Google redirect virus, I can not remove it...

[Denvers Dawgs]

Ok so some how I got this google redirect virus (when clicking a link in google I get sent to a site other than the one I want.)

I've tried running spyware doctor, super anti-spyware, spybot, hitman pro, combofix, and nothing has worked? anyone know how to get rid of this very annoying virus/malware?

Ok so it seems everything is working now with IE, but I use Firefox, and the issue is still happening under firefox.

[johns0]

Check your user folders and see if another account has been created there,if that's the case reboot to safe mode and delete the bogus account and remove the startup entry in the registry.

[freebird73717]

have you tried malwarebytes?

run it from safe mode.

[area51reopened]

plus 1 for malwarebytes!

[area51reopened]

http://www.malwarebytes.org/

[Cornucopia]

The last couple of times one of my agency's PCs have gotten this, it's been piggybacked along with the Vundo virus, which is a bitch to get rid of. Not sure really which steps in the combination finally cleared them both up, but I used a combination of:

1. Booting to a BartPE/WindowsLive Boot CD/DVD rescue disc that has a whole bunch of utilities.
2. Ran through: EZPCFix (many tools), Spybot S&D, Avira+Avast AVs. Put a bunch of utilities onto C:\Documents & Settings\Administrator\Desktop.
3. Then boot to Safe Mode Administrator logon
4. Ran through: RKill, ComboFix, Rootkit Repeal, CCleaner, Malwarebytes MBAM, Spybot S&D, Hijack This, a few others. Made sure Spybot had chance to run in Boot mode.
5. Got rid of ALL temp directories, and checked all major sys folders for items with newest dates, renaming extension of suspect files if necessary (to .bad, or something).
6. If everything doesn't run fast and smoothly, and allow for tools like Spybot to stay resident, then go back to beginning and repeat, trying a few others as well.

If all you have is the redirect, this is overkill, but you may find out that you have more than you think...

Scott

[ranchhand]

..What cornucopia said...Look for Vundo. Rename Malwarebytes to DenverDawg123 (or whatever), move it to a new, randomly named directory and bury it under two layers of sub-directories. Many of these virii recognize names and prevent the .exe from running. You can also try running it from your thumb drive. I just had one that would shut down MB soon as it loaded, then would delete the MB executable file so that it had to be downloaded fresh again. Only problem was that it also hijacked the browser so that you could only go to certain websites, so you couldn't download it again. Then it set the Hosts file to read only so you couldn't edit it. I finally nailed it but would take too long to explain here.

[Denvers Dawgs]

Well last night whikle trying different fixes, my pc just started to reboot itself. Could get to safe mode at all. So had to reinstall from an acronis true image I had saved. So good news is google redirct is gone, bad news is I had to do some program updating, but not to bad. All is good again. Only lost a few e-mails and few unimportant files.

thanks for the replies

[freebird73717]

Aren't you glad you backed up?!!!

[Denvers Dawgs]

Always. Keep it all in a fire proof safe as well......Can't be to safe!!

[johns0]

Afoke_Frieser is a virus.

[DarrellS]

Afoke_Frieser is a virus.

I believe you are right.

[Hoser Rob]

Afoke_Frieser is a virus.

I believe you are right.

I think so too. If I wasn't in Linux right now I would have never clicked on any of those links.