Thursday 15 September 2011

Remove Excellentsearchserver.com (Uninstall Guide)

Excellentsearchserver.com is a search engine/browser hijacker that returns sponsored search results and redirects users to websites they don't care to see increasing third-party website revenues. Sponsored search has become an integral part of the business model of most search engines, however, excellentsearchserver.com is usually one of the payloads of malicious software known as ZeroAccess (aka MAX++). The infamous rootkit performs various actions and has numerous modules that can spoof search results, install click fraud Trojans and download additional components into the infected machine. So, if your Google search results are suddenly being redirected to excellentsearchserver.com or similar search engines, your computer is infected with ZeroAccess rookit and probably some additional malware. To remove malicious software from your computer, please follow the removal instructions below. Good luck and be safe online!




Excellentsearchserver.com removal instructions

1. Download TDSSKiller and run it. Click Start scan.



2. Click Continue to remove found infections.



3. Reboot your computer to completely remove found malware.



4. Download and run ZeroAccess rootkit removal tool.
5. Download free anti-malware software from the list below and run a full system scan.
NOTE: With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

6. If the problem persists, please read this web document and follow the steps carefully: http://deletemalware.blogspot.com/2010/02/remove-google-redirect-virus.html


Associated Excellentsearchserver.com files and registry values:

Files:
  • C:\Windows\system32\consrv.dll
  • C:\Windows\system32\DRIVERS\mrxsmb.sys
Registry values:
  • SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
Share this information with your friends:

No comments:

Post a Comment