Google Search Hijacked

Posted on February 19, 2009
Filed Under Google, Internet, Software | Leave a Comment

If you've enjoyed reading this post then please subscribe to my Full Text RSS Feed.

I was away on holiday for two weeks leaving my PC on but locked. After my holidays, I started coding on my PC and discovered that Google Search on my PC had been hijacked. When I go to www.google.com and type in something to search, the search result page appeared like the usual Google Search result page we always see but when I look closely, the search results were quite different.

The descriptions were related to my search but the URLs were bogus. When I clicked on the links it would bring me to some buy.com, ebay.com and fake websites that contained nothing but advertisement links. How bizarre I thought to myself. I think my PC has been infected by some spyware or malware.

True enough I discovered I was not the only person online who had their Google search hijacked. Not being able to use Google search, I had to resort to Yahoo to help me find some other people online who had also experience the same predicament and hopefully find a resolution. How could I live without Google search, even for a day. I eventually resolved the problem but I spent quite some time trawling through discussion forums.

I had McAfee Security Centre installed on my PC and yet the scan came back clean. Some users online suggested using Kaspersky online scanner and that detected a trojan. It embeds itself in another system file located at C:\Windows\System32. The file name is wdmaud.sys.

The remedy to get rid of the Google search hijacker is to simply delete or rename the file wdmaud.sys in C:\Windows\System32. That restored my Google search result and all previous malicious symptoms went away.

The resolution

1) Use Kaspersky online scanner to scan your PC. Note that all other virus checker detected other viruses/malware on the PC but not this particular one. It was only detected using Kaspersky.
2) Then delete or rename C:\Windows\System32\wdmaud.sys
3) Problem resolved.