xP Total Security Virus Removal via Malwarebytes and Trend Micro Housecall

Update: Fix is located in this blog


Returned home this morning after taking the girls to school and found a pesky virus blocking my internet access. This virus, known by a dozen or more names, causes professional looking popups to appear on-screen and they look just like a legitimate Windows security program. The popup pretends to inform that the computer has been infected as you are directed to click certain links. These links, of course, lead to more trouble.

I will update this post with instructions after I have cleared the viruses. I've found 9 so far. I'm sure my teen and pre-teen internet-surfing daughters have nothing to do with it ;-)

(Posting this from my handy dandy Droid Incredible while the computer is infected.)

Using TDSSKiller To Remove The Google Redirect Virus

Google Redirect Virus On The Prowl.

After my refreshing weekend off, I came back to work to find a lovely computer virus waiting on our main Windows PC. I didn't notice it at first. What I DID notice was that every time I did a Google search and clicked on one of the search results, I would immediately be taken to some strange website made to look like a search engine. Problem was, I wasn't trying to get to a search engine.

I began to test my Internet Explorer browser (yes, I don't like IE either) by running some queries. Google search for "drudgreport" netted me several results linking to the Drudge Report. But when I clicked on the result links, I was taken to what looked to be fake search engines. Some even had script error codes on the page, lame script kiddies.

First thing I did was restore the computer to a prior date. This is a low-level fix but has worked at home when the kids accidentally messup some settings. I had worked on this computer last week and didn't have this issue so I restored the computer to a date last week. Rebooted and tried the Google Drudge query test again. Same problem.

Second, I visited Trend Micro's HouseCall and ran a diagnostic. TM is a global leader in cloud security. All you do is download their HouseCall program and run it. It scans the computer and gives a report. If it finds something, it will attempt to fix it. If it can't fix it, atleast you know what the name of the culprit is so you can google it. HouseCall did NOT find the problem and I uninstalled it and deleted the install folder.

TDSSKiller worked in under 3 minutes.

Third, I searched "Google Redirect Virus" and received numerous results. After reading through a few posts, I found a simple narrative on using a tool called TDSSKiller. This is an anti-root kit offered by Kaspersky, a trusted online anti-virus software provider. I downloaded TDSSKiller, ran the program, and within 3 minutes it found the problem and isolated it. A quick pop up told me to reboot the computer so I did. The next time I logged in, I performed several Google Drudge search queries and haven't had a problem since. It worked like a charm. Then I uninstalled the TDSSKiller and deleted the install folder.

And mom said watching Wargames 78 times when I was a kid wouldn't pay off. Pshhahh.