox thread "xul runner 1.9.1 added mysteriously-redirects google-how remove". The link is: xul runner 1.9.1 added mysteriously-redirects google-how remove

Modified by Noah_SUMO

dmcd 0 solutions 1 answers

If you have tried all the scanning stuff for malware, checked for malicious cookies etc., and still have this problem with redirection of your search results, it can be cured very simply.

In Firefox, go to Tools ->Options->Privacy->beside the box you tick to accept third party cookies (which you can leave ticked), you will see a tab marked->Exceptions. Click on this and in the box type: *googleleads.g.doubleclick.net. Then click the Block button and hit Close. Don't forget the star before the address. No more misdirections via doubleclick!

When the next redirect annoyance comes along - as it surely will, first check that it is not a malware infection of your computer Then have a look at the Cookies for nasties and if necessary clear them. Then just repeat the above process, adding whatever URL initially redirects to the pest advertising site, but don't forget to add the star if you leave off the www., or http:, etc. The star covers all the URL prefixes in use so no need to type them into the box.

It is the redirecting URL that needs blocking as it will be almost impossible to manually block all the advertising site URLs they dish up to you. You will have to be quick to copy the URL before it redirects and the address changes.