Home Rogue Websites Splendidsearchserver.com

Splendidsearchserver.com

Posted: September 23, 2011

Splendidsearchserver.com is a fake search engine site that's closely-tied to identical CC Search sites that utilize similar attacks and scams. Although Splendidsearchserver.com pretends to give you relevant search results and even displays large groups of topical links on Splendidsearchserver.com's default page, SpywareRemove.com malware analysts have found that Splendidsearchserver.com only has Splendidsearchserver.com's eye on infecting your PC and exposing you to harmful advertisements. Links from Splendidsearchserver.com can redirect you to fake account login sites, sites that sell fake software, sites that display fake warnings or other misleading messages and even sites that install software by exploiting browser security limitations. Since visits to Splendidsearchserver.com may also cause you to become infected by browser hijackers that redirect you to Splendidsearchserver.com on a regular basis, you should scan your system for potential infections even if you've only had brief contact with Splendidsearchserver.com.

The Lack of Splendor in Splendidsearchserver.com's Links

Unlike the real search engines that Splendidsearchserver.com mimics, Splendidsearchserver.com doesn't search the web for relevant links to provide for your searches. Rather than doing this, Splendidsearchserver.com will link you to websites that suit Splendidsearchserver.com's own purposes – such as advertisement-revenue sites, sites that sell scamware and websites that install harmful programs without your consent. Disabling scripts for suspicious sites and avoiding any contact with Splendidsearchserver.com, or Splendidsearchserver.com's duplicate websites, classysearchserver.com, coolsearchserver.com, excellentsearchserver.com, Famousservesearcher.com, Supersearchserver.com or Wickedsearchsystem.com will help you keep your PC clean of Splendidsearchserver.com-related problems.

If you do come into contact with Splendidsearchserver.com, SpywareRemove.com malware research team advises you to be wary of the following attacks, which have been linked to Splendidsearchserver.com and similar fraudulent search sites:

  • Rogue security programs that create inaccurate infection warnings before they install themselves on your PC (generally through pop-ups and drive-by-download script exploits). Rogue security products may look identical to normal anti-virus scanners and other PC security software, but they create false positives instead of providing real security information.
  • Phishing sites that try to steal your account login data by imitating the appearance of a legitimate site. In most cases, you can differentiate between a copycat phishing site and a real website by looking for the appropriate URL.
  • Websites that display irrelevant or malicious advertisements, including pop-ups. A typical example of a misleading Splendidsearchserver.com is one that prompts you to visit a site to win a prize or to qualify for a contest.

The Hidden Software Side of Splendidsearchserver.com

Although finding Splendidsearchserver.com by accident is relatively unlikely, SpywareRemove.com malware experts have noted that Splendidsearchserver.com and Splendidsearchserver.com's mirror sites have been known to use browser hijackers to inflate their traffic. Browser hijackers redirect your browser to Splendidsearchserver.com or other harmful sites and are especially likely to attack during an attempt to use a search engine. They may also cause pop-ups, block websites, insert links or even monitor your online activities.

Splendidsearchserver.com-related browser hijackers are also a common branch of broader types of infections, such as ZeroAccess or TDSS rootkits. You can remove even serious Splendidsearchserver.com-infections with up-to-date security software, but SpywareRemove.com malware researchers recommend Safe Mode prior to any attempt to delete Splendidsearchserver.com software. Rootkits and equally-stealthy infections may remain active if you use a normal Windows boot, which can allow them to avoid deletion.

Technical Details

File System Modifications

The following files were created in the system:



%windir%\system32\config\malicious file of splendidsearchserver.com File name: %windir%\system32\config\malicious file of splendidsearchserver.com
File type: Command, executable file
Mime Type: unknown/com
%Windows%\system32\consrv.dll File name: %Windows%\system32\consrv.dll
File type: Dynamic link library
Mime Type: unknown/dll
%Windows%\system32\DRIVERS\mrxsmb.sys File name: %Windows%\system32\DRIVERS\mrxsmb.sys
File type: System file
Mime Type: unknown/sys
Globalroot\Device\svchost.exe\svchost.exe File name: Globalroot\Device\svchost.exe\svchost.exe
File type: Executable File
Mime Type: unknown/exe

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Run "[RANDOM CHARACTERS].exe"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains of TDL4 Rootkit
Loading...