Home Malware Programs Browser Hijackers Njksearc.net

Njksearc.net

Posted: September 26, 2011

Njksearch.net is a fake search engine website and search engine hijacker, similar to findgala.com, startsear.ch, Seeearch.com, Partner12.mydomainadvisor.com/search.php and licosearch.com. SpywareRemove.com malware experts strongly advise you to use appropriate anti-malware products to delete Njksearch.net browser hijackers and related infections, since improper deletion of Njksearch.net infections has been known to cause damage to Windows itself. The dominant symptom of a Njksearch.net attack is being redirected from a popular search engine, such as Google, towards Njksearch.net and, from there, to a random and potentially hostile site. Njksearch.net-affiliated infections are also capable of using multiple methods to redirect your web browser, such as by hijacking your Windows Hosts file or by using a proxy server and so you shouldn't fritter your time away repairing your browser to stop these attacks.

Njksearch.net - a Hijacker for All Your Search Engine Choices

Njksearch.net has been known to target Google, Bing, Yahoo and MSN search engines without discrimination, all with the purpose of redirecting you to itself. Being redirected to Njksearch.net from one of these search engines is a sign of infection by a browser hijacker. If you see this symptom, you should respond with appropriate usage of PC security application. SpywareRemove.com malware researchers also note that it's possible to tell if Njksearch.net is tampering with your search results without clicking on a Njksearch.net-contaminated link – simply highlight the search result's link and look at the URL that displays. A link that's been hijacked by Njksearch.net will display an improper URL (such as [URL for search engine in use]/go?[Random number] or, for a specific example, google.com/go?123912).

Visual side effects of a Njksearch.net redirect attack can include:

  • A "The document has moved, redirecting..." message that appears after you click a link.
  • A spinning wheel graphic that displays the word "Loading..." after you click a link.

If you think that Njksearch.net has hijacked your search results, you should avoid using Njksearch.net-hijacked links, since these links may force you towards phishing websites, sites that sell scamware or websites that can attack your PC with drive-by-download scripts. Redirects by Njksearch.net typically will take you to Njksearch.net before they send you to a random and harmful site that's unrelated to your actual search query.

How Njksearch.net Gets Into Your Browser Any Way That It Can

Njksearch.net browser hijackers are often associated with rootkits, such as ZeroAccess, TDL3, TDSS and TDSS variants (such as Rootkit TDSS.d and TDSS.e!rootkit). SpywareRemove.com malware researchers have found that such infections are capable of running even without obvious signs of being active, so you should assume that Njksearch.net infections are active, unless you've taken specific steps, such as Safe Mode, to stop them.

Njksearch.net hijackers can also alter the Windows Hosts file's IP-to-URL mappings and prevent you from editing the file back to its original values, even if you're logged in as the Windows administrator. Typical error messages that accompany a Njksearch.net infection blocking you from your own Hosts file include 'this file is read-only' and 'file path could not be found.'

A second method of Njksearch.net attack is via alterations to your browser settings that force your browser to use a proxy server. Changing these settings will fail to undo the actual Njksearch.net infection and you should try to delete a Njksearch.net browser hijacker before you try to undo the damage that Njksearch.net caused.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%WINDOWS%\System32\Drivers\mrxsmb.sys File name: %WINDOWS%\System32\Drivers\mrxsmb.sys
File type: System file
Mime Type: unknown/sys
%WINDOWS%\System32\consrv.dll File name: %WINDOWS%\System32\consrv.dll
File type: Dynamic link library
Mime Type: unknown/dll

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
Loading...