Problem -My Google Links Being Redirected

[nekokoneko]

Hi guys,
I need some help. Just recently, I notice that my google search links is redirecting me to other pages. I'm not sure what is going on but how do I fix this problem. I downloaded and install Malwarebytes anti-malware program and scanned my system. It did found some problems and remove them but still founding my search link redirecting me to web pages that I didn't want. How can this problem be solve?

Any help is appreciated.

[MyOdessa]

Usually problem is with your ISP running scrip re-directing your search engine. Call your ISP and complain. Try google search running your ISP name and re-direct. Also check http://www.dslreports.com/ regarding your ISP.

[Cokebottle]

You can cut and paste the links directly.
If you have what I had, it's a combination of the TDSS rootkit.
You'll need TDSSKILLER to remove it... it commonly evades detection.

I also had the Yontoo Pagerage search engine toolbar installed as a result of the virus.

Safe mode.
Command line AVG virus scan.
MalwareBytes scan.

Took me close to 10 hours to clean the machine.
I got it from a link that was posted on Calguns. I got the machine running well enough to inform Kest and the thread was deleted, then I got back to cleaning the machine.

[MrBlazito]

you can also try hitman pro ... google it.

I've had exactly the same problem. It was a trojan. all the big time anti-virus programs couldn't detect the trojan. I was able to detect it and clean it with hitman pro and the re-directing stopped.

[johnthomas]

Go to advanced search, you can set it up. Maybe you did and it is doing what you told it to do.

[KaHuNaZ]

man, those google redirects can be hard to get rid of. Ive removed several successfuly, but I couldnt get rid of the one I got most recently. My motherboard also failed recently, so I never got to find it.

[nekokoneko]

Tried google verizon fios and redirect but its not the same redirecting pages I'm getting.
Tried tdsskiller. It didn't pick up any threat.
Tried hitman pro 3.5. Yes!!! it picked up dxdiag32.exe which it claims to be a threat. Trojan was deleted...... No!!!! still getting sent to these weird site.
Tried checking the advanced search setting.... didn't see much

Thanks for input guys...... danged have to copy and paste just to be sure

[nekokoneko]

Son of a... it copys the redirect link!!!
what the hell is this? Theres a IP address number in it.

http://64.111.211.171/c.php?s=eNotk1kPqkgQhX8QifZC0_BwH1AEcWFffZmwtbKKqKiEHz_MzaQeTlKnUknl1FfNUESEnxECcD57u8n4_PkzgxWAAvor4rw4EAgIoEWwOGda805-m6YI_Wu-PzRx5LwuIQFzQZCQIJGBHOMMAB4yCQqsgBAixkSB_wdRzAuCAAtGBZpnBUaSyBPAYJHyPKNkRvwM58K4G1NWuPdalmVju0bOq9r9nCfM7dC2d6p2ux1Youl1HV5l1gld8aaj1l--A9f5UgIjaDkqM11PXV8eExc4l_066RHs8fpkgFrpyoAsF3CmTqUn5qaQULf1b_RirOWtUN-UsHfLb5dzr42LJ3m49bGWH2zWaBMDPcg-nu4A9eg9KOBD1e68ID6rDg_qrE739jo30SujQqWqKHTa6ckGrtFOx61_PLcGRZ9yrZee99Uc6zgpn1jJaXvXJUFJxOTAW5teU24_5_dTrtH7ZRVa8ky-at6rKGr2lfpQHU6bjp822IDSyk-GCdwRPbmfiq7NQwymJjPc20MzAqyxXt_VvsFJWh3S-uPrXVkFu1e8kR4S_lF9sqOtuhV2G3J6T9Wub0BLtT1XvL-qwfIHuoNKG5c-yCOzqwK3BLGQiHK9dy29_HlGdeY-Vnsl_uVRg23khmW_vlqyA6oM8MAICung9NMo17Z8V65vZNu42Lhrb69Ju1YgV_GJikc0MClwoqNlMqxm-KD3wcbboIJc6gkfxhG9sDG8FPUZDulGuglmSNM31K37tTcVaU-AGauBmSTCe3y90-94cB4lyfyw4nG0BEYy15Ij-z5d-r2hKtlvUvICPHHg5_EDyH0Gt-XQfdphOGHskH2jdZdnFIvurSb2diSS04xs_Pqi7yd4-qaydhqognfG2TwM5_pNuXhNL6lT2As0kOIVISuIVwiCeab8ioAVhHQFwYLSPKPZawOcLf-btfCWhkGd_UiVIrDw9rdmPMdt0MSdsUB1qJLt_y6hBeGTZUueISwJAuIllkpSjkUxTwpWzFmSE5YWKcao-G-GUYgIQBLFgM_STPwXvo49ig

[ojisan]

http://www.superantispyware.com/

Download the free file on another PC and burn a disc.
Start your PC and download / save the SASW from the disc.
A nasty virus will tell you the download failed, but it actually went through fine.
Shut down your PC and restart in safe mode (F8).
Run the SASW program (it may take a couple hours + ).
See how the PC works when done.
You may want to try running other anti-malware programs if this one does not fully clear up the problem.
The SASW is very powerful and will need to be removed before you try running another anti-malware program.

I'm no computer guy, just a lowly "user".
YMMV and good luck!

[MrBlazito]

Tried google verizon fios and redirect but its not the same redirecting pages I'm getting.
Tried tdsskiller. It didn't pick up any threat.
Tried hitman pro 3.5. Yes!!! it picked up dxdiag32.exe which it claims to be a threat. Trojan was deleted...... No!!!! still getting sent to these weird site.
Tried checking the advanced search setting.... didn't see much

Thanks for input guys...... danged have to copy and paste just to be sure

Did you happen to get the name of the trojan? You have the same exact problem I had. I also had one of my system files infected with a trojan. Fortunately for me Hitman Pro was able to delete it completely and the re-directing stopped.

dxdiag32.exe is part of directx. You can delete that file manually and see if that helps. Also scan with hitman pro again and see if it detects that same trojan again. post the name of the trojan here.

[Cokebottle]

dxdiag32.exe is part of directx. You can delete that file manually and see if that helps. Also scan with hitman pro again and see if it detects that same trojan again. post the name of the trojan here.

+1

Trojans will routinely "hide" in a dll file.
Upon reboot, they launch and install themselves in a random system executable.
svchost.exe is also a "popular" one for them to use because there are nearly always multiple copies of this program running when you open the task manager.... svchost will actually run the trojan without being infected itself. Task manager shows svchost, but it doesn't show the dll that it's running.

[nekokoneko]

I rescanned and nothing was detected. Probably just gonna reformat.

[redrex]

Are you getting the fake malware popup as well? We had that one go around the office.

You can get some good hints from this... http://www.youtube.com/watch?v=EX_C5hheRPE

The trick is that even if you kill off the malware, the redirect is still there and working. So you will need to find and clean that manually quite often.

[bender152]

I had the same thing. tdsskiller did not even detect it.

I used malwarebytes to get rid of it.

[HarrisonS004]

Try some kind of bootable virus scanner, thats how I always get rid of the bad viruses. Check out kaspersky "Rescue Disk". You can boot from a CD or USB drive and just run the virus protection instead of windows OS.