Spyware, viruses, & security forum: Redirect search malware

I use Firefox 3.5.6 and no added toolbars. What is default std. Firefox setup gets used. I have checked the setting and see no obvious changes at least it seems that way. -----Willy

Thanks for the reply. I've stayed up late last night and finally had to sleep. The links I manually cur&paste so I wouldn't allow the redirect to grab hold of. It works that way but no idea if any of the help online actually works. Following some posting instruction actually found nothing of what I was expected to find when it came to the final text/line/correction. It seems hard to resolve if nothing is there to correct. My last search called it the "google redirect virus" which is helpful as at least I have a name for the problem. regardless, I still can't resolve it for now. I'll follow your links and see what comes up. thanks -----Willy

You might want to give a try the guide in removing such Vundo that affect Firefox:
http://spillspace.com/2009/new-firefox-virus/

Part of the message in the blog is below (I'm copying here... just in case you can't view the page using FF) :

Symptoms:
You are clicking on your search results and instead of going to the intended target, you are going everywhere else: Yahoo Hotjobs, Fake Anti-Virus sites, Second rate search sites, or you are getting Error 404 Page not found. You may also be seeing popups though popups are blocked. You may also find Internet Explorer (iexplore.exe) running in your Task Manager as a backgound process, even though you have not opened it.

"The short fix:
You will find this one living in the extensions folder of Firefox. What you need to do is find the offending file, delete or encrypt it, then replace it with a blank dummy file.
Here are the steps:
Navigate to: C:\Program Files\Mozilla Firefox\extensions\, look for a folder that is a string of letters, created around the time you began having the problem. Something like "{BCB94CDD-5542-403F-9FB3-07D3DB1E9951}"
Open the folder, and then open the folder called "chrome", then "content", and look for a file inside called overlay.xul (variants may have different names).
Verify that it is the virus: does it have code similar to this: click to see code
If you have found the culprit, delete the file (or encrypt with Axcrypt which is reversible).
Replace it with a blank text file with the same name and extension.
Repeat the process - you may have multiple copies in multiple folders.
Test: Go back to Google, try your search results again.

The better fix:
What you will do here is the short fix listed above, plus you will also run several Malware programs, remove all old versions of Java and download the new Java. If that doesn't cure your problem you may need to run some more serious software. Here are the steps:
Do the "short fix" listed above.
Remove old versions of Java by downloading JavaRa and unziping it to your desktop.
Double-click on JavaRa.exe to start the program and Click on Remove Older Versions.
Download and install the latest version of Java (Most likely the first download you see here).
Install Malwarebytes and SuperAntiSpyware
Update them, run them, and delete all bad stuff.
Shutdown, restart, run them again.
If you are clean then test for redirects in Google."

Willy, there is also another tool that you try: GooredFix
Direct download of GooredFix is in http://jpshortstuff.247fixes.com/GooredFix.exe

Found it in MBAM forums with the following post:

"GooredFix is a tool written to deal with this Firefox Hijack. Option#1 will display what it thinks is bad and Option#2 will delete what it thinks is bad. If you are unsure, post a log from Option#1.

This infection has been around since about October/November last year, and has 4 different "variants". Currently, no AntiVirus/AntiSpyware programs detect this."

http://www.malwarebytes.org/forums/index.php?showtopic=7467

I hope you'll get this fix. Not all browser in your PC is affected, right?

WIN XP SP3

AVG
Win defender
Malwarebytes AM
AD Aware

I scanned with AVG and Melwarebytes and Win defender.
All 3 detected bunch of problems.
I removed what those viruses and malware.
AVG detected "Vundo generic." even through multiple scans.
I still have browser redirects problem though.

the TDSSserv infection. I hope deleting Firefox really get rid of it and if you will reload Java and other plugins but in case you have not, Willy:

Show Hidden Devices under Hardware Device Manager in your Windows Control Panel.
Look for "TDSSserv.sys". If found, right-click it then select disable. Do not select uninstall but choose to "disable"
Reboot the pc.
Scan the system using up-to-date antivirus or anti-malware.

Many are affected now