Thanks!  I guess it is called "Google Search Redirect Virus".  I ran MalwareBytes last night and am running it again right now. 

http://www.ehow.com/how_5842581_remove-google-redirect-virus.html says I need to disable TDSSserv.sys, however I do not find it.

More searching.

I've been using the free McAfee anti virus from Cox cable.  I must have it misconfigured or it just does not work well.

Oh and I'm running XP on this machine and the other one has Media Center. 

I know - more reason to abort M$ and move to Linux on my desktops.  Giving it some serious thought. 

------------------------
Keith Smith

--- On Tue, 1/25/11, Thomas Gail Haws <tom.haws@gmail.com> wrote:

From: Thomas Gail Haws <tom.haws@gmail.com>
Subject: Re: OT: Some kind of google search virus.
To: "Main PLUG discussion list" <plug-discuss@lists.plug.phoenix.az.us>
Date: Tuesday, January 25, 2011, 12:33 PM

It reminds me of a problem that I was able to solve using the help of bleepingcomputer.com and malwarebytes.org forums.  I don't remember the name of the issue, but I do remember the search redirection.

Basically, the fix involved the rkill, gmer, and mbam tools at the least.  If you search from a safe computer for your issue and go by the instructions at either of those forums, you will be in good hands.  I want to hear how it goes.

Tom


--
"To forgive is the highest, most beautiful form of love. In return, you will receive untold peace and happiness." - Dr. Robert Muller


On Tue, Jan 25, 2011 at 12:29 PM, keith smith <klsmith2020@yahoo.com> wrote:

Hi,

I went though an evening of struggling with viruses that took over two computers.  I've removed everything and am back to normal.... almost.

I have some kind of virus I am not able to identify and have no idea how to search for a fix.

What is happening, is on occasion, when searching google, and I click on a link I am routed to some unrelated sales site.  The destination is rarely the same site.  And sometimes the site I am re-routed to will not let me backup so I have to close the tab and start over.

Anyone have any idea what I might be dealing with here?

Thanks!

------------------------
Keith Smith


---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss


-----Inline Attachment Follows-----

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss