239 replies to this topic

[arsegon]

Just another big thanks to add to the plethora of accolades here. Recently lost my C: drive due to hardware failure. Had backups. Installed, partitioned and formatted a new disk I had laying about. Installed XP Pro (hate Vista and have not yet tried W7), SP3 and immediatley went to Mozilla to download and install FireFox. Also hate Windoze Exploiter.. Once Firefox was up I went to McAfee to login and restore my anti virus software.

Somewhere in this brief as possible on line process the machine got infected (probably by some Exploiter weakness)with the Google redirect problem. This drove me insane for a good three days. Found and followed Rorschach112's excellent instructions and it would appear the problem is now solved. No redirects in several hours of use and before it was happening every 10 or 15 minutes.

In my case the sites were random. Disappointing that MalwareBytes and McAfee did not detect and correct this seemingly common problem but from reading all these posts I see that this infection is well designed to avoid detection and removal. I am still not sure if TDSSKill fixed it or the combination of running OTM and GooredFix. I had tried GooredFix before with no success.

In any case, it is gone I think (I hope!) and good riddance. The delinquents that create these global nuisances really should think twice about such wasted talent and get a life.

Thanks to the generous volunteers at Geekstogo for this website and all that it does. Awesome work, awesome concise instructions and best of all, the solution works. Also thanks to Kaspersky labs for TDSSKiller script.

Thank you very much.

Edited by arsegon, 06 July 2010 - 12:21 PM.

[Vger]

I haven't posted back since the 28th of last month, but I can confirm that I have not had any recurrence of the problem since.

Vger

[EndersLegacy]

This was wonderful!!!! It fixed ALL my problems!!! THANK YOU!!!!!!

[wayneman50]

I tried all the steps outlined in the first post. I still have the redirect problem. I can also enter some web addresses directly and it will divert me - at the bottom of my screen, it reads: "Waiting for google-analytics.com...". It happens with yahoo, google, and bing. It happens with Explorer and Firefox. Can someone help me? Thanks.

Edited by wayneman50, 08 July 2010 - 06:27 PM.

[SweetTech]

I suggest you go to the Malware Forum and run all the steps located in the START HERE. These self-help tools will help you clean up 70% of problems on your own. If you are still having problems after doing the steps, then please post the requested logs in THAT forum. If you are unable to run and/or post the required logs, then post that in your initial post in the topic you create in that forum.


Best of Luck.

Cheers,
SweetTech.

[SomebodySaveMe]

Thank you so much! This seems to work against the Alureon.H problem!

[jerryscoins]

removed log. Post in the malware removal forum if you need additional help

Edited by Rorschach112, 13 July 2010 - 01:36 PM.

[MamaJen74]

I followed all the directions and am still having the redirect issues. TDSSkiller found nothing. I'm off to follow the "if you're still having a problem" links.

[mliou]

Thank you guys so much! Solved my problem for now, will post back if something else happens.

[Jonaldinho]

I discovered that my overnight Vipre scan threw up the following scan report:

So when I attempted to google the problems, it didn't take too long to establish that I had the Google redirect bug!

I went back to Vipre and deleted the quarantined risks, shut down and rebooted, only to find that the problem still exists.

Following this, I selected another search engine and found this very insightful thread - seems a lot of folk have found a quick cure to the problem here.

So, I followed the instructions, installed the TDSSKiller and ran a scan. This is what came up:

So, could it be that by deleting the original risks from Vipre quarantine before running TDSSKiller, I may have also removed the route which TDSSKiller requires to track down and 'kill' the trojan?

I've rerun the Vipre Deep Scan, but there's no sign of the risks in the scan reports, but the redirects are still happening across Google, Bing etc.

Hoping you might be able to help?

[Rorschach112]

Please go to the malware forum and follow the instructions at the top....Especially the CLICK HERE.

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post an OTListIt log in THAT forum.

[lynnelle]

I posted somewhere but cant seem to find my post I am new and I am having the google redirect problem. I tried EVERYTHING. Nothing seems to be working. Can someone help?

[riffle]

Hello,

Before discovering this site and tutorial, I tried to get rid of the virus using MalWareBytes. It quarantined some files, and asked me to reboot (in order to delete a file). My computer refused to boot up after, giving me a 'Fatal System Error'. I managed to boot my computer successfully by copying some files from the Windows XP CD. Now firefox and Internet explorer "stop working", prompting me to send an error report.

I was wondering: should i still follow the instructions that you've posted, and do i still have the virus?

Thank you very much in advance.

(and is this the right place to post this message? or should i have started a new thread?)

[Rorschach112]

Give the instructions a go

[Jonaldinho]

Please go to the malware forum and follow the instructions at the top....Especially the CLICK HERE.

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post an OTListIt log in THAT forum.

Hi Rorschach112 - thank you for your help. Much appreciated.

It's been a few days since I first reported my problem and and the upshot is that while following the instructions, the system crashed. I ended up with the machine freezing in 'shutting down' mode for several hours. When I returned to it I shut it down manually, by pressing the 'on' button and once I turned it on again, I tried to repeat the removal steps as shown but did not get as far second time round - the machine froze once again.

One more manual shut down and on restarting, the pc went into a loop of booting and rebooting continously, never getting past the black page with the Windows logo before going back to 'off', restarting and back into the loop once more.

So I've taken it to get it repaired where I bought it and have got it back tonight. But although I haven't lost anything, my mouse and keyboard are working sporadically, with most commands requiring two, three or four clicks on the mouse. The keyboard is missing letters when I type and the volume control does not respond.

Neither the mouse or keyboard are standard supply as I preferred wireless devices to the wired ones supplied. Batteries have been replaced in both devices and so that's not the answer.

I have rerun my Vipre and Malwarebytes scans again tonight with nothing found on either.

Has some part of these viruses remained in my system do you think?

Thanks again!