Google Redirect Virus – Remove Manually(latest update)

Anup Raman, the man behind A Technical Journey is a tech enthusiast, blogger and trainer with 10+ yrs of experience in IT related services. Expert in operating systems and virus removal techniques. Author of Virus Removal Secrets Revealed, a guide on removing computer infections manually without using any security software. Love writing articles on technical issues and giving honest product reviews.

Google redirect virus is one of the most annoying, dangerous and one of the toughest infection ever released on the internet. The virus redirect google search results or normal website links to a malicious webpage which is either related to some sort of advertisement or a page which enable hackers to gather information from you. Apart from google redirect virus, it is also called yahoo redirect virus or bing redirect virus, based on which search engine is infected. In real, all these are same. Not much computer users know that Google redirect virus is not a virus, but in fact a rootkit. Rootkit infections unlike virus, spyware or trojan infections are very difficult to remove. In very rare cases, google redirect virus rootkit is seen associated with Trojans which makes it more deadly. According to a 2011 report, Google redirect virus have already infected 45,00,000 computers worldwide, out of which 1/3rd is from US.

Google redirect virus is tough to remove because of its ability to hide deep inside the operating system and also remove traces and footprints on how it got inside the computer. As of today, there is not even a single security software in the market which can provide you 100% protection from this infection. That explains, how you got infected even with a security software installed for virus protection. This article explains how to handpick and remove google redirect virus. For a virus removal technician, this is the most effective method ever developed and the one used by technicians working for some of the biggest names in security software industry. So most probably, if you contact them for removing google redirect virus, they might try the same manual steps in your computer.

To remove google redirect virus, there are 2 ways to approach it

• Try tools available online or go for a professional tool

Lots of free tools are available, but none of them are good enough to ensure you 100% solution to this problem. Most probably, you might have already tried couple of them. Biggest disadvantage of a free tool is that it is hard on the operating system and might corrupt files. This might cause your computer to crash completely or end up with operating system not loading inside your computer.In some of my early articles, I did mention some free tools for this infection, but then I stopped recommending once I started getting more reports of computer crash  using these tools.  So take precautions before you try these tools. Better be safe than sorry.

Professional tools on the other hand are more responsible, effective and save you lot of time because of the easiness to use the tools. If I am looking for a quick solution and don’t want to get my hands dirty, this will be my choice. For getting professional help which offer 60 day money back guarantee, click here.

• Try to remove google redirect virus manually

This is my most favored method. It might be time consuming and some of you might find it hard to follow the instructions cos of its technical nature. For those who dont mind getting their hands dirty, you may try the steps mentioned here.  This method is very effective, but failure to follow the instructions properly or possibility of human made error can render your efforts ineffective. To make it easier for everybody to follow, I have created a step by step video explaining the details. It shows the same exact steps used by virus removal experts to remove virus infection manually. You can find the video towards the end of this post.

Troubleshooting steps for removing Google Redirect Virus manually

 1) Enable hidden files by opening folder options (start –>run –> control folders),under view tab

• enable show hidden files, folders and drives
• uncheck hide extensions for known file types
• uncheck hide protected operating system files

2) Open msconfig (start –>run –> msconfig)

• Click “Start” –>  run –> msconfig)
• Go to “boot” tab if you are using Vista or Win 7. In case of XP, select “boot.ini” tab
• check bootlog

3) Restart computer

Restart computer for making sure that the changes you made are implemented. (On restarting the computer a file ntbttxt.log is created which is discussed later in the troubleshooting steps)

4) Do a complete IE optimization

Read this article on how to do an Internet Explorer optimization. Internet explorer optimization is done to ensure that the redirection is not as a result of some basic change in IE settings. Even if you use a different browser other than IE, still you need to do follow IE optimization as IE settings are the basic settings for web browsers in windows operating system.

5) Open device manager (start –>run –> devmgmt.msc)

• Click “Start” –>  run –> devmgmt.msc
• Click “view” tab on the top. Select “show hidden devices”
• Look for “non-plug and play drivers”. Expand it to see the entire list under the option.
• Check if you have any entry TDSSserv.sys. Note down the name carefully. Right click on the entry and uninstall it. Don’t restart computer yet, cancel it. Continue troubleshooting without restarting.
  

6) Open the registry (start –>run–>regedit). Take a backup of registry before making changes

• Click on edit –> find. Enter the first few letters of the infection name. In this case, I used TDSS and searched for any entries starting with those letters. Every time there is an entry starting with TDSS, it shows the entry and the value on the right side.
• If there is just an entry, but no file location mentioned, then delete it directly. Continue searching for the next entry with TDSS
• The next search took me to an entry which got details of file location on the right which says C:\Windows\System32\TDSSmain.dll.You need to utilize this information. Open folder C:\Windows\System32, find and delete TDSSmain.dll mentioned here.
• Assume that you were not able to find the file TDSSmain.dll inside C:\Windows\System32.This shows the entry is super hidden. You need to remove the file using command prompt. Just use the command to remove it. del C:\Windows\System32\TDSSmain.dll
• Repeat the same until all entries in registry starting with TDSS is removed. Make sure if those entries are pointing towards any file inside folder remove it either directly or by using command prompt.

Assume that you were not able to find TDSSserv.sys inside hidden devices under device manager, then go to Step 7.

7) Check ntbtlog.txt for corrupted file

By doing Step 2, a log file called ntbtlog.txt is generated inside C:\Windows. It’s a small text file containing lot of entries which might run to more than 100 pages if you take a printout. You need to scroll down slowly and check if you have any entry TDSSserv.sys which shows that there is an infection. Follow the steps mentioned in Step 6.

 In the above mentioned case, I mentioned only about TDSSserv.sys, but there are other types of rootkits which do the same damage. Let’s take the case of 2 entries H8SRTnfvywoxwtx.sys and _VOIDaabmetnqbf.sys listed under device manager in my friends PC. The logic behind understanding if it is a dangerous file or not is mainly by their name. The name makes no sense and I don’t think any self respecting company will give a name like this to their files. Here, I used the first few letters H8SRT and _VOID and did the steps mentioned in Step 6 to remove the infected file.

Please try these steps at your own risk. The steps mentioned above won’t crash your computer. But to be on the safer side, it is better to take a backup of important files and ensure that you have the option to repair or re-install operating system using the OS disk.

Some users might find the troubleshooting mentioned here complicated. Let’s face it, the infection itself is complicated and even experts in this field have to struggle in order to get rid of the infection.

In case the above methods fail and if you need professional help without having to spend too much money contacting professional service, then you may try getting help from specialists by clicking on the link Fix Google Redirect Virus.  My recommendation is based on 2 reasons. Personally, I feel  the cost of their service is much lower than what you might end up paying for a tech shop repair which costs a minimum of 75$-100$ or more. It also comes with a money back guarantee of 60 days which means they will refund if the issue could not be fixed.

So don’t wait anymore. Take action and get rid of  google redirect virus before it does more damage on your PC. Hope this article help you in fixing the problem. Wish you all good luck.

Tagged as: ask.com redirect, bing redirect, browser redirect virus, google redirect virus, internet security, manual removal, redirect, search engine, troublehshooting, virus, virus removal, yahoo redirect