Google search redirect virus/malware

[weeblewobblez]

Does any body have a definite fix for this thing? This will redirect search results to phony websites after searching for popular websites like face book or youtube. you can type the URL and get there but if you use the search result from a search engine like Google or Yahoo it redirects. If you disable scripts you can stop it before you go to the phony site but i want to get rid of it. How does this thing work?

[RicheemxX]

Sure there are lots of definite fixes, a clean install for instance is a definite fix

Run hijack this and run it through the analyzer and remove all the nasties HijackThis Analyzer & Tutorial

Run Adaware, SpyBot S&D or Malwarebytes - don't use all of them at once personally I'd try MB first and see if it cleans the problem.

Run an Anti-virus program like AVG, AVAST, or AVira. Turn off system restore, boot to safe mode and remove anything bad that pops-up.

At any point during these scans you do get any bad results make a note of names and locations of the all the nasty files an/or redirects then if none of that works you can google for a possible fix.

[Taxmancometh]

Does any body have a definite fix for this thing? This will redirect search results to phony websites after searching for popular websites like face book or youtube. you can type the URL and get there but if you use the search result from a search engine like Google or Yahoo it redirects. If you disable scripts you can stop it before you go to the phony site but i want to get rid of it. How does this thing work?

Not sure about this one. There are lots and lots of ways to direct you to malicious redirects. If you use Firefox you can change the setting. Mine is 5. Would it help
? Probably not. But why would I want to be redirected 10 times as the default was? I could set it to 1 I guess. Need to try that and see what happens.

To change the setting you type about:config in the address bar (You will get a warning, click ok) in the search box type in redirect. Look for the string, "network.http.redirection-limit". Double click it and change. That's it.

I highly recommended Noscript. Can be cumbersome though and takes some getting used to. In the options you can allow top level domains by default. It is one of the greatest things ever invented for a browser bar none!

Couple more options in Firefox found in options/security are the "block reported attack sites", and "block reported web-forgeries. However, if your paranoid with cookies as I am and don't allow Google by default, with these options on you will discover Google's cookie anyway.

A PITA when it comes to logging into Youtube though because you need to accept a Google cookie. I do so temporally.


There is another addon for Firefox called Grease monkey and allows so called "user scripts" to be run. Some of these are made with security in mind and can help. Be advised that these are user scripts and may be malicious. One thing I do before installing a scrip is look at the source code. I browse through and see if there is something there that doesn't look right. Then using ctl+F for find I type the keyword "cookie". If this script has nothing to do with cookies and finds a reference to cookie, DO NOT INSTALL! It may be a way of nabbing cookies. Which means they nab account info. for banks, etc.


OpenDNS | Internet Navigation And Security has other safety measures. Check them out.

Just pay attention to the url at the bottom of the search result. Unless this is DNS poison attack.

Are you susetable? DNS Poisoning - a practical example

[skypedog]

Does any body have a definite fix for this thing? This will redirect search results to phony websites after searching for popular websites like face book or youtube. you can type the URL and get there but if you use the search result from a search engine like Google or Yahoo it redirects. If you disable scripts you can stop it before you go to the phony site but i want to get rid of it. How does this thing work?

I used Combo Fix and was able to get off one legitimate search process and almost instantly the redirect virus (seemingly) replicated and was back doing it's dirty work. Combo Fix found a driver file down in Windows system32 folder that was corrupted... ntfs.sys. I am stuck - none of the 'so called' virus products are smart enough. Duh!

[devndev]

Does any body have a definite fix for this thing? This will redirect search results to phony websites after searching for popular websites like face book or youtube. you can type the URL and get there but if you use the search result from a search engine like Google or Yahoo it redirects. If you disable scripts you can stop it before you go to the phony site but i want to get rid of it. How does this thing work?

Hey, I was affecredd by the ave.exe malware and was able to remove it after using many popular tools including mbam etc and with the help of forums like this. But I still had the issue of search redirecting and popups which none of those tools were detecting to remove. Finally I installed Hitman Pro adn BAMMMM it cleaned up in 3mins... So try Hitman Pro !!!!!! it rocks (atleast for now)

[sp33dit]

Hey, I was affecredd by the ave.exe malware and was able to remove it after using many popular tools including mbam etc and with the help of forums like this. But I still had the issue of search redirecting and popups which none of those tools were detecting to remove. Finally I installed Hitman Pro adn BAMMMM it cleaned up in 3mins... So try Hitman Pro !!!!!! it rocks (atleast for now)

Yes my son.

Restart in safe mode.
Download Hitman Pro - delete infections
Restart computer BACK INTO SAFE MODE
Rescan -
Restart into normal windows

Bish Bash Bosh. Love you man