Exallambous.com is a browser hijacker that redirects users to unwanted websites and search engines, modifying browser settings without explicit permission. This potentially unwanted program (PUP) typically infiltrates systems bundled with free software downloads and immediately takes control of the user's default homepage, new tab page, and search provider. While not a virus in the traditional sense, it degrades system performance, exposes users to questionable advertising networks, and makes browsing frustrating by constantly redirecting search queries through suspicious intermediary pages.
Like most browser hijackers, Exallambous.com generates revenue for its operators by forcing traffic through partner advertising networks and affiliate links. The hijacker tracks browsing activity and search queries to serve targeted ads, and the redirects often lead through multiple hops before reaching a final destination—each hop generating revenue. Users typically notice the infection when their browser suddenly opens to Exallambous.com instead of their chosen homepage, or when every search goes through unfamiliar search engines that deliver poor-quality results mixed with excessive advertising.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Type | Browser Hijacker, Potentially Unwanted Program (PUP) |
| Family | Generic browser hijacker family, behavior consistent with search redirect malware |
| Aliases | Exallambous redirect, Exallambous.com virus (misnomer) |
| Affected Platforms | Windows 7/8/10/11; targets Chrome, Firefox, Edge, and Internet Explorer via extensions and policy modifications |
| Distribution Methods | Software bundling, fake software updates, deceptive download buttons on free-software sites |
| Persistence Mechanisms | Browser extensions, scheduled tasks, registry Run keys, Group Policy modifications (on Chrome/Edge) |
| Primary Capabilities | Homepage/search engine redirection, new tab hijacking, search query interception, affiliate link injection, browsing history tracking |
| Data at Risk | Browsing history, search queries, potentially form data through third-party ad networks |
| Network Behavior | Frequent connections to advertising networks, redirect chains through multiple domains, potential connections to tracking beacons |
| Typical Artifacts | Browser extensions with random names, scheduled tasks for reinstallation, modified browser shortcuts with appended URLs |
| User Impact | Degraded browsing experience, slower page loads, exposure to malvertising, potential privacy violations |
| Removal Difficulty | Moderate; reinstalls itself if all components aren't removed, particularly resistant when using Group Policy on Chrome/Edge |
How It Spreads
Exallambous.com spreads primarily through software bundling—the practice of packaging unwanted programs with legitimate free software. When users download video converters, PDF tools, or codec packs from third-party download sites, the installer often includes "optional offers" that install browser hijackers. These offers are frequently presented with pre-checked boxes or misleading language that makes them appear required, and clicking through the installation quickly without reading each screen typically results in infection. The hijacker developers pay these bundling services to distribute their software, creating a revenue stream that makes browser hijacking profitable despite user frustration.
Another common distribution vector involves fake software updates and malicious advertising. Users visiting questionable streaming sites or file-sharing platforms may encounter pop-ups claiming their Flash Player, video codec, or browser is out of date. Clicking these fake update notices downloads an installer that may contain Exallambous.com alongside other PUPs. Similarly, some websites employ deceptive design that places large "Download" buttons—actually advertisements—directly above the legitimate download link, tricking users into clicking the wrong button and starting an unwanted installation.
Distribution methods include:
- Software bundlers: Free download sites like Softonic, Download.com variants, and similar platforms that repackage installers with added "offers"
- Fake update notifications: Pop-ups on streaming sites and piracy platforms claiming Flash Player, Chrome, or media codecs need updating
- Deceptive advertising: Misleading download buttons on legitimate-looking software sites that install hijackers instead of requested programs
- Torrent payloads: Cracked software installers and keygens that bundle hijackers with the pirated application
- Malicious browser extensions: Extensions in official stores (before removal) that promise useful features but hijack search after installation
- Email attachments: Less common for this family, but some variants distribute through spam with fake invoice PDFs containing dropper scripts
What It Does On Your Machine
Once installed, Exallambous.com immediately modifies browser settings to redirect all web traffic through its domain. The hijacker changes your default homepage to Exallambous.com or an intermediary page, replaces your search engine with a suspicious alternative (often a white-label version of Yahoo or Bing that funnels searches through affiliate networks), and sets your new tab page to display advertising content. These changes apply to all installed browsers—Chrome, Firefox, Edge, and Internet Explorer—making system-wide impact within minutes of infection. The hijacker's persistence mechanisms ensure these settings revert even when you manually change them back, creating a frustrating cycle of repeated modifications.
The redirection behavior follows a predictable pattern. When you type a search query, the hijacker intercepts it before sending it to any legitimate search engine. Your query travels through Exallambous.com, then typically through one or two additional redirect domains, before finally reaching a search results page. Each hop in this chain generates revenue for the operators through affiliate fees or advertising impressions. The final search results often come from legitimate engines like Yahoo, but are modified to inject additional sponsored links at the top of the page. These injected links look like organic results but lead to advertiser sites that pay per click, generating even more revenue while degrading your search experience with low-quality results.
Beyond the visible browser changes, Exallambous.com installs persistence mechanisms throughout the system. The hijacker typically drops a support executable in a randomly-named folder within your user profile, creates scheduled tasks to re-apply browser modifications if you try to remove them, and may install one or more browser extensions that monitor and enforce the hijacked settings. In Chrome and Edge, more sophisticated variants use Enterprise Policy to lock settings, displaying a "Managed by your organization" message in the browser menu even on home computers. This policy approach is particularly difficult to remove because it operates at a deeper level than typical extensions or registry modifications.
The hijacker also monitors your browsing activity to generate revenue from data collection. It logs every search query you type, every URL you visit, and potentially form data entered on websites. This information feeds into advertising networks that build profiles for targeted marketing. While Exallambous.com itself may not steal banking passwords or credit card numbers, the data collection creates privacy risks and the redirects expose you to malicious advertising networks that might. Some of the partner sites in the redirect chain are known to host exploit kits or push additional malware downloads, turning a simple browser hijacker into a gateway for more serious infections.
Manual Removal — Step by Step
Disconnect and Document
Disconnect your computer from the internet—unplug the Ethernet cable or disable Wi-Fi. This prevents the hijacker from downloading additional components or re-configuring itself during removal. Open Notepad and write down your current browser homepages and search engines (if you can still see the legitimate ones), plus note any suspicious browser extensions you see. Take a screenshot of your browser's Extensions page for reference.
Boot to Safe Mode with Networking
Restart your computer and boot into Safe Mode with Networking. On Windows 10/11, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart, and press 5 or F5 to select Safe Mode with Networking. This loads Windows with minimal drivers and prevents the hijacker's background processes from running, making removal significantly easier and preventing immediate reinstallation.
Uninstall Suspicious Programs
Open Control Panel > Programs > Programs and Features (or Settings > Apps on Windows 10/11). Sort by "Installed On" date and look for unfamiliar programs installed around the time you first noticed the hijacker. Common names include random-looking entries, programs claiming to be "Web Companions," "Search Managers," or utilities with generic names. Uninstall anything suspicious, especially items installed on the same day from unknown publishers. Decline any offers during uninstallation to "save your settings" or install alternative software.
Remove Browser Extensions
Open each browser you use and remove all unfamiliar extensions. In Chrome, navigate to chrome://extensions/, enable "Developer mode" in the top right, then remove any suspicious extensions—note the extension ID (long alphanumeric string) before removal. In Firefox, go to about:addons, select Extensions, and remove unknowns. In Edge, visit edge://extensions/ and repeat the process. Pay special attention to extensions installed recently or those lacking descriptions and publisher information. Don't skip browsers you rarely use—hijackers install everywhere.
Clear Group Policy Settings
Open Registry Editor (press Windows+R, type regedit, press Enter). Navigate to HKEY_CURRENT_USER\Software\Policies\Google\Chrome and HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome. If these keys exist, check for values like "HomepageLocation," "RestoreOnStartupURLs," or "DefaultSearchProviderSearchURL." Delete any entries pointing to Exallambous.com or unfamiliar domains. Repeat for HKEY_CURRENT_USER\Software\Policies\Microsoft\Edge and HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge. If the entire Policies key was created by the hijacker (no other legitimate policies exist), you can delete the entire Chrome or Edge key.
Remove Persistence Mechanisms
Open Task Scheduler (search for it in the Start menu). Look in Task Scheduler Library for tasks with suspicious names, especially those running hourly or at login. Check the "Actions" tab for each suspicious task—if it points to a randomly-named executable in your user profile's AppData folders, delete the task. Then open Registry Editor again and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Look for entries with random names or pointing to executables in AppData\Local or AppData\Roaming folders. Delete any suspicious entries. Finally, check your browser shortcuts—right-click each browser icon, select Properties, and look at the Target field. If there's anything appended after the .exe (like --homepage=http://exallambous.com), remove everything after chrome.exe, firefox.exe, or msedge.exe, then click OK.
Delete Hijacker Files
Open File Explorer and navigate to C:\Users\YourUsername\AppData\Local\. Look for folders with random GUID names (like {A2C3D4E5-1234-5678-9ABC-DEF012345678}) or generic names created recently. Open each suspicious folder and check for executables—if you see files named things like "background.exe," "updater.exe," or "service.exe," note the folder path. Close all programs, then delete these entire folders. Repeat the process in C:\Users\YourUsername\AppData\Roaming\. If Windows says the file is in use, you didn't fully stop the processes—reboot to Safe Mode again and retry.
Reset Browser Settings
Reconnect to the internet. In Chrome, go to Settings > Reset settings > Restore settings to their original defaults, then click Reset. In Firefox, type about:support in the address bar, click "Refresh Firefox," and confirm. In Edge, go to Settings > Reset settings > Restore settings to their default values. This removes remaining hijacker configurations in browser preference files. After reset, manually configure your preferred homepage and search engine—don't rely on automatic restoration as the hijacker may have corrupted saved preferences.
Run Malwarebytes
Download and install Malwarebytes Free from malwarebytes.com (verify the URL carefully—don't click ads). Run a full Threat Scan. Malwarebytes excels at catching browser hijacker remnants and associated PUPs that manual removal might miss, including registry entries and hidden browser preferences. Quarantine everything it finds. If Malwarebytes detects additional threats beyond what you removed manually, you likely have multiple infections—consider bringing the machine to the shop rather than continuing manual removal.
Verify and Change Passwords
Restart your computer normally (not Safe Mode) and test your browsers. Visit a few sites and confirm your homepage, search engine, and new tab page are working correctly. Open Task Manager (Ctrl+Shift+Esc) and check the Startup tab—disable anything suspicious that's set to run at login. If everything looks clean, change passwords for important accounts, particularly if you entered any passwords while the hijacker was active. Browser hijackers sometimes work with keyloggers or form-grabbers, so treat any credentials entered during infection as potentially compromised.
Prevention
- Download software from official sources only. Avoid third-party download sites like Softonic, Download.com clones, and file-sharing platforms. Go directly to the developer's official website. When searching for software, typing "[program name] official site" usually surfaces the legitimate source above ad-laden alternatives.
- Use custom installation and read every screen. Never click "Express," "Quick," or "Recommended" installation options. Always choose "Custom" or "Advanced" installation, then read each screen carefully. Uncheck any pre-checked boxes offering toolbars, browser extensions, homepage changes, or "partner software." If an installer doesn't offer custom options, consider that software suspect.
- Keep browsers and Windows updated. Enable automatic updates for Windows, Chrome, Firefox, and Edge. Updated software closes security vulnerabilities that allow drive-by downloads and reduces the attack surface for exploit kits. Most modern browsers also include improved hijacker protection when fully updated.
- Install uBlock Origin or similar ad-blocker. A good ad-blocker prevents malicious ads from displaying on legitimate sites, eliminating a major distribution vector for hijackers and other malware. Configure it to block ads by default but whitelist trusted sites you want to support. This single step prevents the majority of fake update notifications and deceptive download buttons.
- Don't ignore unfamiliar program installs. If a program installer appears when you didn't deliberately download anything, don't click through it out of curiosity. Close the installer immediately, run a malware scan, and investigate what triggered it. Browser hijackers often chain-install—the first infection downloads the second.
- Create a standard user account for daily use. On Windows, create a separate administrator account for maintenance tasks and use a standard (non-admin) account for daily browsing and work. Standard accounts can't install software without your admin password, blocking most automated hijacker installations. This approach requires more discipline but dramatically reduces infection risk.
- Be skeptical of browser extension requests. Only install extensions from official browser stores, read reviews carefully, and check the developer information. If an extension requests excessive permissions (like "read and change all your data on websites you visit"), question whether its functionality justifies that access. Uninstall extensions you don't actively use—every extension is a potential security risk.
- Run periodic scans with Malwarebytes. Schedule a monthly scan with Malwarebytes Free even if you're not experiencing symptoms. PUPs and hijackers often operate quietly in the background for weeks before symptoms become obvious. Catching them early limits data exposure and prevents them from downloading additional malware components.
When Computer Repair Roswell removes malware from your system, we back our work with a 90-day warranty. If the same infection returns within 90 days, we'll re-clean your machine at no additional charge. We also include preventative measures: software updates, removal of unnecessary programs that create vulnerability, and browser configuration to reduce future infection risk. Our goal isn't just cleaning the current infection—it's making sure you don't get infected again next week.
Bring It In
Manual removal works for technically comfortable users who can follow detailed instructions, but it's time-consuming and risky if you miss components. The hijacker's persistence mechanisms specifically defend against manual removal—scheduled tasks reinstall files, policy settings revert manual browser changes, and hidden executables restart processes you've killed. If you've tried the steps above and the hijacker keeps coming back, or if you're not confident working in the registry and Task Scheduler, professional removal is the faster and safer option. At Computer Repair Roswell, we see browser hijackers daily and can identify all components quickly using specialized tools and techniques that go beyond what's practical for home users.
We're located on Alpharetta Street in Roswell, just north of the historic downtown area. Bring your infected computer in—no appointment required during business hours, though calling ahead at (770) 695-6860 ensures we can start work immediately. Most hijacker removals take 1-2 hours, and we'll have your machine browsing normally again by end of day. We'll also check for the additional PUPs and malware that frequently travel with browser hijackers, update your security software, and configure your browser to make reinfection less likely. Getting your computer professionally cleaned costs less than the time you'll waste fighting persistent infections and rebuilding your system after incomplete removal attempts cause Windows instability.