Comments on: 7.7.7.0 Google Redirect Virus Alert

By: Steve Jowett

Steve Jowett — Thu, 18 Mar 2010 19:38:03 +0000

HitMan Pro cleared up the search engine redirect problem in 30 minutes. Two days with McAfee support did nothing. I know I will go with Hitman when my current contract with McAfee ends. Thank you guys at Hitman Pro.

Steve Jowett

By: tatteredreverie

tatteredreverie — Fri, 12 Mar 2010 13:15:14 +0000

I am so, so glad I found this site, thanking everyone for the advice! If only there was some way to prevent creators of this bullshit from checking out pages like this too…

By: Nasty Google Redirect Virus on the loose « The Asylum

Nasty Google Redirect Virus on the loose « The Asylum — Fri, 05 Mar 2010 06:30:05 +0000

[...] – [andydidyk.com] [...]

By: Beagle

Beagle — Tue, 02 Feb 2010 22:36:59 +0000

I had this problem last year and I was able to solve it by deleting the wdwaud.sys file. But this year, my friend got the same problem but he didn’t have the sys file. So we decided to use the free trial version of HitMan Pro (downloaded from CNet) and it worked within minutes! It showed three files that were trojans (I can’t remember the names but I don’t think I saw atapi.sys). When I restarted the computer, everything was working.

By: susiedarling

susiedarling — Tue, 02 Feb 2010 19:26:06 +0000

Today is 2/3/10. I had that darn redirect virus for almost two weeks and no one could seem to help me. I even called a repair shop and they said, well you tried everything we would have tried, Malwarebytes, SpyDoctor, etc. Finally, I went on Yahoo answers and one replied that the only thing that took this driver related virus off their machine was Hitman Pro 3.5. I downloaded it (home website is Surfright” which took seconds. When file is opened, it scans immediately. In just a minute or so, it came up with the driver related “rootkit”. I hit delete, rebooted and now everything is fine. Hallejuhah. It was so miserable. Now that was yesterday and I haven’t started up my computer yet so hopefully it is still gone.

By: Mike

Mike — Mon, 01 Feb 2010 10:29:24 +0000

I too, did not see the 7.7.7.0. I used the Hitman 3.5, and it showed the atapi.sys as bad, but have been told that your pc needs this file, so I just can’t delete it, can I?

By: EJ

EJ — Mon, 01 Feb 2010 06:58:27 +0000

I’ve just had this Google redirect problem, myself. Though, I noticed no 7.7.7.0, I just got redirected from good links. Surfright Hitman Pro 3.5 (30-day free trial) sorted this problem out for me, as AVG & Adaware couldn’t pick the problem up. It was an overwrite infection of the otherwise legitimate atapi.sys. I seem to have acquired the problem either by briefly going into my router’s DMZ, else by hooking up an infected hard disk to my machine.

By: Mike

Mike — Mon, 18 Jan 2010 09:12:05 +0000

I just started having this problem. I tried system restore, and then my virus protection was off when windows started back up, so I undid the restore, and virus protection worked again.

I looked in the system32 folder, and only show one wdmaud file (no .sys, or .anything after it). I tried to delete it, but wouldn’t let me. I’m afraid to do it in safe mode, in case my audio quits (which someone else mentioned), plus, I have no idea what safe mode is, or how to use it.

I did a search for files/folders, for “wdmaud”, and got several hits, all listed as being modified from August 2004 to April 2008 only… nothing in the recent past.

Anyone have similar findings, or new corrections to try?

By: Seth

Seth — Sun, 10 Jan 2010 03:19:37 +0000

Hey guys i know some of you don’t have the wdmaud.sys but are still getting hijacked as that is what was happening to me… well i did a little digging around and found windrv.sys in my system32 folder and after removing it the hijacking is over. Hope this helps!

By: Tim C

Tim C — Wed, 23 Dec 2009 22:40:05 +0000

Thanks a bunch, bro. I got stuck fixing my Dad’s computer this Christmas (again…*sigh*) and couldn’t figure out where the redirects were coming from. The file you mentioned, wdmaud.sys, was not there but I found it now listed as wdmaud.drv in the same location. I renamed it and suddenly, no more redirects! Thanks again for your excelent forethought in writing this down. Just letting everyone know the new name just in case they need it in the future. Remember to rename it instead of delete it in case its a valid file, but in all honesty you might want a professional to look if you start mucking around in system files.

Tim