Thanks! I guess it is called "Google Search Redirect Virus". I ran MalwareBytes last night and am running it again right now.
http://www.ehow.com/how_5842581_remove-google-redirect-virus.html says I need to disable TDSSserv.sys, however I do not find it.
More searching.
I've been using the free McAfee anti virus from Cox cable. I must have it misconfigured or it just does not work well.
Oh and I'm running XP on this machine and the other one has Media Center.
I know - more reason to abort M$ and move to Linux on my desktops. Giving it some serious thought.
------------------------
Keith Smith
--- On Tue, 1/25/11, Thomas Gail Haws <
tom.haws@gmail.com> wrote:
From: Thomas Gail Haws <
tom.haws@gmail.com>
Subject: Re: OT: Some kind of google search virus.
To: "Main PLUG discussion list" <
plug-discuss@lists.plug.phoenix.az.us>
Date: Tuesday, January 25, 2011, 12:33 PM
It reminds me of a problem that I was able to solve using the help of bleepingcomputer.com and malwarebytes.org forums. I don't remember the name of the issue, but I do remember the search redirection.
Basically, the fix involved the rkill, gmer, and mbam tools at the least. If you search from a safe computer for your issue and go by the instructions at either of those forums, you will be in good hands. I want to hear how it goes.
Tom
--
"To forgive is the highest, most beautiful form of love. In return, you will receive untold peace and happiness." - Dr. Robert Muller
On Tue, Jan 25, 2011 at 12:29 PM, keith smith <
klsmith2020@yahoo.com> wrote:
Hi,
I went though an evening of struggling with viruses that took over two computers. I've removed everything and am back to normal.... almost.
I have some kind of virus I am not able to identify and have no idea how to search for a fix.
What is happening, is on occasion, when searching google, and I click on a link I am routed to some unrelated sales site. The destination is rarely the same site. And sometimes the site I am re-routed to will not let me backup so I have to close the tab and start over.
Anyone have any idea what I might be dealing with here?
Thanks!
------------------------
Keith Smith
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
#yiv1935799613 #yiv1935799613avg_ls_inline_popup{padding:0px 0px;margin-left:0px;margin-top:0px;overflow:hidden;word-wrap:break-word;color:black;font-size:10px;text-align:left;line-height:130%;}
-----Inline Attachment Follows-----
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss 
(text/plain)