1. Welcome to Tacoma World!

    You are currently viewing as a guest! To get full-access, you need to register for a FREE account.

    As a registered member, you’ll be able to:
    • Participate in all Tacoma discussion topics
    • Communicate privately with other Tacoma owners from around the world
    • Post your own photos in our Members Gallery
    • Access all special features of the site

Google Redirect virus

Discussion in 'Technology' started by macgyver, Mar 21, 2012.

  1. macgyver

    macgyver [OP] Well-Known Member

    Joined:
    Aug 14, 2009
    Member:
    #21173
    Messages:
    3,607
    Gender:
    Male
    First Name:
    Brad
    Canton, GA
    Vehicle:
    '13 Tundra double cab SR5 4x4
    Hey guys,

    My home desktop has been infected with a google redirect virus in the last week or so that I can't seem to get rid of. The last 3 night's I've been trying to get rid of it and can't.

    Essentially when I do a google search and click on the returned links, it re-directs me to random pages. Very annoying.

    So far I've run:
    AVG (My primary anti-virus)
    CCleaner,
    Adaware,
    Spybot S&D,
    Malwarebytes (3 times),
    TDSS Killer (twice),
    Combofix (twice),
    Norton fixTDss,
    Minitoolbox (I think that's the name),
    and a few others..honestly, I've lost count at this point. None of them have fixed it.

    I'm tempted to just dump my pictures and music on my networked external hard drive and go buy a new laptop tonight (I've been needing a new one anyways). Supposedly it doesn't affect pictures, documents, music, etc so I should be ok moving those. It only affects drivers and system files.

    It's probably time to ditch the desktop anyways...it's an old Dell with a Pentium 4 processor, 1G ram, and a 60G hard drive, running XP. But it works great for what I use it for up until I got the virus. I only use it for the internet, listening to music, and excel spreadsheets for my business.

    Any ideas on how to get rid of this thing before I give up? I've been reading posts on bleepingcomputer.com and various tutorials I've googled and nothing has worked yet. It keeps coming back. GRRRRRR It's so frustrating. :mad:
     
  2. STLTaco09

    STLTaco09 Well-Known Member

    Joined:
    Dec 4, 2008
    Member:
    #11281
    Messages:
    361
    Gender:
    Male
    5100's all around, fronts at 1.75". TSB leaf pack + Toytec TSB AAL
    SuperAntiSpyware, but if those you already listed didn't clean it, I dont have high hopes in general.
     
  3. Aw9d

    Aw9d That one guy

    Joined:
    Nov 7, 2011
    Member:
    #66635
    Messages:
    11,501
    Gender:
    Male
    You need to boot into safe mode and run these or boot up in diagnostic mode.

    start-run-msconfig
    choose diagnostic mode.. this will only load Microsoft services. Then do your run with antvirus.

    People just run these which is great and all, but if its a service, it won't try and stop it to remove it. So you need to have all non-essential services stopped.
     
  4. macgyver

    macgyver [OP] Well-Known Member

    Joined:
    Aug 14, 2009
    Member:
    #21173
    Messages:
    3,607
    Gender:
    Male
    First Name:
    Brad
    Canton, GA
    Vehicle:
    '13 Tundra double cab SR5 4x4
    I don't use the desktop for that...

    Either my sister or my girlfriend are probably the culprits. I am very very cautious about what I download and the links I click on. The is the first virus I've had on this computer.
     
  5. macgyver

    macgyver [OP] Well-Known Member

    Joined:
    Aug 14, 2009
    Member:
    #21173
    Messages:
    3,607
    Gender:
    Male
    First Name:
    Brad
    Canton, GA
    Vehicle:
    '13 Tundra double cab SR5 4x4

    I've tried that already though... I've run a few of them in Safe Mode (No networking)
     
  6. BERTHDZ

    BERTHDZ KF5TUQ

    Joined:
    Feb 28, 2011
    Member:
    #52059
    Messages:
    305
    Gender:
    Male
    First Name:
    Bert
    Pharr, TX - RGV
    Vehicle:
    02 v6 SR5 TRD Off Road
    3" Body Lift, Fabtech 6" Lift, XD Series 17x9" Revolver Rims, 35x12.50r17 Nitto Trail Grapplers
    slave the drive if you can to another computer and do a full scan using Malwarebytes
     
  7. arrrghhh

    arrrghhh Well-Known Member

    Joined:
    Jan 19, 2009
    Member:
    #12748
    Messages:
    2,072
    Gender:
    Male
    Denver, CO
    Vehicle:
    09 TRD Off-Road
    Custom Front Bumper, Smittybilt XRC-8, 3" OME lift, 33" Falken A/T tires
    Malwarebytes is good.

    I've had this same virus, and the ONLY thing that removed it was ComboFix...
     
  8. jeremy_283

    jeremy_283 Super Member

    Joined:
    Dec 14, 2008
    Member:
    #11569
    Messages:
    1,417
    Vehicle:
    08 TRD Offroad Access Cab 4x4 Auto 4.0L
    Hella Rallye 4000 Cornering Lights PIAA 510 Fog Lights All Pro Front Bumper All Pro Rear Bumper All Pro Transfer Case Skid All Pro IFS Skid All Pro Rock Sliders All Pro High Clearance Hitch OME Dakar Leaf Springs OME Rear Shocks OME Front Shocks OME 885 Front Coils Wet Okole Seat Covers WeatherTech Floor Liners Sony Head Unit JL XD600/1 Amp 2 JL Audio 10” Subwoofers Custom Subwoofer Enclosure Kenwood Front Speakers Sony Rear Speakers Sound Deadening Mats LED Interior Lighting Pop N’ Lock Tailgate Lock Viper Alarm System Extra D-Rings In Truck Bed Maglite Seat Mount Disable Seatbelt Chime Rear Differential Breather Relocation Hi-Lift Bed Mount Flexible Front Mud Flaps 110v Inverter Always At 400w ABS Kill Switch Locking Center Console Removed Sway Bar
    Have you tried Googling the answer? :rofl:
     
  9. macgyver

    macgyver [OP] Well-Known Member

    Joined:
    Aug 14, 2009
    Member:
    #21173
    Messages:
    3,607
    Gender:
    Male
    First Name:
    Brad
    Canton, GA
    Vehicle:
    '13 Tundra double cab SR5 4x4
    I don't have another computer to try that with other than my old laptop. :( Good idea though. Maybe my next door neighbor has one I can try that with. He's a computer programmer by profession.
     
  10. macgyver

    macgyver [OP] Well-Known Member

    Joined:
    Aug 14, 2009
    Member:
    #21173
    Messages:
    3,607
    Gender:
    Male
    First Name:
    Brad
    Canton, GA
    Vehicle:
    '13 Tundra double cab SR5 4x4
    I've run combofix twice now... :( No luck. Is it possible to run combofix in safe mode? When I booted in safe mode, I didn't see it.
     
  11. arrrghhh

    arrrghhh Well-Known Member

    Joined:
    Jan 19, 2009
    Member:
    #12748
    Messages:
    2,072
    Gender:
    Male
    Denver, CO
    Vehicle:
    09 TRD Off-Road
    Custom Front Bumper, Smittybilt XRC-8, 3" OME lift, 33" Falken A/T tires
    Crap. I'll look around, I swear that was the way I fixed it.

    I *think* you can run it in safe mode... make sure you do safe mode w/networking.

    Edit - I forgot, this is a rootkit. You need something like TDSSKiller. IIRC, TDSSKiller got it no problemo. Either way, you might want to consider a complete wipe of the OS & restore of your OS and all your applications. A pain, but as with any virus/malware, there's always the question of "did I really get it all...?" - and unfortunately there's no way to know for sure.

    http://pctechnotes.com/how-to-easily-remove-google-redirect-virus/
     
  12. Aw9d

    Aw9d That one guy

    Joined:
    Nov 7, 2011
    Member:
    #66635
    Messages:
    11,501
    Gender:
    Male
    Did you try diagnostic mode? A lot of AV won't run right in safe mode.
     
  13. elmo7

    elmo7 Easily Replaceable Member

    Joined:
    Aug 11, 2011
    Member:
    #61553
    Messages:
    712
    Gender:
    Male
    SC
    Vehicle:
    07 DC TRD OR 4x4
    Copy data off and boot from the Install/restore disk and start fresh and clean. Gotta be easier than loading and running a bunch of stuff that doesn't clean it up. You benefit from that too performance-wise.

    After that, create users on the PC - yourself and Others. Give the Others piddly rights so they can't install crap.
     
  14. arrrghhh

    arrrghhh Well-Known Member

    Joined:
    Jan 19, 2009
    Member:
    #12748
    Messages:
    2,072
    Gender:
    Male
    Denver, CO
    Vehicle:
    09 TRD Off-Road
    Custom Front Bumper, Smittybilt XRC-8, 3" OME lift, 33" Falken A/T tires
    Never a bad idea.

    Or Linux - have a dual-boot setup just for stupid people that use your computer. This way, no chance of viruses when others are using it :D.

    Seriously tho, rootkits are bad news. TDSSKiller should get rid of the actual Google redirect issue... but like I and others have said... pillaging and starting over is sometimes easier & quicker.
     
  15. macgyver

    macgyver [OP] Well-Known Member

    Joined:
    Aug 14, 2009
    Member:
    #21173
    Messages:
    3,607
    Gender:
    Male
    First Name:
    Brad
    Canton, GA
    Vehicle:
    '13 Tundra double cab SR5 4x4
    I don't know where my windows disk is lol. I think it's buried in a cabinet somewhere. :( But that was going to be my last resort.
     
  16. Derpy Derek

    Derpy Derek Derp

    Joined:
    May 10, 2010
    Member:
    #36868
    Messages:
    4,885
    Gender:
    Male
    First Name:
    Derek
    Lindale, TX
    Vehicle:
    2012 TRD Sport 4x4 DCSB
    Stow-away roof rack, Entune navigation, Aero Turbine 2525 muffler, Tan Softopper.
    Take this as a sign that the computer gods are telling you to ditch the dell :D
     
  17. macgyver

    macgyver [OP] Well-Known Member

    Joined:
    Aug 14, 2009
    Member:
    #21173
    Messages:
    3,607
    Gender:
    Male
    First Name:
    Brad
    Canton, GA
    Vehicle:
    '13 Tundra double cab SR5 4x4
    TDSS Killer didn't work :( It did find a few things but when I re-booted it was back.
     
  18. LBtaco

    LBtaco Thread killer

    Joined:
    Jan 23, 2009
    Member:
    #12893
    Messages:
    1,250
    Gender:
    Male
    Long Beach , CA
    Vehicle:
    15 Nissan Leaf
    Jetsons mod

    This is a good plan.
    Move your files to the old laptop and just restore the PC if you have the disk(or if it has the recovery partition)
    you'll be up and running in a few hours
     
  19. elmo7

    elmo7 Easily Replaceable Member

    Joined:
    Aug 11, 2011
    Member:
    #61553
    Messages:
    712
    Gender:
    Male
    SC
    Vehicle:
    07 DC TRD OR 4x4
    Dig that thing out! You'll have a fresh defragged HDD in 1 hr! Reinstall a couple of apps and reload your data - done!
     
  20. LBtaco

    LBtaco Thread killer

    Joined:
    Jan 23, 2009
    Member:
    #12893
    Messages:
    1,250
    Gender:
    Male
    Long Beach , CA
    Vehicle:
    15 Nissan Leaf
    Jetsons mod
    or borrow or d/l the version of Windoze you need
    just use your cd-key usually on the sticker on your PC
     
To Top