If you are infected with the Google Redirecting Virus (a type of Trojan Horse that initiates itself whenever you open your web browser) then you are probably seeing an awful lot of spam advertisements and affiliate links whenever you are viewing search results pages.
how can I remove the Google redirect Trojan?
Not only is this extremely annoying but it also makes money for the hackers behind it, something I certainly wouldn’t want to be part of.
The problem also seems to be growing – as I’m finishing off this post davkal has just written this tweet -
@Security_FAQs , are there easy removal instructions anywhere for the google redirect trojan, seems more people are getting it
So, what you all need is a removal guide…
Removing The Google Redirect Trojan
- As ever, I always recommend using a good antivirus program (and make sure you keep it updated with the latest virus definitions!)
- Go to C:/Windows/System32 . Find regedit.exe in this folder and right click on it. Rename it with a new name (one that you can easily remember). Disable regedit.exe, which will disable Google Redirect Virus from executing.
- Download and install Anti-Malware by Malwarebytes. Run the Anti-Malware complete scan and select to search all drivers, folders and files. Complete the scan and remove any Trojan horses found.
- Go back to the “System32″ folder and rename the file “regedit.exe.”
- Click on “Start.” Select “Run” and type in “regedit” or type “regedit” in the “Start Search” box. A new window will open called “Registry Editor.”
- Click on the arrow to expand “HKEY_LOCAL_MACHINE”. Click on “Software,” “Microsoft,” “Windows,” “CurrentVersion,” “Run.” Look for an entry in the right-hand window called “RegSvr32=%System%msmsgs.exe”. Right-click and delete the file. Restart the computer.
Share this post: Tweet It | Facebook It | Stumble It | Digg It | Delicious It
{ 2 comments… read them below or add one }
I about went crazy trying to fix this. Every recommendation I found did not help until I found this one. Thank you to whoever posted this. Everyone needs to repost this elsewhere on the web to get the message out.
Look in (windows)\system32\drivers\etc\hosts. There should be only some lines starting with # and “127.0.0.1 localhost”. Anything else in there might be redirecting you to a fake Google or other fake site.
I’m glad you found this post useful
{ 1 trackback }