239 replies to this topic

[CaptVeg]

Thanks very much for your clear and detailed instructions. I'd been battling this problem for three stress-filled days before looking on here for help, and your guide seems to have done the trick! A much appreciated service.

[soccermad]

Thank you so much for your very clear and detailed instructions - My google redirect issues are a thing of the past. I am already a devoted fan of your site!

[Frank G 929]

Thanks a bunch. I followed the steps and now the redirects are gone. Initially my printers were also gone, but a reboot solved that. I guess one of the removal programs stops some services. Just a head's up of the possibility for any other readers.

Edited by Frank G 929, 09 April 2010 - 01:16 PM.

[Rorschach112]

This tutorial has been updated, it should remove the latest google redirect infection.

[aa2239]

Hello, another hugely satisfied customer here.... thanks a million for this website in general and this guide in particular, it's so simple to follow and so effective. Problem solved, no more bloody redirects.

You are officially an Internet Superhero!!

Edited by aa2239, 19 May 2010 - 03:03 AM.

[littleholly]

I completed all these steps and it worked perfectly Just one thing.. I have no sound in my Safari browser for any type of video, youtube, google etc.
Something I did wrong? Or a plug in missing maybe?

[Rorschach112]

did this happen when you got infected or after the fix ? Or has it been there for a while ?

[Bez2000]

Hi Guys

I have tried this method and nothing has been resolved. The redirect only occurs in IE google toolbar. It displays google results but when clicking the link it briefly goes to www.gaf417sa11i.com followed by random characters. Then I am directed to random sites. The only thing I have found out about this domain is that it was registered on 17th or 18th May 2010. Any help woould be greatly appreciated.

[Rorschach112]

Please go to the malware forum and follow the instructions at the top....Especially the CLICK HERE.

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post an OTListIt log in THAT forum.

[littleholly]

This happened after the fix, it was working perfectly before.

[Rorschach112]

can you post the tdsskiller log here, it should be in C:\

[littleholly]

removed log

Edited by Rorschach112, 22 May 2010 - 09:43 AM.

[Rorschach112]

does this fix it

Backup Your Registry with ERUNT

• Please use the following link and scroll down to ERUNT and download it.
  http://aumha.org/freeware/freeware.php
• For version with the Installer:
  Use the setup program to install ERUNT on your computer
• For the zipped version:
  Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe



How To Fix:

• Go to Start and select Run and type regedit to open the Registry Editor.
• Navigate to the following key by using the + to expand the folders: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
• Now right-click on the heading Drivers32 and select New -> String Value
• Call this new String Value wavemapper.
• Now double-click the wavemapper entry you just created and for the Value field, type in msacm32.drv and click OK.
• Close the Registry Editor and try watching a video on youtube again. (You might have to reboot your PC)

[littleholly]

I can get as far as making the string value, but when it comes to renaming it wavemapper, this message comes up : The Registry Editor cannot rename New Value#1. The specified value name already exists. Type another name and try again.

I tried different names but this error message still comes up.

[Rorschach112]

going to send you over to the tech guys to fix this

make a topic here

http://www.geekstogo...dows-7-f79.html

explain your problem, tell them I sent you over and that you had a patched C:\Windows\system32\DRIVERS\tdx.sys file


they should be able to fix this problem