So I download trojan remover and it finds it, deletes it, and when it restarts, it works perfectly. It diagnosed the problem and told me the virus was going under a different file name to hide from virus programs. This is why I could never find a “TDSS” file anywhere in my device (unhidden) manager or windows explorer search. Download trojan remover and malwarebytes and you should be good to go! Thanks Again.

Removing all the redirects (and there were many …) in the HOST file in C:\WINDOWS\system32\drivers\etc\hosts, while leaving the normal entry (localhost 127.0.0.1) in place, took care of everything.

I had almost given up hope, but thanks to your advice I was back on track in no time!

Thanks again,
Ewald

Their web site is http://www.Simplysup.com

I received another email from http://www.Simplyup.com:
There’s one more step you need to take, to restore the now fixed eventlog.service.

Open a command prompt, and issue the following command:

SC CONFIG EVENTLOG START= AUTO

Thanks to Simply Super Software. Their tech support is really super. They make Trojan Remover. I was at a point where none of the malware removers would work. The virus would disable all the many removers I tried. I emailed Simply Super Software and they led me through a solution.

Here is the sequence of events:

I emailed them telling them my problem.

Here is their return email:
Please send us your Trojan Remover logfile so that we can see what is
loading on the infected machine.

Trojan Remover’s logfile is called TRLOG.TXT and is located in:

For 2000/XP:
“My Documents”\Simply Super Software\Trojan Remover Logfiles

For Vista and above:
“Documents”\Simply Super Software\Trojan Remover Logfiles

I sent them my logfile.

Here is their return email:
Your system is infected with a rootkit (Trojan.Crot), which prevents
many anti-malware programs from working correctly

Please look for the following files:
c:\windows\system32\logevent.dll
c:\windows\system32\ntelogon.dll
c:\windows\system32\sceclt.dll

I expect only one of them to be present. When you determine which file
is on your system let me know and I should be able to provide removal
instructions.

Here is my reply:
I located a c:\windows\system32\logevent.dll file. There was no c:\windows\system32\ntelogon.dll file. I also did not find a c:\windows\system32\sceclt.dll file; however, there was a c:\windows\system32\scecli.dll. I don’t know if that is an okay file.

Here is their reply:
Proceed as follows:
1. Open a Command Prompt (START | Run – type in CMD and press Enter).
2. At the prompt, type in the following exactly as it is shown:

SC CONFIG EVENTLOG START= DISABLED

and press the Enter key.
NOTE: there is no space before the = sign, but there is one after it.
If you have typed the command correctly, you should see the message
ChangeServiceConfig SUCCESS.
3. Close the Command Prompt screen and restart the PC.
4. FInd the following file:
C:\Windows\System32\EVENTLOG.DLL
Right-click on it and select the option to delete it.

The file should be automatically replaced (within 1 minute) by Windows
File Protection. Look for the file again and check that it is back
(you may see it re-appear at the bottom of the directory, unless you
close Windows Explorer and then re-open it).

If you were successful in deleting EVENTLOG.DLL, and the new file
returns, you can then delete the LOGEVENT.DLL file (this is a backup
of the original eventlog.dll file, created by the malware – if we
don’t need it, we won’t use it).

Problem Solved !!!!

Thanks again.

Any other ideas? Anyone have any luck with a system restore?

Thanks!

A bit of further information~

Not all google redirect viruses are tdds viruses. The solution I outlined here did not work when I encountered the same problem on my laptop, since I had encountered a different mutation.

I’m working on some alternative solutions for such instances~ I actually repaired my laptop by going a completely different route. If you are fortunate enough to only get this once and you have the same virus I did initially, the Trojan Remover solution will likely work and be the simplest route to repairing your PC’s functionality. However, my suggestion is to uninstall Trojan Remover AS SOON AS IT CLEANS YOUR PC~ don’t wait for the trial period to expire.

Not to be a conspiracy theorist, but I left Trojan Remover on one of the PCs I work on just as a test, and that machine mysteriously had the google redirect virus again shortly after the free trial expired. I can’t say they invented it, but the company definitely wants your money! I still swear by it for a quick and very effective fix, but to be safe, follow my advice and get rid of it once it cleans your machine. It’s quite easily uninstalled and not worth the risk of it causing problems down the line. I’ve used it only once and uninstalled it on several other PCs and haven’t had any problems afterwards, so no need to be fearful of using it for a one-time clean.

I have the most updated version of Malwarebytes, and while it’s one of the best freeware programs online IMO, it doesn’t seem to catch this virus even when it’s able to run. If you download an anti-malware program and can’t install it, the best way to trick this virus (or any other that disables your system) is to simply change the .exe extension to .com. That generally allows you to install/launch the anti-viral/anti-malware program of your choice.

If you find the solutions I’ve outlined don’t work, please be as specific as possible about the problems you are experiencing. I’ll try to help you out as best I can.