jump to navigation

Google Redirect Virus January 19, 2009

Posted by ctraymon in : Tech Support , add a comment

Hey – brand new to the blog scene here!

Long Story:

Started the computer yesterday and went about the usual routine… quickly scan all of the away messages, check the UMail… “Hey, Facebook notifications!,” quickly log on to my FB. I decided to search “Ubisoft” because I have a phone interview with them tomorrow (apparently I’m too lazy to type ubi.com). Now… my first 10 results on Google had the correct headings, but the URLs listed below the links were incorrect. Subsequent pages were fine, however. Not only this, but the status bar at the bottom said “Redirecting 7.7.7.0″ Stupidly, I clicked on one, and it brought me to some annoying advertisers.

Easy fix right? Fire up AVG to check for a virus, and then Ad-Aware… no results. Okay, downloaded SpyBot: Search and Destroy… 1 result, not my problem though. Searching the internet, many people recommend MalwareBytes and SuperAntiSpyware. Neither one detected ANYTHING. Fed up, I do a search for the results “7.7.7.0″ and find the answer to my prayers at Andy Didyk’s blog. Can’t thank him enough.

Search through your computer to C:/Windows/system32/wdmaud.sys and delete the SYSTEM file. Don’t delete the other one. After it’s deleted, then run virus/spyware searches. Restart your computer for good measure, then try your searches again!

Short and Sweet:

If the first 10 search results of your Google/Yahoo searches are redirecting you to advertising sites, and if the status bar reads “Redirecting 7.7.7.0″ then you likely have the same problem. Try your virus and spyware scanners to take out any lingering issues, then go into your hard drive to C:/Windows/system32/wdmaud.sys and delete the system file. There is another file by this name, but make sure you only delete the sys. file. It should be between 16 and 20 kb. The REAL file is located at C:/Windows/system32/drivers/wdmaud.sys and is about 80 kb. THEN run your virus and spyware software.

Sorry for the boring first post, but this is a problem that’s not recognized by software yet!
-Clinton