Virus? Google redirect, random popups, and ping.exe?

Question

I have three problems;

1) When I go into google search and click into a link, the link is then redirected to another completely different site
2) I have random popups (or rather, random tabs appearing)  that leads to "congratulations!" I won somethin! or "warning! your computer is infect!" blah blah!
3) Something called PING.exe*32 "TCP/IP Ping command" keeps running up to 100% CPU usage. This was not there before when I first got my laptop. I keep ending the process through task manager but it always starts up again within a few seconds, completely slowing down my laptop. I have to keep task manager open and remember to check it every few seconds. I went to find the application through, My Computer -> Local Disk (C:) -> Windows -> System32 - > PING
And when I go to delete it, it goes "You need Permission from TrustedInstaller to make changes to this application".
Can anyone help me? Please??

I use Comodo Antivirus and that keeps coming up saying that my computer has nor viruses or anything. I tried other antivirus software but NONE seem to find anything wrong :(

Anonymous · Accepted Answer

It seems that your computer is infected with the 'redirect' virus. You should scan your computer with antimalware software and TDSSKiller http://support.kaspersky.com/faq/?qid=208280684

You may also follow this removal guide:

http://deletemalware.blogspot.com/2010/02/remove-google-redirect-virus.html

I hope this helps. Good luck!

Winston · Answer

2

Arfenundred · Answer

You have more likely than not got a Rootkit.

A complete pain to get rid of.
this generic attack on the infection should put things right.

First

click on Start > Run. 

Type in the following into the open box.

devmgmt.msc

then Click on OK.

This will run Device Manager.

In Device Manager,

click on View > Show Hidden Devices.

expand all the devices by clicking on the "Plus" sign. 
Now try to find

TDSSserv.sys or clbdriver.sys or oUltraf or seneka.sys,
right click on whatever one you found and select Disable.

make sure that you do not select the Un-Install option
otherwise infection will be back once you reboot your computer.

if none of them are there do not worry,
it could be something simpler but follow what comes next.

you will have to enable view hidden folders in, folder options > view.

Delete everything in the windows temp folder,
C > Windows > Temp

Delete all cookies,
Delete all temporary internet files(not to be confused with windows temp files)
these are best deleted via your internet browsers.
it will save you messing about in the the hidden system files

reset internet explorer,
tools > internet options > Advanced tab > reset .

Delete everything in the prefetch folder.
C > Windows > Prefetch

Delete the hosts file,
C > Windows > System32 > drivers > etc > HOSTS

A clean hosts file will be written by windows when you reboot later.
Note: if you were using a custom Hosts file
you will need to replace any of those entries yourself.

Delete the flash cookies found in the macromedia, #Shared Objects folder.
c > users > "your name" > App Data > Roaming > macromedia > Flash player > #Shared Objects

delete everything you find in the #Shared Objects folder

last lot to delete,
navigate to 
c > users > "your name" > App Data > Local > Temp

delete everything in the Temp folder.


Run a full scan with this
Sophos Anti-Rootkit : http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

and remove everything suspicious it finds.

Do not have any open windows and shut down all programs when you run it.

Sophos Anti-Rootkit DOWNLOAD : https://secure.sophos.com/support/cleaners/sar_15_sfx.exe

Then run a full scan with this and remove what it finds.

Super anti spyware Pro : http://www.superantispyware.com/

Super anti spyware Pro DOWNLOAD : http://downloads.superantispyware.com/downloads/SUPERAntiSpywarePro.exe
this has a tool built in that can reset the URL prefix's, USE IT.
 
reset your router to default.

download then run,Hitman pro : http://www.surfright.nl/en  to mop up anything left.
remove what ever it finds.

your redirect virus should now be gone.
 
 

.

Anonymous · Answer

Google redirects manual removal
http://remove-free.com/removal-google-redirect-virus-overview-causes-and-solutions

Anonymous · Answer

Download, and run full scans with:

1. http://download.cnet.com/SuperAntiSpyware-Free-Edition/3000-8022_4-10523889.html?tag=dropDownForm;productListing

2. http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=rb_content;main

TDsskiller is not recommended because you may lose internet after you use it, SuperAntiSpyware will take care of redirect malware

Trending News

Virus? Google redirect, random popups, and ping.exe?

5 Answers