Home Rogue Websites Excellentsearchserver.com

Excellentsearchserver.com

Posted: September 16, 2011

Excellentsearchserver.com is a copy of other types of fake search engines that use the CC Search template to provide you with inaccurate, useless and potentially malicious links. Although it's unlikely that you would ever stumble over Excellentsearchserver.com by yourself, SpywareRemove.com malware research team has noted recent attacks by the ZeroAccess rootkit and related browser hijackers that can redirect you to Excellentsearchserver.com without your consent. These browser redirect attacks can occur at any time, but are most likely to strike when you try to use a Google search. Since any occurrence of an Excellentsearchserver.com redirect attack means that your computer is infected by a potentially-serious PC threat, you should react by resorting to the most competent security tool that you have at hand, to remove Excellentsearchserver.com browser hijackers and associated infections.

The Distinct Lack of Excellence in Excellentsearchserver.com Search Results

Excellentsearchserver.com can easily be seen as a direct copy of other sites that exist as mutated offspring of the malicious CC Search template, a search engine that's used to create artificial traffic and redirect you to valueless and advertisement-driven websites. Some examples of other sites in the same family as Excellentsearchserver.com, include noblesearchserver.com, coolsearchserver.com, coolwebsearch.com, classysearchserver.com and the *dayoftheweek.com sites (which start at 1dayoftheweek.com and go up to 7dayoftheweek.com).

Like all of Excellentsearchserver.com's kin, Excellentsearchserver.com pretends to be a helpful search engine but redirects you to blank websites, websites with advertisement and no useful content, harmful websites that may attack your PC via browser vulnerabilities and websites that otherwise drive revenue back to Excellentsearchserver.com. If you find that your browser has made contact with Excellentsearchserver.com, an Excellentsearchserver.com clone or any website that's linked to Excellentsearchserver.com, you should consider your computer potentially attacked and use suitable security software to double-check for possible infections.

How Excellentsearchserver.com Surfs Its Way to You and Drags You Back with the Tide

The chances of finding Excellentsearchserver.com by yourself are marginal, but Excellentsearchserver.com compensates for that by using browser hijackers to redirect your browser to itself. Excellentsearchserver.com browser hijackers are often included in ZeroAccess. SpywareRemove.com malware research team has noted the following attacks that are likely to accompany any Excellentsearchserver.com or ZeroAccess infection:

  • Browser redirects to Excellentsearchserver.com, especially when you try to use a search engine (such as Google).
  • A homepage that's set to Excellentsearchserver.com; changing your browser settings will fail to combat this unwanted browser alteration.
  • Pop-up advertisements, fake prize-winning pop-ups and pop-ups that market fraudulent software.
  • The presence of rogue security programs; these programs are installed by ZeroAccess and will create fake error messages to lure you into believing that a small army of infections is on your PC.
  • General degradation of your system performance, since ZeroAccess will launch itself by default and take up resources on a constant basis.

You can delete Excellentsearchserver.com browser hijackers and ZeroAccess if you're willing to use a rootkit-removal program, such as a fully-updated anti-malware scanner. However, SpywareRemove.com malware experts forewarn that system scans that take place outside of Safe Mode are likely to be ineffectual at removing all components of an Excellentsearchserver.com infection.

Technical Details

File System Modifications

The following files were created in the system:



C:\Windows\system32\DRIVERS\mrxsmb.sys File name: C:\Windows\system32\DRIVERS\mrxsmb.sys
File type: System file
Mime Type: unknown/sys
C:\Windows\system32\consrv.dll File name: C:\Windows\system32\consrv.dll
File type: Dynamic link library
Mime Type: unknown/dll

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
Loading...