Google Redirect Virus - HELP!!!

tripled

Open C:\WINDOWS\system32\drivers\etc\hosts in notepad and see what is in there.

babybug

System restore has fixed it!!!! Yay!!

Thank you so much for your help - you're my hero!!!

Browntoa

I'd run malwarebytes to be sure

after a few days , if you remain clean , purge your restore points as the newer ones will hold the infection

http://support.microsoft.com/kb/310405

turning it off ,then back on will remove them all , then make sure you set a manual restore point straight away

still not sure what this one was

think you were lucky that sytem restore saved your skin

babybug

Running mbam now. Will also follow the rest of your advice

Thank you so much for helping out, I really appreciate it.

Reluctant_spender

Damn - I have just found a tool that will clear redirects. Yes it is a relatively new too.

Browntoa

too late, did it the old fashioned way !! lol

(hopefully)

MrsChips

Browntoa - I need your help please.

I also have the same problem with the Google Re-direct Virus which has resulted in my Paypal account being hacked so I need a fix asap.

I have tried following the advice on this thread... downloaded Malware, Spy bot, Search and Destroy etc but we are still redirected when using both IE and Firefox. Can you help please?

I've just done the C:\WINDOWS\system32\drivers\etc\hosts search and its come up with loads of strange sites, mostly adware and XRated sites and lots from Italy - What are these and how can I get rid of them?

P.S. You deserve a Big Shiny Medal for all your help on these Boards! :T

thomas01155

Spybot locks the host file you can delete them once you have changed the settings on it. A lot of the sites may of been added by spybot to stop you visiting them.

Open Spybot Press mode at the top and select advanced. Then go to tools on the left hand side and go to IE tweaks and untick Lock host file read-only protection against hijackers. Please start a new thread as it will get confusing.

MrsChips

Thanks Thomas - I've done that in Spybot and started a New thread to avoid confusion - I've linked to the new thead if you want to add more info.