BleepingComputer.com: Google Redirect Virus

Jump to content

Forum Guidelines

Posted Image Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help


Posted Image Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.


Posted Image DO NOT RUN ComboFix unless requested to.


Posted Image Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.


Posted Image When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.


Posted Image Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  • 2 Pages +
  • 1
  • 2
  • You cannot start a new topic
  • This topic is locked

Google Redirect Virus still cant remove it

#16 User is online   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,106
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 30 April 2011 - 03:41 PM

1. Click Start, click Run, type services.msc, and then click OK.
2. In the list of services, click DNS Client.
3. Make sure that the Status column displays Started and that the Startup Type column displays Automatic.
4. If the service is not set to Started or if the startup type for the DNS Client service is not set to Automatic, follow these steps:
a. Right-click DNS Client, and then click Properties.
b. In the DNS Client Properties dialog box, click the General tab, and then click Automatic in the Startup type list.
c. Click Start, click Apply, and then click OK.

Now try the DNS instructions again.
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#17 User is online   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,106
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 02 May 2011 - 06:50 PM

Hi,

I have not had a reply from you for 3 days. Can you please tell me if you still need help with your computer as I am unable to help other members with their problems while I have your topic still open. The time taken between posts can also change the situation with your PC making it more difficult to help you.

If you like you can PM me.

Thanks,

m0le
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#18 User is online   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,106
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 03 May 2011 - 06:33 PM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#19 User is online   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,106
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 05 May 2011 - 07:55 PM

Reopened at user's request

-----------------------------------------

Please carry out the instructions posted before the bump.

Thanks
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#20 User is offline   OhSht 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 62
  • Joined: 09-September 10

Posted 07 May 2011 - 08:27 AM

Okay I flushed the DNS succesfully! Now can you give me a little bit more specifics as what I should change in my router settings?

#21 User is online   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,106
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 07 May 2011 - 08:43 AM

Is this a bit more detailed for you?
  • Please read this: Malware Silently Alters Wireless Router Settings


  • Consult this link to find out what is the default username and password of your router and note down them: Route Passwords


  • Then reset your router to it's factory default settings:

    Quote

    "If your machine has been infected by one of these Zlob/DNSchanger Trojans, and your router settings have been altered, I would strongly recommend that you reset the router to its default configuration. Usually, this can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds)"



  • This is the difficult part.
    First get to the routers server. To do that open Internet Explorer and type http:\\192.168.1.1 in the address bar and click Enter. You get the log in window.
    Fill in the password you have already found and you will get the configuration page.
    Configure the router to allow you to connect to your ISP server. In some routers it is done by a setup wizard. But you have to fill in the log in password your ISP has initially given to you.
    You can also call your ISP if you don't have your initial password.
    Don't forget to change the routers default password and set a strong password. Note down the password and keep it somewhere for future reference.

If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#22 User is offline   OhSht 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 62
  • Joined: 09-September 10

Posted 10 May 2011 - 04:34 PM

okay for this site http:\\192.168.1.1 should I change my user name and password?

#23 User is online   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,106
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 10 May 2011 - 05:48 PM

Yes, you should change them when you have gained access.
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#24 User is offline   OhSht 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 62
  • Joined: 09-September 10

Posted 11 May 2011 - 05:16 PM

okay i mean like my user name and password to log onto my stuff are very very simple/basic. Should I change that part too? and how do I do that?

#25 User is online   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,106
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 11 May 2011 - 05:58 PM

Let me just check this, you are asking if you should change all the passwords that you use on the machine? Is that right?

At this stage the machine is still compromised. You need access to a known clean computer and then change all passwords where applicable. In most cases the login page will have a link to changing the username and password. The important thing is to do this on a clean computer.

Let me know when you've completed the router control panel changes.
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#26 User is offline   OhSht 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 62
  • Joined: 09-September 10

Posted 12 May 2011 - 04:32 PM

wait how do I do it on a clean computer? I have another computer but it redirects on the internet as well

#27 User is online   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,106
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 12 May 2011 - 05:07 PM

For the general change of username and password you will need access to a clean PC. You would need to try an internet cafe or another source. In the UK, we have access at libraries, for instance.

For the router access you can use the infected machine.
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#28 User is online   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,106
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 14 May 2011 - 08:57 PM

How is that going?
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#29 User is online   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,106
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 16 May 2011 - 05:01 PM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

Share this topic:


  • 2 Pages +
  • 1
  • 2
  • You cannot start a new topic
  • This topic is locked

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users