How Did My Computer Become Infected with the Google Redirect Virus?
The Google Redirect Virus is really a category of rootkits that is
absolutely one of the most difficult pieces of malware to remove. It
hides from almost all antivirus, antispyware, and removal tools and
does not allow the user to visit many antispyware sites or download
removal tools. It redirects Google search results to a variety of sites
other than the true site is was supposed to show. Normally you won't
understand you have a virus until you try to search for something in
Google and you can't get to the sites you want. Instead you get popups,
miscellaneous sites promoting products, and everything else except for
the page you really wanted. In my particular case, Malwarebytes and
Combofix, two well known and very good malware cleaning tools showed no
infection at all. However the redirect was still present on the
computer.
How Do I Know I Have a Google Redirect Virus on My System?
Try to search Google for something and click on the various search
results that show up, if none of the results allow you to go to the
appropriate site, you are infected. Instead you'll
be redirected to sites like:
- icityfind.com
- scour.com
- fastsfind.com
- amusede.in
- 1freefiledownload.com
- find-quick-results.com
- bidvertiser.com
Can I Remove the Google Redirect manually?
Many sites on the net have various instructions for manually removing this rootkit. To be honest, none of these manual methods work. There are really only two products floating around the net that successfully remove this type of infection. One by Kaspersky Labs and one by Symantec. So, please follow the instructions below to download these tools and remove the Google Redirect Virus from your computer. Follow these steps in order to restore internet access, check your hosts file, and finally delete the rootkit.Fix Proxy Settings
1) Open Internet Options in the Control Panel or via Tools menu in Internet Explorer
2) Click on the Connections tab
3) Click on LAN Settings
4) Uncheck the "Use a Proxy Server for your LAN" setting. Especially if the address spot is blank.
5) Click OK
Check Hosts File
Follow the steps on my page about how to check or reset the Hosts FileRemove the Google Redirect Malware with TDSSKiller
Kaspersky Labs has created a removal tool called TDSSKiller to remove the Google Redirect Virus. Follow these steps to download and run it. In some cases, you may have to run it in Safe Mode with Networking to remove it.1) Download TDSSKiller, unzip it, and Save it to your desktop.
2) Double-click on TDSSKiller.exe to run. If the program does not run, you may have to rename it to something like explore.exe, 123.exe, or something else before running it. The virus is trying to block the program from running, so renaming it will in some cases allow it to run.
3) Click on the Start button to start a scan and allow it to completely run
4) Allow TDSSKiller to fix any issues it finds and reboot the computer afterward
5) After reboot, try Google and see if the redirect it gone.
For more detailed information on TDSSKiller visit the Kaspersky page
Extra Steps with FixTDSS.exe
In a few circumstances, I have been unable to run TDSSKiller even after renaming it. In these cases, I have turned to the other removal tool that works, FixTDSS by Symantec. Follow these steps to download and run it.1) Download the FixTDSS.exe tool from Symantec and save it to your desktop
2) Double-click on FixTDSS.exe and run it
3) Click Start to begin the process, and then allow the tool to completely run
4) Restart the computer when prompted
5) After reboot, the program will give you the results of the scan and cleaning.
6) Try Google and see if the redirect virus is gone.
For more detailed information on FixTDSS visit the Symantec page.
Run a Thorough Virus Scan
Finally, as an extra precaution, scan your computer with online virus scanner like Housecall, BitDefender, or eTrust or download and install an antivirus program and run a complete scan. A list of online scanners is below, some however will only scan but not remove issues.
Online Virus Checkers
Trend Micro Housecall - will scan and remove threats
BitDefender Scan Online - will scan and remove threats
ESet (NOD32) Online Scanner
Kaspersky Online Scan - will scan and remove threats
Panda Activescan - appears to only scan for but not remove threats
McAfee FreeScan - appears to only scan for but not remove threats
eTrust Antivirus Web Scanner - will scan and remove threats
Symantec Security Check - will scan and remove threats
Dr.Web Online Check - user can upload and test for threats on particular files
Trojan Scanner
TrojanScan by WindowsSecurity.com
Spyware Scanners
Malwarebytes AntiMalware
Super AntiSpyware
Spybot Search and Destroy
Congratulations! Your computer should be free of the Google Redirect Virus.
Written by Mark Hasting
