Weird porn searches showing up in history (NSFW)

6

3

A few months ago I went to do a search from the Firefox search page (the default home page) on my computer and one of the previously run searches in the dropdown was for "pee porn." At the time it was a little upsetting as I thought maybe my temporary housemate was responsible, but the dates and times related to the search didn't add up. I looked through the history and could not find any evidence that anything was accessed after the search, nor could I find the search results page for this query in the browser history. Perhaps the history was deleted but I never figured it out, the computer eventually got reformatted and I didn't think about it again.

Fast forward to a few days ago, my daughter and I were playing a game on my wife's laptop when I alt-tabbed out to Firefox to look up something for the game. On the Firefox search page, in the first five entries was a search done for "girl eats own p***y". I shooed my daughter away and looked at what else was on the list; there was "huge c--t porn," "men lick their c-- off girl b------," and possibly others (you get the point).

Assuming these searches are related, this set of fetishes is so diverse and in language that neither of us would ever in a million years use that my first guess was that this is all some kind of SEO attempt. The thing that gets me though is that I can't find any evidence that these searches are ever completed or that anything is accessed as a result. I 10000000% don't believe it's my wife doing this, I didn't do it, and I don't have any kids or visitors who would have done it either.

Virus scans are clean; both affected computers run Adblock Plus and the laptop in question just came back reformatted from the shop in May.

Anybody else have anything like this pop up on home or work computers?

Thanks

edit: I'm starting to get some validation in that I'm not the only one who seems to have this problem. This google thread (http://productforums.google.com/forum/#!category-topic/websearch/unexpected-search-results/dmT4efq3-HY) has a bunch of people complaining about weird searches showing up in their Google History.

jstar

Posted 2012-07-26T14:07:18.460

Reputation: 69

2

While its semi integral to the question, i've taken the liberty of editing this question slightly for worksafeness - folk can look at the previous edits if need be, and we've had some users complain about that sort of language before under more innocent circumstances. I've asked about it to the mods, and if necessary we can roll back my edit.

– Journeyman Geek – 2012-07-26T14:34:50.227

1> and the laptop in question just came back reformatted from the shop in May.   Um… – Synetech – 2012-07-26T15:36:05.983

When you say it happens while doing searches, what does that mean? Is it Google or other search engines? Get a fresh, portable copy of Firefox and see if it still happens. Try IE or other browser. If you can narrow it down to just that one copy of Firefox as opposed to a network-related issue, then try clearing out the cache. Maybe even consider making a backup of your profile and then try clearing the history, cookies, etc. until you find something that stops it altogether. That way you can narrow down exactly what is causing it. – Synetech – 2012-07-26T15:48:43.800

4Do you use Firefox's sync? If so, is it possible you've synced with another computer that someone else had access to? That could definitely account for this behavior. Is it possible that you logged into your google account on someone else's computer (or library, work, school) and left it logged in? I'm not sure if that would cross computers automatically, but if so it could just be searches someone else made before you were logged out. – techturtle – 2012-07-26T17:39:48.673

@techturtle : you should post that as an answer. Its another possibility, and one i didn't think about. – Journeyman Geek – 2012-07-27T00:23:56.467

I noticed these searches in the dropdown on Firefox's default custom search page.

Neither of us use Firefox sync, but I will look into it anyway. – jstar – 2012-07-27T15:19:10.583

> Firefox's default custom search page   “Default custom”? o.O   Check your search engine settings (pay close attention to the spelling of the URL); you may not be using what you think you are. – Synetech – 2012-07-27T16:13:39.290

Good thought. The browser opens up to about:home though. – jstar – 2012-07-27T16:25:17.283

Answers

9

There are two things I'd suggest here:

SU malware removal community wiki should be your first port of call.

Nirsoft has a few tools that may be useful in terms of forensics - my last search should help you find searches and when they were done, at least as far as the browser is concerned. He also has tools for looking at cache, cookies and history.If nothing else, if all these happens at wierd hours, you could rule out human involvement, short of a catburgler with an embarrassing porn fetish.

As for prevention, If you're running XP (or even newer windows versions, you may want to consider doing everything as a limited user and have per user accounts. If nothing else this should contain any weirdness to that user.

Journeyman Geek

Posted 2012-07-26T14:07:18.460

Reputation: 119 122

If you use Google and stay logged in, you can turn on search history, and then use the google search history to see when those searches were made. And introduce your roommate to Google Chrome and ctrl+shift+n – jcolebrand – 2012-07-26T20:57:02.877

If he determines there's malware causing this, I'd vote against using any malware removal tools. Given the symptoms, there would be at least a rootkit involved here, and malware travels in packs. It'd be easy to remove the obvious symptoms and unknowingly leave behind a more nefarious keylogger designed to steal credit card, bank passwords, or the like. – Joel Coehoorn – 2012-07-27T13:53:49.527

Oh yes, If his system is compromised to hell, reformatting is a very good idea. I still think checking for malware would be the first thing to do, before deciding on a course of action – Journeyman Geek – 2012-07-27T14:28:43.767

I've activated Google history on both our accounts just to see if I can drill down on any future occurrences.

It is my understanding that reformatting does not always eliminate rootkits. Is this true? – jstar – 2012-07-27T15:33:30.337

Oh, and I fired up MyLastSearch and it cannot find any evidence of these searches, even with the Google Instant exclusion disabled. These queries were entered but like my first experience with it there is no residual evidence... – jstar – 2012-07-27T15:34:47.030

2

Do you use Firefox's sync? If so, is it possible you've synced with another computer that someone else had access to? That could definitely account for this behavior. Is it possible that you logged into your google account on someone else's computer (or library, work, school) and left it logged in? I'm not sure if that would cross computers automatically, but if so it could just be searches someone else made before you were logged out.

techturtle

Posted 2012-07-26T14:07:18.460

Reputation: 8 059

I checked; sync is not enabled. – jstar – 2012-07-27T15:33:42.180

-1

I'm not sure this can be a virus or rootkit since you have AV installed.

I would install keyloger to check all hits from keyboard. the log will contains dates and time of the hit so it will be much easier to narrow down the time frame and possible cause.

Additionally some firewalls / AVs have a possibility of extended log - you may want to enable this. It might show accessed web pages.

If you are determined and your ISP provides his own DNS server - so you dont have like 8.8.8.8 as DNS entry, you may want to ask your ISP for date and time when the query for this particular domain was sent to DNS server.

you can also install local proxy which will collect all the urls and log them, and direct browser to use this local proxy.

mnmnc

Posted 2012-07-26T14:07:18.460

Reputation: 3 637

5"I'm not sure this can be a virus or rootkit since you have AV installed." - A popular misconception. Having said that, Occam's Razor in this case would point to someone actually doing those searches. – EBGreen – 2012-07-26T14:25:15.650

i've heard of worms that block certain DNS queries or drops connections to certain sites. I've never heard of a worm that will search nasty things by using ones browser. What would be the benefit? Malware usually access the url directly - no need to search for the page as it might raise an unnecessary alarm. – mnmnc – 2012-07-26T14:29:02.493

1Viruses often have no real benefit for the writer these days. They are written simply to show that they can be. – EBGreen – 2012-07-26T14:30:41.527

2@EBGreen: Quite the opposite. Gone are the olden days when people wrote viruses to show off; most malware these days aims for commercial gain - be it ad popups, clickjacking, identity theft, ransom, corporate espionage or something else. Perhaps those searches might have been inserted by malware trying to promote some shady site? – Piskvor left the building – 2012-07-26T14:55:12.993

2Either way, stating that it is unlikely to be a virus just because AV is installed is faulty logic in my experience. Having said that, in my opinion, I would rank virus below the likelihood of someone actually doing those searches. – EBGreen – 2012-07-26T15:00:51.237

@EBGreen - Which is the exact reason this answer should be voted down. Having security software only tells you one thing, your not infected with known infections, which is the simplest to solve. – Ramhound – 2012-07-26T15:16:56.040

@EBGreen I'd love to hear the logic behind your reasoning that someone did the search. I can't imagine someone coming in and executing a group of searches like that in a row but never going to a website referred to by any of the searches--I'm trying to imagine a scenario, perhaps you could explain yours. I'd think that if you were to look for the simplest answer--well I'd have to bypass that one. – Bill K – 2012-07-27T15:58:26.260

So if I understand the situation, you are saying that the search terms are cached in the firefox start page which is actually google. In other words, they pop up in the search box when you start typing in search. However when you look at the browser history, you do not see any pages being opened that match the sort of things that you would expect the search to return. To me this sounds like someone that knows how to open the history and delete pages out of it. – EBGreen – 2012-07-27T16:18:43.817

Basically my logic is that there is not much reason for doing the searches unless you plan to do something with the result. So given that as a premise, I would take the next step that something was actually done with the result. This means that if it were a virus, the virus is also cleaning up the history after itself. If it were actually being done by a person, they are cleaning up the history after themselves. I just think it to be more likely that a person would care more about cleaning up the history than a virus. – EBGreen – 2012-07-27T16:21:27.120

I will add that if it were a virus,and that the purpose of the virus were to promote porn sites, I would expect the virus to already know the sites that it wanted to promote and not to be doing a web site for types of sites. – EBGreen – 2012-07-27T16:22:41.673

Here's the kicker as to why I think it's a virus or script and not human intervention-- the "pee porn" result I found months ago through Google History put the time and date of access at a time that my wife and I were verifiably both sitting side-by-side at our computers, most assuredly not searching for porn. This is absolutely incontrovertible fact. Fast forward to now when I'm seeing equally odd searches coming up on HER computer. I thought as well that someone is picking clean the history but it really doesn't add up; I would have found SOMETHING residual by now. – jstar – 2012-07-27T16:32:49.257

As to why this stuff is just being searched for and not accessed, I don't know, but my speculation is that the virus writer wants to check to see if their client site is prominently ranked when a user searches for particular keywords. – jstar – 2012-07-27T16:35:05.137

They could do that much easier from their own browser. – EBGreen – 2012-07-27T18:05:14.090

Either way, further discussion especially of speculation like this should probably be in chat. – EBGreen – 2012-07-27T18:07:42.883

Asked: 2012-07-26T14:07:18.460

Viewed: 13 772 times

Active: 2017-09-24T04:52:34.130