Help with a redirect virus, please?

7 Comments

1. Pulsar - says:

   July 26, 2011 at 06:24

   You have more likely than not got a Rootkit.

   A complete pain to get rid of.
   this generic attack on the infection should put things right.

   First

   click on Start > Run.

   Type in the following into the open box.

   devmgmt.msc

   then Click on OK.

   This will run Device Manager.

   In Device Manager,

   click on View > Show Hidden Devices.

   expand all the devices by clicking on the "Plus" sign.
   Now try to find

   TDSSserv.sys or clbdriver.sys or oUltraf or seneka.sys,
   right click on whatever one you found and select Disable.

   make sure that you do not select the Un-Install option
   otherwise infection will be back once you reboot your computer.

   if none of them are there do not worry,
   it could be something simpler but follow what comes next.

   you will have to enable view hidden folders in, folder options > view.

   Delete everything in the windows temp folder,
   C > Windows > Temp

   Delete all cookies,
   Delete all temporary internet files(not to be confused with windows temp files)
   these are best deleted via your internet browsers.
   it will save you messing about in the the hidden system files

   reset internet explorer,
   tools > internet options > Advanced tab > reset .

   Delete everything in the prefetch folder.
   C > Windows > Prefetch

   Delete the hosts file,
   C > Windows > System32 > drivers > etc > HOSTS

   A clean hosts file will be written by windows when you reboot later.
   Note: if you were using a custom Hosts file
   you will need to replace any of those entries yourself.

   Delete the flash cookies found in the macromedia, #Shared Objects folder.
   c > users > "your name" > App Data > Roaming > macromedia > Flash player > #Shared Objects

   delete everything you find in the #Shared Objects folder

   last lot to delete,
   navigate to
   c > users > "your name" > App Data > Local > Temp

   delete everything in the Temp folder.

   Run a full scan with this
   Sophos Anti-Rootkit : http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

   and remove everything suspicious it finds.

   Do not have any open windows and shut down all programs when you run it.

   Sophos Anti-Rootkit DOWNLOAD : https://secure.sophos.com/support/cleaners/sar_15_sfx.exe

   Then run a full scan with this and remove what it finds.

   Super anti spyware Pro : http://www.superantispyware.com/

   Super anti spyware Pro DOWNLOAD : http://downloads.superantispyware.com/downloads/SUPERAntiSpywarePro.exe
   this has a tool built in that can reset the URL prefix’s, USE IT.

   reset your router to default.

   download then run,Hitman pro : http://www.surfright.nl/en to mop up anything left.
   remove what ever it finds.

   your redirect virus will now be gone.

   .
2. numaan - says:

   July 26, 2011 at 06:24

   install a good anti-virus – trail version of Norton anti-virus 2011 and make a full system scan .you may find the way illogical but it works
   whatever the browser u are using uninstall it and then restart your computer install the browser again
   don’t do blind browsing ,always explorer safe sites-don’t open *****educational sites****
3. H_Dickory_Dock - says:

   July 26, 2011 at 06:24

   Sounds like you may be infected with the TDSS rootkit infection (AKA Google Redirect Virus) which usually cannot be detected with ordinary anti-virus/anti-spyware/anti-malware softwares. This crap is all over the internet the past few weeks.

   Info from BleepingComputer:
   http://www.bleepingcomputer.com/virus-removal/remove-tdss-tdl3-alureon-rootkit-using-tdsskiller

   Removal Tool from Kaspersky Labs:
   http://support.kaspersky.com/viruses/solutions?qid=208280684

   Note: Some variants of this infection will block access to the above sites.

   Note 2: There is a very new version of TDSS called TDL-4 which can be more difficult to remove.: If you suspect TDL-4 (Rootkit.MBR.TDSS), BitDefender now has the info and a free removal tool:
   http://www.bitdefender.com/news/bitdefender-releases-free-removal-tool-for-tdl4-2150.html
4. John - says:

   July 26, 2011 at 06:24

   Scan your computer with Hitman Pro or Combofix.
   http://www.surfright.nl/en/hitmanpro/
   http://www.bleepingcomputer.com/combofix/how-to-use-combofix

   More information about the redirect virus:

   http://deletemalware.blogspot.com/2010/02/remove-google-redirect-virus.html

   http://www.google.com/support/forum/p/Web%20Search/thread?tid=6df7e15519290612&hl=en

   http://ask.metafilter.com/100853/Oh-that-nasty-Google-Redirecting-Virus
5. Andrew - says:

   July 26, 2011 at 06:24

   I had the same problem a couple of months ago. Im not to sure but I think I used mallwarebytes to get rid of the problem.