Comments on: Google Redirect Virus

By: TheUnknownHacker

TheUnknownHacker — Tue, 08 Nov 2011 00:30:16 +0000

I have the same thing and no matter how many times i delete it, it comes back. If you want to view any webpage that redirects you,
then click the link,
then click the address bar (so that the address of the webpage that you want to view is completely highlighted)
and hit enter…
Let me know if that works for you

By: lee

lee — Fri, 28 Oct 2011 15:20:34 +0000

Look in your registry for the extension registry settings. It’s likely something set itself up as the program to launch .exe with. That’s a nasty one, but if you find and remove that, not only will you be able to run things again, but you’ll also know what to delete.

By: tbaaah

tbaaah — Sat, 10 Sep 2011 23:55:30 +0000

George’s remedy worked for me as well, at least for now. I’ll have to give it a while to see if it creeps back in.

By: Bobalou

Bobalou — Tue, 06 Sep 2011 22:47:11 +0000

Hey all! I had success with George’s remedy! go to Start, Control Panel, click on Java, go down to Temp Internet Files, click settings, then click on Delete files tab at bottom, (both checkmarks) then hit ok! finally tried the windows\syst32\drivers\etc\hosts (edit file)..thanks George!

By: Rick

Rick — Sun, 28 Aug 2011 23:19:01 +0000

To replace the atapi.sys file. You have to expand from an original location to a save location on the hard drive such as a TEMP folder. You then have to reboot with an original disk or bartpc or something to get you at a dos like screen after reboot. Then manually copy the file to two folders where it exists.. Being in a Dos like mode allows you to over write the infected files.

good luck

By: Samiej72

Samiej72 — Sat, 20 Aug 2011 18:01:53 +0000

Reboot your computer in safe mode and delete the following file in the following folder. Fixed my redirect problem like a champ!!

File: api-ms-win-core-memory-l1-1-032.dll
Folder: C:\Windows\SysWOW64

By: George

George — Wed, 03 Aug 2011 21:40:19 +0000

It is connected to Java. Just go to Control Panel, click on the Java icon, delete temporary files located there, restart your computer, and voila, it’s gone.

By: Roderick Burkes

Roderick Burkes — Sat, 12 Feb 2011 10:18:16 +0000

That is complete bull. I installed a new hard drive because my old one had the google redirect virus and nothing was working to find and remove the virus. So I install the new hard drive thinking there is no way that this virus could have followed it onto a NEW hard drive. The first time I install windows and start it up, I go to google, and sure enough. There is that damn redirect virus. antispyware programs are not removing this virus. There has to be a PROVEN way to get rid of this infection.

By: alam khan

alam khan — Tue, 04 Jan 2011 16:28:01 +0000

D:drive amd64 i386 virus file not delete pls melp me

By: Amy

Amy — Fri, 22 Oct 2010 04:11:55 +0000

I am having the same problem. I can not get onto any website at all except Google. I get Internet Explorer cannot display the webpage error. I can do searches but if I click on the link or type in an address in the address bar I get that error.
I do not have a CD rom because my computer is used and I did not get one.
Is there anything else I can do?
Thanks!

By: Stacey

Stacey — Mon, 18 Oct 2010 18:10:02 +0000

I got rid of it. What worked for me with my XP was to go to start, then search, All files, etc, then type in etc, once you see the folder labelled etc then right click on it to remove read only under properties, then hit on it and I deleted all the host files that were crazy, there were a bunch like ad this and sex that etc then i went back and right clicked on etc to put read only again rebooted and it was gone.

By: Britteny

Britteny — Sun, 17 Oct 2010 19:21:31 +0000

I am experiencing the same problems with the virus. None of the anti-virus anti-malware things I have downloaded can find it. Srinath
pointed out a solution but my computer is old. It came with Windows XP I do not have a OS disk for it. So how do I expand the file? Is there another solution available?

Please help.. and explain in simple terms. I’m not the most computer literate person out there.

By: Mircea

Mircea — Mon, 09 Aug 2010 22:01:19 +0000

try from Safe Mode.

By: Rajendra

Rajendra — Fri, 16 Jul 2010 12:34:35 +0000

Shrinath, tried u r solution.
expand h:\i386\atapi.sy_ -r h:\windows\system32\drivers\atapi.sys this command is not working, some window flashes but file is not replaced. My win xp is on h: as i386 is also at same place. Pl help I am tired of every solution and badly need google services as unable to even login gmail etc.

By: Terry

Terry — Thu, 15 Jul 2010 10:21:46 +0000

thanks and sorry for that! I see a file oko6.dll . Is this a virus file?

By: Srinath

Srinath — Wed, 14 Jul 2010 15:48:37 +0000

Terry – The right command is

expand X:\i386\atapi.sy_ -r c:\windows\system32\drivers\atapi.sys

and all other info you gave are perfectly correct

By: jezza

jezza — Mon, 12 Jul 2010 15:35:32 +0000

ive installed 3 different ani spyware progs and none find it

By: Terry

Terry — Mon, 05 Jul 2010 15:04:59 +0000

Insert your Windows XP CD-ROM into the drive. Click Start, Run and type CMD.EXE. Use the Expand command.

Example

expand X:\i386\atapi.sy_ -r c:\windows\system32\drivers\

Where X:\ is your CD-ROM drive letter. The above command assumes Windows is installed in C:\ drive. If not, change the drive letter / Path accordingly.

Srinath , Am I correct ?

By: Stacey

Stacey — Mon, 05 Jul 2010 01:16:03 +0000

I am so not computer literate. how do I go about actually doing this please? I have no idea where to start.

By: moi

moi — Fri, 02 Jul 2010 12:53:01 +0000

So Expand the File from i386)folder.If the file is not replaced the computer may not boot or may end up in BSOD Error. Eg of Expand command (expand C:\i386\atapi.sy_ C:\Windows\System32\Drivers\atapi.sys). ENJOY !!!!!!!!!!!!!!!

^^^
could someone please explain that a bit more clearly?

sorry, but i’ve read it many times, opened the C:\WINDOWS\system32\drivers
and attempted to figure out how to get rid of the google redirect virus, but
i’m having trouble because every “help” suggestion is similar to the one above.

many of us don’t understand what you said. i openly admit i didn’t.

could you please explain that a bit better? please use the carriage return every now and then.

thanks so much.

By: nnikba

nnikba — Thu, 01 Jul 2010 06:31:20 +0000

Post by Srinath worked for me also . Great help Srinath . Thanks
I tried many software and scan before without result!

By: Terry

Terry — Tue, 29 Jun 2010 16:10:04 +0000

Post by Srinath worked for me. Great help Srinath . Keep it up.

By: char

char — Tue, 29 Jun 2010 01:25:04 +0000

srinath, i have the same virus as everyone here. my ” C:\Windows\System32\Drivers\atapi.sys. If it is 95KB 0r 93KB it is infected(It should be 94 KB) ” my file say 94.2 KB…is it infected????

By: Terry

Terry — Mon, 28 Jun 2010 17:19:43 +0000

Post by Srinath worked for me . Great help Srinath . Thanks

By: Carl

Carl — Fri, 25 Jun 2010 18:35:27 +0000

If you need to do searches till you solve the problem you can always copy and paste the search results address into the address bar and that shouldnt do a redirect. Also for Firefox there is a plug-in that’s supposed to solve that. I installed it and it helped but wasnt 100%.
I think I finally eliminated the virus after trying all the free spyware programs . I had more items detected with Malware Bytes than any of the others. People say Combo Fix will knock it out but that its not a good tool for folks that arent experienced with it.
I’d also recommend doing all the windows updates and update your browser. Good luck

By: Richard Bendert

Richard Bendert — Mon, 21 Jun 2010 21:27:49 +0000

I appear to have the google redirect virus. I can’t download anything to fix it because it redirects it. I used a separate computer and used the download link to download sdsetup_aff.exe from this website then copied it to the infected computer. Unfortunately the first thing the software does is try to update and gets “Redirected” causing it to fail so I can’t use the software.

Help!!!

By: annab

annab — Sat, 19 Jun 2010 15:58:40 +0000

Use another search engine.

By: Eric

Eric — Sat, 12 Jun 2010 14:28:32 +0000

How can i can i fix the problem when everytime i try to type hitman in the browser, it redirects me

By: Ellay

Ellay — Sat, 23 Jan 2010 16:23:04 +0000

I got the redirect virus and used Hitman Pro 3.5 (downloaded for cnet downloads) and it seems to have gotten rid of the virus without messing up anything else.

By: Srinath

Srinath — Thu, 14 Jan 2010 11:51:37 +0000

Hi all, I have fond a solution that works fine. In WindowsXP, Check C:\Windows\System32\Drivers\atapi.sys. If it is 95KB 0r 93KB it is infected(It should be 94 KB). It is a genuine file,but gets infected because of Virus.So Expand the File from i386)folder.If the file is not replaced the computer may not boot or may end up in BSOD Error. Eg of Expand command (expand C:\i386\atapi.sy_ C:\Windows\System32\Drivers\atapi.sys). ENJOY !!!!!!!!!!!!!!!

By: Don

Don — Wed, 06 Jan 2010 15:13:12 +0000

Has ANYONE found a ay to get rid of this redirect virus yet !!! I have been trying for several days now without any luck at all. I found an article on it that said to “Disable” it instead of deleting it. Said that if you deleted it, that it would reinstall itself when you rebooted. I am about to the point that I am ready to just wipe my hard drive and reinstall the O/S if I cannot find a fix for this problem.

By: bryan

bryan — Mon, 28 Dec 2009 09:14:14 +0000

Please note that wdmaud.sys located in C:\Windows\System32\drivers\ is is a Windows core system file, it’s a safe file.

But wdmaud.sys in C:\Windows\system32\ is a trojan/Google redirect also known as Rootkit.Win32.Agent.fwt.

By: Srinath

Srinath — Sun, 27 Dec 2009 10:58:49 +0000

Try deleting C:\Windows\system32\Wdmaud.sys……………

By: Dan Zee

Dan Zee — Fri, 25 Dec 2009 03:34:01 +0000

Yeah, same problem here. Superantispyware and Malwarebytes cleaned out the bad files, but there’s something in the registry that redirects Google searches. My only workaround is to use AltaVista to search. There seems to be a lot of useless articles like this that claim to tell you how to remove the redirect virus, but that tell you nothing.

By: Ariana

Ariana — Tue, 08 Dec 2009 02:25:02 +0000

I have a redirecting virus that affects all browsers (Firefox, Internet Explorer, Netscape) that none of the antiviral software I have tried will remove. I have already tried manual removal of the browsers except Netscape, removal of old versions of Java, using SuperAntivirus, Malwarebytes, Microsoft Security Essentials, and Panda Antivirus. None of them have been able to disable this malware. They do not even see it. I did a system restore to a date prior to the infection but the virus persisted.

What now?

By: Jessica6

Jessica6 — Thu, 03 Dec 2009 19:41:48 +0000

I’ve got a computer that has that virus but it blocks Spyware Doctor for opening! I downloaded it with no problems but it will not run. I’ve tried to double click the icon, used the ‘run’ command, etc. When I click on ’start’ and find it there the program has been highlighted in pale orange though so this virus I’m sure is behind preventing it from opening.

I ran Malware bytes & though it cleaned up a lot the virus is still there. Cleaned the registry too, manually removed host files, dlls & exe files that looked suspicious but I’m still missing something. There’s also a couple of files I just cannot delete.

By: carrie

carrie — Sun, 15 Nov 2009 00:12:35 +0000

We used Spy doctor. things are working right now. It started out as a redirect virus then google and yahoo were blocked completly.

By: BEan

BEan — Sat, 18 Jul 2009 11:15:31 +0000

I have been trying to remove this softwre for ages. Any website which offers solutions seems to be blocked!

By: Luciana

Luciana — Mon, 08 Jun 2009 11:22:12 +0000

You can download Spyware Doctor from this website. It doesn't matter which software you choose; just make it's anti-spyware and make sure it's reputable.

By: Deena

Deena — Mon, 08 Jun 2009 11:03:55 +0000

Which software do you recommend to download? My homepage is currently the same, but when I try click on a google web search it takes me to other site and when I type the website into the address bar it does the same.

By: Luciana

Luciana — Mon, 08 Jun 2009 06:12:00 +0000

You can always install some anti-spyware and let it do the removal for you.

By: jay

jay — Sun, 07 Jun 2009 02:12:41 +0000

ya umm.. wat about ppl who dont no enuf bout computers 2 no how to remove this shit..?