Removal of Fastsfind.com Redirect Virus

Printer Friendly Version

Why Do My Google Searches Always Go To Fastsfind.com?

Most likely your computer is infected with a form of a Google Redirect Virus. In my case, my customers system had become infected with a rogue antispyware application. After removing this infection with a combination of MalwareBytes AntiMalware and Combofix, the google redirection still was causing all searches in Google to go to a combination of sites including Fastsfind.com. All logs from the removal tools showed absolutely nothing but the infection remained.

How Do I Know I Have a Google Redirect Virus on My System?

Try to search Google for something and click on the various search results that show up, if none of the results allow you to go to the appropriate site, you are infected. Instead you'll be redirected to sites like:

Also, when I opened Task Manager there were two instances of Iexplore.exe running even though I did not have Internet Explorer open at the time. There were also two instances of SVCHost.exe open when all other programs were closed. These multiple instances of system files open led me to a rootkit infection. Many times I have found Combofix to be extremely useful in removing issues like this but it did not find anything in this case.

Can I Remove the Fastsfind.com Redirect?

Follow these steps in order to restore internet access, check your hosts file, and finally delete the rootkit.

Fix Proxy Settings

1) Open Internet Options in the Control Panel or via Tools menu in Internet Explorer
2) Click on the Connections tab
3) Click on LAN Settings
4) Uncheck the "Use a Proxy Server for your LAN" setting. Especially if the address spot is blank.
5) Click OK

Proxy Lan Settings

3) Download RKill from Bleeping Computer to your desktop. Double-click on it and run it. This program will try to kill any malicious processes currently running on your system.

Check Hosts File

Follow the steps on my page about how to check or reset the Hosts File

Remove the Fastsfind.com Redirect with TDSSKiller

Kaspersky Labs has created a removal tool called TDSSKiller to remove the Google Redirect Virus. Follow these steps to download and run it. In some cases, you may have to run it in Safe Mode with Networking to remove it.

1) Download TDSSKiller, unzip it, and Save it to your desktop.

2) Double-click on TDSSKiller.exe to run. If the program does not run, you may have to rename it to something like explore.exe, 123.exe, or something else before running it. The virus is trying to block the program from running, so renaming it will in some cases allow it to run.

3) Click on the Start button to start a scan and allow it to completely run

4) Allow TDSSKiller to fix any issues it finds and reboot the computer afterward

5) After reboot, try Google and see if the redirect it gone.

For more detailed information on TDSSKiller visit the Kaspersky page

Results from TDSSKiller

In my case, TDSSKiller would not run. I tried renaming it and even running it in Safe Mode, but the program refused to load. Actually the redirect problem was blocking TDSSKiller from running. So, I had to run another program..

Fixing the Google Redirect with Symantec's FixTDSS.exe

In a few circumstances, I have been unable to run TDSSKiller even after renaming it. In these cases, I have turned to the other removal tool that works, FixTDSS by Symantec. Follow these steps to download and run it.

1) Download the FixTDSS.exe tool from Symantec and save it to your desktop

2) Double-click on FixTDSS.exe and run it

3) Click Start to begin the process, and then allow the tool to completely run

4) Restart the computer when prompted

5) After reboot, the program will give you the results of the scan and cleaning.

6) Try Google and see if the redirect virus is gone.

For more detailed information on FixTDSS visit the Symantec page.

After running the FixTDSS file from Symantec and rebooting the computer, the redirect was gone. The log report from FixTDDS.exe showed an infection in a Windows system driver called Volsnap.sys. Which is the Volume Shadow Copy Driver used to make System Restore Backups. The FixTDDS program was able to cure the infection and restore the system to normal.

Run a Thorough Virus Scan

Finally, as an extra precaution, scan your computer with online virus scanner like Housecall, BitDefender, or eTrust or download and install an antivirus program and run a complete scan. A list of online scanners is below, some however will only scan but not remove issues.

Online Virus Checkers
Trend Micro Housecall - will scan and remove threats
BitDefender Scan Online - will scan and remove threats
ESet (NOD32) Online Scanner
Kaspersky Online Scan - will scan and remove threats
Panda Activescan - appears to only scan for but not remove threats
McAfee FreeScan - appears to only scan for but not remove threats
eTrust Antivirus Web Scanner - will scan and remove threats
Symantec Security Check - will scan and remove threats
Dr.Web Online Check - user can upload and test for threats on particular files

Trojan Scanner
TrojanScan by WindowsSecurity.com

Spyware Scanners
Malwarebytes AntiMalware
Super AntiSpyware
Spybot Search and Destroy

Congratulations! Your computer should be free of the Fastsfind.com redirect problem!

Search PCHell.com