Google Redirect Virus Keeps Returning

[ElectroBricks]

Hey guys!! I'm back!! Well my sister has a netbook. Right now it has the google redirect virus. After removing it came back again. I have searched and searched but I am unable to permanently remove it. So how can I remove it permanently? Thanks again!! You guys rock!!

 

[Maguscreed]

malwarebytes , but it has to be run in http://www.sevenforums.com/tutorials/69585-safe-mode.html with networking to be sure, and you have to do a full scan to make sure it gets every bit of it.
Malwarebytes : Malwarebytes Anti-Malware PRO removes malware including viruses, spyware, worms and trojans, plus it protects your computer

I say http://www.sevenforums.com/tutorials/69585-safe-mode.html with networking because you'll want to be able to update the virus database before scanning.

the free version should be adequate for this.

 

[ElectroBricks]

Already tried that...

I have already tried that before.

 

[Maguscreed]

Well it's a fairly simple thing so I don't think the failure is in the removal. I would guess the user is consistently doing something that is resulting in the infection.

 

[Qdos]

Sometimes downloading a third party toolbar is enough...

 

[C-11]

When I clean up a computer I'll run MBAM & SUPERAntiSpyware

Also, an online scan wouldn't hurt either. Choose one or more.

ESET :: Get a FREE Online Virus Scan

HouseCall - Free Online Virus Scan - Trend Micro USA

Free Online Virus Scan - Bitdefender Online Virus Scanner

 

[Saint Andrew]

Run all Anti-Virus and Malware tools you can get in Safe Mode with Networking. If that still doesn't remove anything, back up files and clean your Hard Drive. If you've got windows disk do a clean installation.

 

[Golden]

Hi,

I think you might have a "poisoined" DNC cache. Please try the following:

1. Open a new instance of NotePad, and copy and paste the text below exactly as shown into NotePad:

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Now save this as flush.bat on your Desktop.

2. Right-click on this bat file, and choose to run as administartor. It will automatically shut-down, and then reboot your PC. your PC.

After reboot, use as as normal and check to see if you still get re-direction.

Regards,
Golden

 

[Jacee]

Malwarebyte's FAQ - Malwarebytes Anti-Malware won't run or failed to resolve my issues - Malwarebytes Forum

 

[ElectroBricks]

Wow!

Thanks for all of your replies. I will try all of them. Thanks!

 

[GianniDPC]

Also try a Hitman scan: Home - SurfRight It's possible that it is a rootkit so do a scan with Hitman as it has a high detection rate in Rootkits etc ...

 

[DBone]

Don't forget about Comodo Cleaning Essentials |MG| Comodo Cleaning Essentials 2.4.225190.192 Download

 

[Layback Bear]

What browser are you using Google on?

 

[Maguscreed]

Okay whatever it is, assuming it is not a toolbar installation gone horribly wrong.
We've given him more than enough tools at this point.

Perhaps we are looking at this the wrong way.
Have you tried another web browser.
If it's a real hijack it will generally affect all of them.
Otherwise I'm thinking it might be time to start looking at internet explorer itself.
Exactly what is the nature of this redirect?
Is it just changing the homepage?
Or are we even possibly just talking about the default search engine being messed up.

 

[Layback Bear]

You are correct Maguscreed that is why I asked what browser is being used. Just giving us Google is not much to work with.

 

[ElectroBricks]

Sorry.

I will get back with you all friday. Sorry. And I will have some more info. Sorry about not giving you much to work with. You guys are awesome! Thanks for all of the replies.

 

[ElectroBricks]

Update and More Info

Hello! Thanks for all of the replies! Here are the questions you asked and the answers for them:
Q: Have you tried another web browser?
A: Yes they all redirect.
Q: Exactly what is the nature of this redirect?
A: After searching for something, any link google has redirects. So when you click on one it redirects to a different web page besides the link you going to visit.
Q: Is it just changing the homepage?
A: No, it redirects the search result links.
Q: Are we even possibly just talking about the default search engine being messed up?
A: No, the search.
Thanks Again!!

 

[Maguscreed]

sounds like you need tdsskiller from kapersky.

How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

If that doesn't work we'll need to look at the url association, a registry key, and the host file.

 

[Layback Bear]

So we all are not running around like a bunch of chickens with their heads cut off could give us a list of everything you have tried to remove this problem?
It would also be helpful if you filled in your specs completely.

 

[ElectroBricks]

More Info...

Sorry. I have tried tdsskiller and other simular things with/without safe mode, malaware bytes with/without safe mode, Norton AV(ant-virus) and Panda Cloud AV. System Specs of my sister's Asus EEE PC 1005HAB netbook are:
General Product Features
Intel ATOM 270/ 1.3M Camera
Display: 10.1" (1024 x 600 Resolution)
Hard Drive: 160GB Hard Drive
Operating System: Windows XP Home
Run Time: Up to 8.5 hours
Processor, Memory, and Motherboard
Hardware Platform: PC
Processor: 1.6 GHz Intel Atom
Number of Processors: 1
RAM: 1 MB
RAM Type: DDR2 SDRAM
Hard Drive
Size: 160 GB
Type: Serial ATA
Speed: 5400 rpm
Graphics and Display
Graphics Card: Graphics Media Accelerator950
Interface: Integrated
LCD Native Resolution: 1024 x 600
Ports and Connectivity
USB 2.0 Ports: 3
VGA Video Out Ports: 1
Cases and Expandability
Weight: 3.75 pounds
Power
Rated Charge (normal use): 4.5 hours
Wireless
Wireless Type: 802.11bgn