Are you facing problems with your web browser getting redirected to unwanted websites and you don’t have any control? Is there too many pop-ups coming up? Are these redirects predominantly pointing towards an e-commerce site, porn, gambling sites? Chances are you might have a Google Redirect Virus.
Google redirect virus is one of the most annoying, dangerous and toughest infection ever released over internet. The virus may not be considered deadly as it is not going to crash your computer and make it useless. But it is more of an annoyance than deadly because of the unwanted redirects and pop ups and how frustrated it can make the users.
Google redirect virus not only redirects Google results, but also Yahoo and Bing search as well. This make it Yahoo Redirect Virus or Bing Redirect Virus. From time to time, malware coders modify their codes to create variations to escape easy detection by security software. Recent variations appeared such as Nginx Redirect Virus and Happili Redirect Virus etc. All these infections come under redirect virus, but variation in the codes and mode of attack.
According to a 2011 report, Google redirect virus have already infected 45,00,000 computers wide, out of which 1/3rd is from US. As of May 2016, the infection seems to have made a come back with an increase in number of reported infected computers.
A Quick Note from Author
My first experience with Google Redirect Virus was when working on a Symantec Project. Most security software’s fail to catch this infection as it is a rootkit level infection. So mostly, the only solution is manually removing the infected files from PC. It took a lot of trial and error to finally figure out an effective way to identify and get rid of this infection. The steps mentioned here are followed by virus removal professionals all over the world to remove these type of infections. In this article, I have done my best to explain the manual removal process. If followed properly, you will be able to remove the redirect virus. Windows 8 and 10 users might find it hard to remove the infection manually because of the changes made in OS architecture.
- Due to the highly technical nature, I did my best to explain all the steps with the help of a video tutorial which can be seen below.
- If you find the steps complicated or not working in your OS, as a last step you may opt for getting professional help using google redirect virus removal tool.
How to remove Google Redirect Virus
Google Redirect Virus can be removed mainly using two methods.
- Remove google redirect using software
The easiest way to get rid of Google Redirect Virus is by using the professional google redirect removal tool. Removal using software is quick and there is no question of human error in finding infected file.
- Remove google redirect manually
It is possible to remove this infection by manually removing the files responsible for redirect. You have all the necessary step by step instructions and video in this article. But don’t get me wrong. The manual steps might be a little difficult to follow due to its technical nature. Failure to follow the instructions properly or possibility of human error in identifying the infected file can render your efforts ineffective. The manual removal method is time consuming. As a virus removal technician, it took an average 40-50 minutes for me to do a thorough checking.
The troubleshooting steps and video is given below.
- Tools which are constantly updated for handling the latest variants of this infection. If one tool fails, you can try the other to remove the infection. Free access to their future updates. Guidance on how to use the tools also provided.
- Quick resolution so you can save time and prevent countless unproductive hours.
- A dedicated team providing 24/7 support within a certain time frame.
- Online service is cheaper. Professional services such as tech shop repairs and virus removal services charge may charge couple of 100$ for getting rid of this infection.
Google Redirect Virus Rating
Ease of Use
Value for Money
Watch Manual Removal Steps for Removing Google Redirect Virus
Troubleshooting steps for removing Google Redirect Virus manually
Unlike most of the infections, in case of Google Redirect Virus you will find only one or two files which is related to the infection. But if the infection is ignored initially, the number of infected files seems to increase over a period of time. So better get rid of the infection as soon as you find redirect problems. Follow the troubleshooting methods mentioned below to get rid of google redirect virus. There is also a video below.
1) Enable hidden files by opening folder options (start –>run –> control folders),under view tab
- enable show hidden files, folders and drives
- uncheck hide extensions for known file types
- uncheck hide protected operating system files
2) Open msconfig (start –>run –> msconfig)
- Click “Start” –> run –> msconfig)
- Go to “boot” tab if you are using Vista or Win 7. In case of XP, select “boot.ini” tab
- check bootlog
3) Restart computer
Restart computer for making sure that changes you made are implemented. (On restarting computer a file ntbttxt.log is created which is discussed later in troubleshooting steps)
4) Do a complete IE optimization
Read this article on how to do an Internet Explorer optimization. Internet explorer optimization is done to ensure that redirection is not as a result of problem with IE or corrupted internet settings. Even if you use a different browser other than Internet explorer, IE optimization is compulsory as IE settings acts as the basic settings for any web browser using windows operating system.
5) Open device manager (start –>run –> devmgmt.msc)
- Click “Start” –> run –> devmgmt.msc
- Click “view” tab on top. Select “show hidden devices”
- Look for “non-plug and play drivers”. Expand it to see entire list under option.
- Check if you have any entry TDSSserv.sys. Note down name carefully. Right click on entry and uninstall it. Don’t restart computer yet, cancel it. Continue troubleshooting without restarting.
6) Open registry (start –>run–>regedit). Take a backup of registry before making changes
- Click on edit –> find. Enter first few letters of infection name. In this case, I used TDSS and searched for any entries starting with those letters. Every time there is an entry starting with TDSS, it shows the entry on the left and value on right side.
- If there is just an entry, but no file location mentioned, then delete it directly. Continue searching for next entry with TDSS
- The next search took me to an entry which got details of file location on right which says C:\Windows\System32\TDSSmain.dll.You need to utilize this information. Open folder C:\Windows\System32, find and delete TDSSmain.dll mentioned here.
- Assume that you were not able to find file TDSSmain.dll inside C:\Windows\System32.This shows entry is super hidden. You need to remove file using command prompt. Just use command to remove it. del C:\Windows\System32\TDSSmain.dll
- Repeat same until all entries in registry starting with TDSS is removed. Make sure if those entries are pointing towards any file inside folder remove it either directly or by using command prompt.
Assume that you were not able to find TDSSserv.sys inside hidden devices under device manager, then go to Step 7.
7) Check ntbtlog.txt for corrupted file
By doing Step 2, a log file called ntbtlog.txt is generated inside C:\Windows. It’s a small text file containing lot of entries which might run to more than 100 pages if you take a printout. You need to scroll down slowly and check if you have any entry TDSSserv.sys which shows that there is an infection. Follow steps mentioned in Step 6.
In above mentioned case, I mentioned only about TDSSserv.sys, but there are other types of rootkits which do same damage. Let’s take case of 2 entries H8SRTnfvywoxwtx.sys and _VOIDaabmetnqbf.sys listed under device manager in my friends PC. The logic behind understanding if it is a dangerous file or not is mainly by their name. These name makes no sense and I don’t think any self respecting company will give a name like this to their files. Here, I used first few letters H8SRT and _VOID and did steps mentioned in Step 6 to remove infected file. (Please Note: H8SRTnfvywoxwtx.sys and _VOIDaabmetnqbf.sys are just an example. The corrupted files can come in any name, but it will be easy to recognize because of the long file name and presence of random numbers and alphabets in the name.)
Please try these steps at your own risk. steps mentioned above won’t crash your computer. But to be on the safer side, it is better to take a backup of important files and ensure that you have option to repair or re-install operating system using OS disk.
Some users might find troubleshooting mentioned here complicated. Let’s face it, infection itself is complicated and even the experts struggle in order to get rid of this infection.
You now have clear instructions including step by step video on how to get rid of google redirect virus. Also you know what to do if this didn’t work out. Take action immediately before the infection spreads to more files and render the PC unusable. Share this tutorial. It makes a huge difference to someone facing the same problem. Good Luck.