Can't Get Rid of Nasty Redirect Virus in IE and Firefox.

[tharden3]

Hi Bytes Community,

I don't have a problem with my computer, but my family's main computer is having some issues. It is an HP Pavilion desktop running Windows XP.

The computer has a nasty redirect virus that I cannot seem to get rid of. It affects both Firefox and Internet Explorer on that computer. Whenever you try to do a search in Google, or visit websites, many times it redirects you to fraudulent websites.

I have run the latest AVG Free Anti-Virus as well as Spy Bot - Search and Destroy (with all the latest updates), and neither of them show or get rid of the virus. It looks like the name of the redirect virus is "plxlestatservlce" (I assume with intentional misspellings). I have Googled the issue several times, but I could not find a concrete answer nor a free application that will get rid of this.

Any help is appreciated.

Kind regards,
Tim

[sicarie]

Awesome choice in brand (though I'm biased :)

My recommendation is a bit complicated. When a virus is already installed, it will usually act to keep itself 'alive' by neutralizing antivirus and spyware. The thing you want to do is run AVG from a location other than the disk of the infected computer.

I would recommend using a separate computer to create either an up-to-date bootable CD or USB key from a place like AVG, and then try to boot and run AV from there.

If that's not possible, I have something similar to this. I would recommend turning the family PC off, removing the disk, and then attaching it as a slave (may require changing jumpers, depending how old your family computer is) to a laptop, and then running AVG against that.

Just be careful that if you plug it in and there's a LOT of activity without you really doing a lot, it might be wise to unplug it and take it in to a 'reputable' shop - if you can find one - that can use a different OS to kick off the AV scan - you don't want to spread the virus while attempting to get rid of it...

[tharden3]

Hi sicarie,

I appreciate your help, I had unfortunately become sidetracked by more pressing matters over the last month. I am going to rework the problem with your advice now, and I will post my results here.

For now I have my family using Ubuntu on that PC so they can work without all of this virus mess.

Thanks again, and talk to you soon.

-Tim

[Rabbit]

1) Find the name of the process that's causing it (which you've already done).

2) Start the computer in safe mode.

3) Go into msconfig and disable said process.

4) Go into regedit and delete referrences to the exe file.

5) Delete/rename the file.

6) Restart and it should go away.

[tharden3]

@sicarie and Rabbit:

Thank you both for your help, I used both sets of advice and cleaned up a ton of viruses, etc. from the family PC. Unfortunately, there was an extra step I had to take to get rid of the virus that was ultimately causing all of the redirect problems in my browsers. Like I said, the virus would redirect me to fraudulent websites when I tried to click on links in Google search results. I found a very helpful link and a free download offering from Symantec that deleted the virus within a couple of minutes. For sake of heeding the "no-advertising" rule I don't want to post the link here, but for anyone that ever runs into this "redirect virus" PM me and I can point you in the right direction.

Thanks again for the help.

Cheers,
Tim