Comments on: go.google – go.yahoo

By: Michael

Michael — Sat, 04 Sep 2010 04:29:37 +0000

If you can’t find TDSSserv.sys in DEVICE MANAGER (as Mike described above); then click START > RUN > Open: regedit > EDIT > FIND > TDSSserv — delete (if you also see go.yahoo delete that too) — then click FIND NEXT — delete any others found then FIND for go.yahoo — delete any found. Exit Registry Editor.

By: Hyoran

Hyoran — Tue, 20 Oct 2009 17:41:03 +0000

I’ve tried everything to find the TDSSserv.sys including the scan for hardware changes and i still can’t find it. Is there any other hardware you can disable that will help?

Also i seem to have problems with serial and npkcrypt. Why have they stopped working?

By: crippy

crippy — Sun, 09 Aug 2009 12:36:31 +0000

I seem to have an updated version of this hijack, I can’t even get into device manager, all attempts to find or install software are blocked along with any websites related to software fixes… any ideas? :P

By: Gordon

Gordon — Tue, 28 Jul 2009 12:13:10 +0000

Same problem here. I’ve been trying to get rid of this for two days now. I looked for and could not find TDSServ.sys file as directed. Using my work pc and emailing to my home pc, I was able to download and run AVG and Malwarebytes. AVG found only 5 bad files where MW found 27. Cleaned all of them and it did something but didn’t get rid of it. Now I’m just redirected to a different search enging then before and still can’t get to any spyware/security sites. Any help would be greatly appreciated.

By: lithium4641

lithium4641 — Sat, 25 Jul 2009 23:26:27 +0000

I’ve been having this same prob w/ search redirecting it doesn’t matter which browser I use IE, firefox, safari, etc. Tried to find the TDSS under non plug and play but it wasn’t there however I noticed another entry called Serial, disabled that just for grins, tried google again and no more bs redirecting anymore, now I just need to figure out how to get the junk off my pc.

By: Shari

Shari — Thu, 09 Apr 2009 18:07:12 +0000

I can’t find the
TDSS file I can’t download Malwarbytes and this went right through my McAfee. I need to do my taxes and don’t dare as long as this is here I have two harddrives one a slave one not. I am running XP with IE 8. I also have Safarie and FF loaded and it redirects in both of them. Please help I am not good at computers but I follow directions well. Mike I look for that file in Non Plug and play unless it is named something else it is not there. Somebody help. Why do I pay big money for antivirus programs if they aren’t going to help. This seem to let me load Malwarebyes but not run it.

By: Louai

Louai — Wed, 25 Mar 2009 22:42:56 +0000

MAN I still have the same problem I looked for the TDSserver it wasnt rather downloaded malwarebytes and XoftSpySe and still no luck can someone help me out?

By: Scott

Scott — Fri, 23 Jan 2009 10:54:44 +0000

OK Here’s what had to be done to get my system back up.
I did not have the TDSSserve file (I’ll tell you how I found out)
I downloaded Malwarebytes to a flash drive and tried to run it on the infected comp. No luck…wouldn’t even start – even in safe mode which kind of scared me.In fact, I tried a bunch of different malware killers but no luck. So, I took the drive out of the computer and put it on an old back up computer and looked at the infected drive as a slave. I used the old computer with malwarebytes to hunt down any infections on the slave. It found 17 trojans that McAfee couldn’t or wouldn’t see When this was done, I reinstalled the drive back into the primary computer. (I unplugged the network cable) I then tried to run malwarebytes again and nothing. Next I went for the big guns… I went to bleepingcomputers.com and downloaded combofix.exe onto another flashdrive. I copied combo to my desktop and renamed it CB (you can call it what you want) I ran it and it found 37 chunks of garbage lurking in the system32 files. NOT ONE MALICIOUS FILE WAS TDSSERVE! After this went through its course I ran malwarebytes which started right up and the computer is clean. A bit of advice…it doesn’t help to scream cry swear etc. Keep your cool and you will figure it out.

By: Scott

Scott — Thu, 22 Jan 2009 23:37:28 +0000

OK Ive taken the harddrive out and ran a scan in another computer treating the infected one as a slave. Found one trogan after 2.5 hours of scanning. There is no existance of TDSserve on this system. Is there another one in the ysstem that is called something else? Cannot even load any malware software even in safe mode

By: jeff

jeff — Wed, 14 Jan 2009 07:33:14 +0000

Ok Im all fired up at this POS trojan! I followed instructions but its not located in the non-plug and play drivers….I was able to run spyware doctor and at first had 17 threats and under the TDSS one there were 52 then after running once and rebooting there were still 9. I looked at the registry when I ran the doctor…and 5 were in C;/windows/system 32 and 3 were in the Hkey local machine system control set 003 and 004 etc. How do I find these now (I tried a search in safe mode and took forever so I stopped). Please Help!! Its friggen 2:30 am and Im pissed!!!

By: Matt

Matt — Tue, 13 Jan 2009 22:23:25 +0000

Mike,

Your suggestion did the trick. Thanks… Mcafee killed it within seconds after I disabled the TDSSserv.sys. But how did I get it in the first place. I run mcafee and spybot and neither picked it up on its way in??? UK.

By: Nancy

Nancy — Tue, 13 Jan 2009 15:24:17 +0000

Mike, you are a genius and a lifesaver!! Thank you!!!

By: Phil

Phil — Tue, 06 Jan 2009 03:32:20 +0000

MIKE my hero!!!! THX A LOT!!!

By: Cooney

Cooney — Sun, 04 Jan 2009 06:29:10 +0000

MIKE!!!!!!!! YOU ROCK!!!!!!!!!!

By: Fredrik

Fredrik — Fri, 02 Jan 2009 15:33:35 +0000

Thanks very much Mike, your advice saved my life almost. ive been trying for days now to get rid of this nasty virus.
/Fredrik, Falun – Sweden

By: F*** AntiVirus2009

F*** AntiVirus2009 — Sun, 28 Dec 2008 04:56:36 +0000

Thanks! Been seeing this alot lately in repairs

Recommend virus scanners pick up on this little tip!!!!!!

By: Mayor McCheese

Mayor McCheese — Sun, 28 Dec 2008 04:47:04 +0000

Mike, I love you more than life itself.

By: Lenmo

Lenmo — Wed, 24 Dec 2008 08:38:41 +0000

Mike – Msg #4 saved my day and Christmas! I had spent 7-8 hrs trying to remove Spyware Guard 2008. I was ready to call it quits and reformat my hard drive when I realized my browser had been taken over by go-dot-google. Since I was not able to browse using google, I changed to AltaVista, was able to browse the internet, and found this post. I manually disabled the “TDSSserv.sys” file per your instructions, then was able to download and run the free Malwarebytes Anti-Malware program. This program kept hanging during the download prior to disabling the tdsserv.sys file. Malwarebytes found 93 files (trojans,malware, etc…) and removed them.

I now have my system back! THANK YOU!

By: terenaam

terenaam — Wed, 24 Dec 2008 01:18:09 +0000

msg #1 worked for me. Thanks.

By: madfluter

madfluter — Sun, 21 Dec 2008 09:02:35 +0000

Mike (msg #4) saves the day!
ran Ad-aware (full version) and caught it, but had to go into system 32 and delete recalcitrant TDSS files. i bought the Ad-Aware after the free Malwarebytes ran for 1/2 hour and caught nothing…. damn, this sucker stinks. all i can say is: go google and go yahoo can go google and yahoo themselves…

THANKS MIKE

By: AlainStoon

AlainStoon — Fri, 19 Dec 2008 01:09:27 +0000

Mike, Thanks for the hint. I was planning to re-install XP and you save me many hours fixing my PC. I am curious. How did you find out about TDSSserv.sys?

By: Justthegreatone

Justthegreatone — Thu, 18 Dec 2008 05:26:36 +0000

Thankyou so much mike, its funny that everytime something like this happens to me, i always find the answer on a message board. Its working so far now, and does anyone know a great virus protection program to insure that this does not happen again?

By: Zelly

Zelly — Tue, 16 Dec 2008 00:34:51 +0000

IF YOU CAN’T FIND TDSSSERVE:

If you are looking through Non-Plug and Play, but don’t see TDSSserve, go to Action > Scan for Hardware Changes. This made it appear on the list for me.

Thanks so much to #4, Mike! <3

By: Anketaros

Anketaros — Mon, 15 Dec 2008 12:25:25 +0000

Thx Mike!
Good question Mark. Enable the TDSSserve after the cleaning operation??.

By: Gordeaux

Gordeaux — Sun, 14 Dec 2008 13:45:15 +0000

Thanks Mike, your advice really saved me!

By: Mark

Mark — Sun, 14 Dec 2008 06:15:10 +0000

Do I need go back and enable the TDSSserve after I run my antivirus??

By: Mark

Mark — Sun, 14 Dec 2008 06:11:52 +0000

Thanks so much!!! I can put the razor blades away!!!!!!!

By: chuck

chuck — Sat, 13 Dec 2008 19:56:05 +0000

Thanks for all the good advice. The DR Web scanner has picked up viruses that none of the other AV programs I tried found. This fixed the go.google redirect problem immediately.

I did follow the additional advice of disabling the TDSSERV.SYS as well.

By: Z

Sun, 07 Dec 2008 00:56:20 +0000

I forgot to add that I was not able to defrag, start in safe mode or get to the windows update page until the fix.

Thanks again!

By: Z

Sun, 07 Dec 2008 00:48:05 +0000

Thank you every much. The sick feeling I had the last few days has gone away. This site is a must for now on.

:thumbup:

By: Anton

Anton — Sat, 06 Dec 2008 23:31:41 +0000

Thank you! Finally this thing is gone.

By: Casey J

Casey J — Sat, 06 Dec 2008 23:28:01 +0000

hey I am having all the same symptoms of this TDSSserv.sys problem. I have done a complete fresh windows XP install and I am still having all the symptoms. Any suggestions?

By: Tom

Tom — Sat, 06 Dec 2008 13:45:11 +0000

Mike, you da man !!!! I was just minutes away from the “reformatting hard drive” fix when I came upon your solution. After several days and many hours of frustration your advice worked like a charm. Thanks a million. All systems go.

By: Alice

Alice — Fri, 05 Dec 2008 17:03:23 +0000

Thank you so much!! You saved me from a whole lot of pain!
I was ready to reinstall Windows.

By: Rima Nomolas

Rima Nomolas — Thu, 04 Dec 2008 13:45:53 +0000

As I indicated the other day – couldn’t find the TDSServ.sys files in Non-plug and Play Drivers.

My niece suggested that I download Malwarebytes: (see link below) This software found the Trojan virus and worked like a charm. Phew!!!!!!!!!

Btw, if you blocked from downloading Malwarebytes – You should use firefox, not IE.

http://www.precisesecurity.com/tools-resources/adware-tools/malwarebytes-anti-malware/

By: Jason

Jason — Wed, 03 Dec 2008 21:15:51 +0000

I used CureIt and Malwarebytes to get rid of this problem. Thank you Bill for the tips. Found this page on Google.

By: George

George — Wed, 03 Dec 2008 12:12:07 +0000

!!! mrzeta !!!!

by tha way again how did you get there??

…..Now I found the main software entries !!! KMA look at the disallowed area – all those websites I couldnt load up! Hey wait (!!!); if these are the disallowed ………..

By: George

George — Wed, 03 Dec 2008 11:55:56 +0000

by the way after disable device called TDSSserv (mike´s ideea) you may still find some threat my Malwarebytes find 5 in C:\system Volume information\_restore{….. this files are probabily what was left in the restore volume however you have to scan fully to find them coz a quik scan wont do you any good. a.. mrzeta can you tell me how you delete all TDSSserv from regedit some of thm are still there and i cant delete them Jesus this is a hell of a spyware…

By: George

George — Wed, 03 Dec 2008 11:40:57 +0000

you have to go on Go to Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices. then click it and disable

By: Rima Nomolas

Rima Nomolas — Wed, 03 Dec 2008 11:36:27 +0000

One more time – how should a computer novice find the
file named TDSSserv.sys. (it is not showing up on Non-plug and play drivers).

If possible – I need “play by play” instructions.

Thanks so much.

By: George

George — Wed, 03 Dec 2008 11:01:25 +0000

Mike your the man……. its working. If you have que you can ask me anything you want thx man

By: Rick

Rick — Wed, 03 Dec 2008 07:34:22 +0000

Mike, you’re a god. Thanks for the great suggestion to disable the TDSS file.

By: mrzeta

mrzeta — Wed, 03 Dec 2008 02:47:10 +0000

LMBO TDSS is loading again into my system – I need to logoff

By: mrzeta

mrzeta — Wed, 03 Dec 2008 02:43:17 +0000

Also – I couldnt get permissions on some of the files because the name of the user

was missing ! Just add the user you are logged into maybe – I accidently used my

other one I havnt used yet and I got the permissions boxes to open up! Good Luck!

By: mrzeta

mrzeta — Wed, 03 Dec 2008 02:36:44 +0000

One more thing – in the windows registry if you cant delete any legacy tdss files, right click on permissions; hopefully you have admin rights, click full permission then delete the entry !

Rima, Folow Mike’s instructins above to ‘disable’ the non plug and play device called TDSSserv !

MrZ

By: mrzeta

mrzeta — Wed, 03 Dec 2008 02:23:30 +0000

One more thing ! Thanks Mike !! Disabling TDSSserv did the trick – I have my search engines back, and go.google.com is gonna here from me.

That disallowed list I mentioned is a list of programs that prevent from running on your computer, or even installing !! Now I am trying MBam !

Thanks !

By: Rima Nomolas

Rima Nomolas — Wed, 03 Dec 2008 02:20:21 +0000

Can’t find file named TDSSserv.sys.

Can someone in simple terms explain to a rookie what is the next approach to removing this trojan?

Donny suggested:
You might want to go to your system 32 files, and click on date modified, scroll down to the latest date and see if the tdssserv. files or anything that is related to it is still there. I cut and pasted them to my desk-top then deleted them all.

where do you find system 32 files. Was anyone else succesful with this recommendation.

Help………………
I need play by play instructions…………

By: mrzeta

mrzeta — Wed, 03 Dec 2008 02:18:20 +0000

Here is the registry entries – I do all mine manually.

hkey_local_mach, system, controlset001, enum, root, legacy_tdssserv.sys (delete
this one; its called an active service – I didnt locate it manually my house is
noisy again tonite.

Just search tdss in the registry an delete them all AFTER restarting. I am doing this now. Dont run IEXplorer. I have also saves the registry entries should I

decide to install it on my virus computer lol.

Now I found the main software entries !!! KMA look at the disallowed area – all those websites I couldnt load up! Hey wait (!!!); if these are the disallowed

spyware programs this list must have a good list of spyware programs for us to use
!! Muhaha !

Then I did a search in files fot tdss – deleted (after moving !) all of em (mostly system32 dlls).

I also see that tdss is in a list of browser addons (under manage addons:),
Mscorews.dll and msadco.dll. The last one is ligit but I just disabled it; also
wuweb.dll; search assistant addons. All this crap relates to these browser addons,
and tdss was not found in the addon list but it was still being used. I deleted
the search assistant entries in ACMru (Again these are manual registry deletions).

I also couldnt get rid of all the tdss registry entries; I did get the most
important one, the program entries with dissallowed sites; GONZO !

Oh, and I added this site to my favorites !

Now here are some other important things to check.

Delete all prefetch files and everything in Docs/set Temp, then check those

directories for odd files. I always look at the date and time when somethin goes awry with my computer and that helps.

Export the registry after running malaware etc. Good luck.

By: mrzeta

mrzeta — Wed, 03 Dec 2008 01:37:11 +0000

Hi – I found TDSSserv.sys and also (!!) I never knew about hidden devices…

I do know about services running so I am gonna look it up now.

Somethin I noticed – I disable all my remote access stuff – well the drivers i that list are labled as ‘demand’ ; it is like they still can be used even though I shut them down; disabled they go too….I couldnt disable the TAPI one but I tried the other 2.

Here goes PC restart !!

By: mrzeta

mrzeta — Wed, 03 Dec 2008 01:24:48 +0000

Hi folks – This frkin problem called page and search engine hijacking is the 2nd worst trojan I have ever encountered. There was ref to 302 exploit and redirects – I couldnt log into any spyware websites etc – my other computer worked thankfully. I think I got slammed of my frikin email site. What happens is that advertizers embed scripts in their ads; my registry get changed and files are added to my system without my permission. This crap really pisses me off and someday I am hacking all those responsible. I let yas know if my problem is solved.

By: robert

robert — Tue, 02 Dec 2008 20:40:20 +0000

Thanks so much Mike. I wish I would have found your suggestion before wasting almost an entire day.

By: Fortysix&2

Fortysix&2 — Tue, 02 Dec 2008 03:12:00 +0000

Thanks Mike!!! 5 minutes to fix; some of the other sites would have taken hours to fix.

By: Mike number 2

Mike number 2 — Tue, 02 Dec 2008 01:50:55 +0000

Mike.. Like a friggin charm. 1/2 day lost, but not I’m back. thanks again

By: tito

tito — Tue, 02 Dec 2008 01:38:39 +0000

thanks mike, i fought that all weekend to no avail.your fix worked !

By: Grayghost

Grayghost — Tue, 02 Dec 2008 00:38:30 +0000

Way to go Mike! Bing Bang Boom…done.

By: Jen

Jen — Mon, 01 Dec 2008 06:47:02 +0000

THANK YOU SO MUCH, MIKE!

By: cybersnak

cybersnak — Sat, 29 Nov 2008 17:03:16 +0000

thax a lot man :)==*~

By: Sahil

Sahil — Sat, 29 Nov 2008 08:11:50 +0000

I have been trying to fix this problem for so long that I feel like pulling my hair out right now. I can’t seem to get google to stop re-directing me to other sites. Google has become slow and it seems like I just can’t go to any of the websites that I normally am able to go to. I tried Mike’s suggestion but when I get to control panel and click on “system”, it doesn’t even open. I tried and tried and it just doesn’t open. I really need to get this fixed. Please help!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

By: Seth

Seth — Fri, 28 Nov 2008 23:40:03 +0000

Thank you Mike! That totally did the trick.

By: Tom

Tom — Fri, 28 Nov 2008 20:22:16 +0000

Yup, the tips here saved me from jumping off a tall building…did the Dr. Web first and that got me through the nasty virus attack….thanks all!

By: tony

tony — Fri, 28 Nov 2008 01:09:15 +0000

i cant find tdss serv.sys ive opened non plug/play drivers and its no where to be seen im on windows xp ,could any one suggest any thing as im not very good on computers and this virus is driving me up the wall
thanks tony

By: Kam

Kam — Thu, 27 Nov 2008 13:19:12 +0000

yeah works great, unless your using Vista

By: Donny

Donny — Thu, 27 Nov 2008 00:13:28 +0000

You might want to go to your system 32 files, and click on date modified, scroll down to the latest date and see if the tdssserv. files or anything that is related to it is still there. I cut and pasted them to my desk-top then deleted them all.

By: Kitch

Kitch — Wed, 26 Nov 2008 00:24:12 +0000

I have a similar problem,
but, I can’t open Google, it re-directs me to “Microsoft security” an obvious fake site.
followed Mike’s instructions above (slightly different- I’m using Vista) but couldn’t find a file named TDSSserv.sys there.

Thanks.

By: Rejesh

Rejesh — Tue, 25 Nov 2008 20:49:33 +0000

you are awesome. That totally helped me to fix my computer.

By: Lisa

Lisa — Tue, 25 Nov 2008 04:30:49 +0000

Thank you SOOOOOO MUCH Mike, I have been up for hours trying to fix my hubbies computer and your solution worked like a dream!!!! Thank you

By: Dylan

Dylan — Tue, 25 Nov 2008 04:08:37 +0000

Many thanks Mike, your fix did the trick! Cheers

By: J Moz

J Moz — Mon, 24 Nov 2008 21:00:13 +0000

Had similar problem with almost every google or Yahoo search being directed to random spam or even adult pop-ups/sites. However followed Mike’s instructions above (slightly diff as I’m on Vista) but couldn’t find a file named TDSSserv.sys there.

Any other ideas?

Cheers

By: mike b

mike b — Mon, 24 Nov 2008 18:51:51 +0000

I.m still working through this but your suggestion is the only thing that has allowed Malwarebytes to run….fingers crossed it’ll sort it out but I had to thank you for the progress ater days of pulling my hair out. Many thanks!!!

By: CA$H

CA$H — Sun, 23 Nov 2008 19:28:52 +0000

GOOD LOOKiN OUT MiKE! BEEN TRYiNG 2 FiX THiS 4EVER!

By: Joe

Joe — Sun, 23 Nov 2008 08:33:59 +0000

Thax Mike – u really made it simple – now I see that device with yellow exclaimation mark – what should I do with that?

By: Mark

Mark — Fri, 21 Nov 2008 12:35:16 +0000

Thanks guys! I was trying to get rid of this for days with no help from the guys at AVG. It initially detected the virus but did not stop it completely. Sometimes I wonder what we pay these anti-virus people for? If people on a forum can do it why cant they!!!!!

By: Dave

Dave — Thu, 20 Nov 2008 22:45:43 +0000

Mike – Nicely done. I’m running the scan now, but I’ve at least been able to access the webpages necessary to get to the scan software. I even tried doing things with a downloaded program onto a thumbdrive … couldn’t get that to work. Fingers crossed, but this seems to be doing the trick. Thankfully I had another computer to use in researching this.

By: Tina

Tina — Thu, 20 Nov 2008 14:36:58 +0000

Mike,

Thanks very much – worked perfectly and easier than all the other solutions.

By: codie

codie — Thu, 20 Nov 2008 04:43:20 +0000

Mike,
Repeated scans and uploading different antivirus via removable drives, disabling sytem restore, starting in safe mode, no luck. Your TDSS disable suggestion saved the day, Dr. web program found the virus 30 seconds into the scan. Thanks,Man.

By: eg

eg — Wed, 19 Nov 2008 18:16:50 +0000

I found a suggestion which worked. If the virus isn’t letting you open or run any anti-virus/malware program, rename the setup file. I found when I did it with the Malwarebytes setup file it would actually install. I couldn’t install any anti-virus program because this thing recognized all of them until I tried the rename. I did manage to get rid of the Antivirus2008 malware popup with the free program Avira Antivirus which for some reason loaded while being infected. Malwarebytes did the rest and everything seems back to normal.

By: RM

RM — Wed, 19 Nov 2008 04:26:16 +0000

Mike,

Thanks very much. I tried your suggestion of disabling the TDSSserv.sys and it worked. It stopped routing to the local computer.Then I downloaded Malwarebytes software after disabling the TDSSser.sys, which I could not download earlier before disabling it. The malwarebytes scanned all the trojans and virus infected files. I deleted all those. Then installed a new AntiVirus software that I bought.

Thanks very much. I appreciate it.

By: mike

mike — Mon, 17 Nov 2008 23:18:38 +0000

heres what i found

Go to Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices.

Scroll down to “Non-plug and Play Drivers” and click the plus icon to open those drivers.

Then search for “TDSSserv.sys”

Right click on it, and select “Disable”

Note: If you select Uninstall, it will install itself again when you reboot the system, so DON’T select Uninstall.

Restart your pc.

You can now update your Antirus/Malware/Rootkit softwares and the go.google rubbish will stop.

Its now up to the Anti-Virus/Malware/Spyware companies to make an effort to stop this, and not rely on simple basic home PC user’s like myself to save the world

In simple terms, TDSSserv.sys is a service/server redirecting all software updates to 127.0.0.1 (your own computer) so they won’t update.

By: Noah

Noah — Mon, 17 Nov 2008 00:48:14 +0000

Thanks, it worked for me when no other antispyware programs would!

By: james

james — Sun, 16 Nov 2008 23:25:09 +0000

this is so-far the best resolution for fixing the hijack that i have stumbled across. thank you so much for the advice