8 replies to this topic

[1dmf]

I may be slow on the uptake here, but has google released a new mechanism in their SERPs , where it seems when I click a link in the SERPs (organic), I first get redirected to a URL from googledoubleclick.com

I did a quick search and there seems to be some info on a new paid ad service called doubeclick from Google, but there are also reports of a virus.

Is it a virus?

Cheers,
1DMF

[chrishirst]

No, Google bought DoubleClick way back in 2007 http://googleblog.bl...oubleclick.html and they have been gearing up to start using it for the last year or so with their changes in privacy policies, requiring Adsense publishers to update their privacy policies to include "third party cookies" etc. etc.

Simply "Google, the advertising company", showing their corporate business face, rather than their "Google, the benevolent provider of services" face. Despite their remarks to the contrary.

[1dmf]

Well it's off to the firewall to block that domain then!

If it breaks Google then i'm off to the competition. Google had lost my trust a long time ago, now it might lose my custom!

Update -> it does break Google, so it's tme to move on , where is CUIL when you need em

Oh, this redirect also breaks their own rules and the browser back button -> shame on you Google, you are now a corporate tyrant!

Edited by 1dmf, 11 April 2012 - 04:44 AM.

[1dmf]

OK, now i'm totally puzzled?

Why are all links in Bing trying to redirect via http://pagead.google...ks.com?URLxxxxx

None of the links in Bing work now that i have blocked doubleclicks.com domain?

Why is Bing using Google doubleclicks?

Note : Same thing with Yahoo?


Update : It doesn't do the redirect in safe mode!

I beleive this is a virus!!!!!!!

Edited by 1dmf, 11 April 2012 - 06:24 AM.

[Jill]

Yep, sounds like adware on your browser.

[1dmf]

It sure was Jill!

So just to recap for anyone else...

If your browser redirects on any SERPs to a URL such as http://pagead.googledoubleclicks.com?URLxxxxx

IT IS A VIRUS! - funny how there is next to nothing on the net about this! - should I feel lucky? Am I one of the first?

Anyway....

To remove it I did the following....

1. Boot into safe mode
2. Update Malwarebytes anti-malware and run a scan
3. Remove any objects found and reboot. (make note of their names)
4. edit registry and find the startup regkey for the virus, mine was called 'zclum.dll'
5. open internet explorer and go to the browser files location and delete everything (not via 'delete browsing history')
6. go to browser options -> privacy -> sites , and add http://pagead.googledoubleclicks.com to the list via 'Always Block'
7. close internet explorer and re-open, do a google search and this should resolve the problem!

Hope it helps others!

Regards,
1DMF

[chrishirst]

Having Spybot S&D and using Firefox with AdBlock Plus stops things like that before they even start.

[1dmf]

Really?

According to you this was perfectly legitimate and not a virus

Seriously though, our new support company talked the MD into ditching our zscaler proxy protection, and low and behold, we end up with a virus.

Not having strong enough malware protection to stop these nasties is someone elses responsibility now! What the MD fails to appreciate is that the new support company has actualy cost the company more in down time, technical issues and wasted money than they ever initially saved the company. Grr, bosses drive you nuts!

Edited by 1dmf, 11 April 2012 - 08:54 AM.

[chrishirst]

True. However, I was basing my reply on the information in the first post. The subsequently added information threw a different light on what was occuring.

Google are always playing with their UI and seeing a rerouted URI is not particularly unusual from some datacentres / server clusters, but once the same problem happens on other search providers, it points to a common cause that is exclusive to your machine.

Bosses are wonderful. In a former life as a wage slave, the directors used to complain about me spending 20% - 25% of my week researching what was happening with virus creators etc. So i was always prepared for what was likely to arrive in emails and I had filters in place on the Exchange server gateway to quarantine subjects, certain attachments and so on. About eight weeks after I left the entire company network was infected and ~150 machines over three sites had to be taken down and cleaned at an estimated cost of £12k in lost time and IT staff wages to clean it up.

Afterwards I did send all the directors a message that said "Now do you think I was wasting time"??