Comments on: 7.7.7.0 Google Redirect Virus Alert

By: Nasty Google Redirect Virus on the loose « The Asylum

Nasty Google Redirect Virus on the loose « The Asylum — Fri, 05 Mar 2010 06:30:05 +0000

[...] – [andydidyk.com] [...]

By: Beagle

Beagle — Tue, 02 Feb 2010 22:36:59 +0000

I had this problem last year and I was able to solve it by deleting the wdwaud.sys file. But this year, my friend got the same problem but he didn’t have the sys file. So we decided to use the free trial version of HitMan Pro (downloaded from CNet) and it worked within minutes! It showed three files that were trojans (I can’t remember the names but I don’t think I saw atapi.sys). When I restarted the computer, everything was working.

By: susiedarling

susiedarling — Tue, 02 Feb 2010 19:26:06 +0000

Today is 2/3/10. I had that darn redirect virus for almost two weeks and no one could seem to help me. I even called a repair shop and they said, well you tried everything we would have tried, Malwarebytes, SpyDoctor, etc. Finally, I went on Yahoo answers and one replied that the only thing that took this driver related virus off their machine was Hitman Pro 3.5. I downloaded it (home website is Surfright” which took seconds. When file is opened, it scans immediately. In just a minute or so, it came up with the driver related “rootkit”. I hit delete, rebooted and now everything is fine. Hallejuhah. It was so miserable. Now that was yesterday and I haven’t started up my computer yet so hopefully it is still gone.

By: Mike

Mike — Mon, 01 Feb 2010 10:29:24 +0000

I too, did not see the 7.7.7.0. I used the Hitman 3.5, and it showed the atapi.sys as bad, but have been told that your pc needs this file, so I just can’t delete it, can I?

By: EJ

EJ — Mon, 01 Feb 2010 06:58:27 +0000

I’ve just had this Google redirect problem, myself. Though, I noticed no 7.7.7.0, I just got redirected from good links. Surfright Hitman Pro 3.5 (30-day free trial) sorted this problem out for me, as AVG & Adaware couldn’t pick the problem up. It was an overwrite infection of the otherwise legitimate atapi.sys. I seem to have acquired the problem either by briefly going into my router’s DMZ, else by hooking up an infected hard disk to my machine.

By: Mike

Mike — Mon, 18 Jan 2010 09:12:05 +0000

I just started having this problem. I tried system restore, and then my virus protection was off when windows started back up, so I undid the restore, and virus protection worked again.

I looked in the system32 folder, and only show one wdmaud file (no .sys, or .anything after it). I tried to delete it, but wouldn’t let me. I’m afraid to do it in safe mode, in case my audio quits (which someone else mentioned), plus, I have no idea what safe mode is, or how to use it.

I did a search for files/folders, for “wdmaud”, and got several hits, all listed as being modified from August 2004 to April 2008 only… nothing in the recent past.

Anyone have similar findings, or new corrections to try?

By: Seth

Seth — Sun, 10 Jan 2010 03:19:37 +0000

Hey guys i know some of you don’t have the wdmaud.sys but are still getting hijacked as that is what was happening to me… well i did a little digging around and found windrv.sys in my system32 folder and after removing it the hijacking is over. Hope this helps!

By: Tim C

Tim C — Wed, 23 Dec 2009 22:40:05 +0000

Thanks a bunch, bro. I got stuck fixing my Dad’s computer this Christmas (again…*sigh*) and couldn’t figure out where the redirects were coming from. The file you mentioned, wdmaud.sys, was not there but I found it now listed as wdmaud.drv in the same location. I renamed it and suddenly, no more redirects! Thanks again for your excelent forethought in writing this down. Just letting everyone know the new name just in case they need it in the future. Remember to rename it instead of delete it in case its a valid file, but in all honesty you might want a professional to look if you start mucking around in system files.

Tim

By: Brodie

Brodie — Sun, 09 Aug 2009 01:40:49 +0000

I think I am having the same problem or a very similar one as everyone else. I don’t see a 7.7.7.0 when I get redirected but I have a lot of the similar problems.

I tried running several programs to fix it including Ad-Aware, Spybot, AVG Anti Virus.

Adaware and spybot both get closed down as soon as I try to scan anything with them. I also tried using Malwarebyte and renaming the .exe as suggested in the link to another forum.

I tried deleting wdmaud.sys and .drv but everytime I delete one a duplicate comes up in its place. For some reason I can’t go into safemode to delete it either my computer says im missing ntoskrnl.dll? I checked and the file is there but it’s probably corrupt and I can’t seem to find or trust a download link for the .dll

By: Barbara

Barbara — Sun, 19 Jul 2009 20:46:21 +0000

I followed what applied to my problem from the above messages it was very helpful. I got rid the bad file and registry entry. I continued to get the redirects. I put spybot on my computer from a USB drive, but a connection with the server was required and it was blocked.
I finally remembered how I got spybot to work once before. I downloaded it to another computer and copied the file from my program files to a usb file. I ran the program from the files on my usb drive and it found 182 redirects and fixed them all. I restarted the computer and could finally connect to spybot to add to the infected computer so this would not happen again. I hope this helps someone else.