Google redirect virus

Re: Google redirect virus

One trick that's been 99% successful for me is to run the spyware scan/removal in safe mode (if you don't know what safe mode is please ask) and that usually removes the pesky ones. You can email my your hijack this log, or you can just paste it here http://www.hijackthis.de/ and it'll tell you what to remove 99% of the time.

Re: Google redirect virus

If you use "system restore" you may be able to restore your computer to a point before your guests arrived.

Re: Google redirect virus

Scroll through your Add/Remove Programs in the Control Panel and check and see if there is any suspicious programs listed in there.

Also, run Spyware Blaster, Spybot Search and Destroy, and Lavasoft Adaware.

Re: Google redirect virus

Don't use Internet Explorer. Simple and effective mechanism to ward off most of the little buggers.

-Christian

Re: Google redirect virus

Yup, simple as that. Some people do want to, though, but I think most just can't be bothered to change it. IE does nothing that the other browsers don't do at least as well.

Firefox seems to be the alternative most people go for, but personally I'm a huge fan of Opera, and can wholeheartedly recommend it. Definitely something to consider. Best security record of any of the top three by far, too.

Just a few remarks regarding google redirect virus:

it doesn't matter if you are using Internet Explorer, Mozilla Firefox or any other, trojan will be taking action on any of browsers.
Add/Remove Programs is helpless here, because trojan presence will not be noticed there.
It seems that http://www.computing.net/answers/security/google-redirect/26874.html helped tp remove the virus.

RE: Problems with google redirecting/language in searches/Google Deutschland

http://www.google.com/support/forum/p/Web+Search/thread?tid=6df7e15519290612&hl=en

by: stealthjunk
I had almost the exact same problem today and none of my anti-spyware programs (SpyBot, AdAware, MalwareBytes, Housecall) could fix it.  Fortunately, I found the solution on another board.  As a little bit of background, viruses sometimes will alter your "hosts" file, which is basically a file that controls the redirecting for your browsers (specifically, this file makes it faster for your computer to convert URLs into the relevant IP addresses by having a shortcut list of IP addresses instead of having to look them up when you type in the URL).

Anyway, enough background, here's what you need to do to fix:

(1) Click START > RUN > and type in "C:\windows\system32\drivers\etc\hosts"
(2) When prompted, open the HOSTS file in either Notepad or Wordpad
(3) Delete all the lines of IP addresses in the text document except for "127.0.0.1 localhost".

If you find several lines of IP numbers other than localhost in your hosts file, then this is almost definitely your problem and will be fixed right away.  If not, then this probably isn't the issue, but it's worth a look.

Let me know how it goes -- best of luck!
9 of 16 people found this answer helpful. Did you?
Yes

---------------------
stealthjunk's post on clearing the hosts file extra data worked for me to remove the "go to google deutschland" from the main google webpage.  i first exited all programs and web browsers, then i clicked start > run > type  cmd   (then press enter to get the command console), then type cd\windows\system32\drivers\etc  (then press enter), then type   edit hosts  (press enter), then scroll down and delete the extra junk except the localhost 127 line (there was like over 50 lines of other hosts in there), then press ALT-F for File then press S to save, then ALT-F then X to exit the editor, now type  exit  (to exit the cmd program).  Now just to be safe i restarted my computer and started my firefox browser and my google homepage was back to normal.  I didnt have to type any of this here, but, I live by the golden rule to do to others as I would want them to do to me, and I'd want someone to confirm how to get rid of that redirect problem, and they sure did, thanks guys!
PS: if you cannot find the hosts file, the virus probably made it hidden and read-only, to undo that, once u get into cd\windows\system32\drivers\etc folder, type this:  attrib -s -h -r -a hosts  (then press enter), now you can continue with cleaning up the hosts file, and remember it is not a Text file, there is no extension to it, just hosts  (not hosts.txt).
-------------
Brian Stusalitus
04/20/2010

I've flagged the post above to be checked out, but I caution anyone else from following that link from a first time poster on an ancient thread bump...

Also I'm pretty sure I flaged post #8 about 2 years ago too and it wasn't removed, so YMMV.  Post #9 looks very suspicious too.