Do you know what Trojan.Redirector is?
Trojan.Redirector is a dangerous infection that enters computers without permission. As it tends to enter computers secretly, many users do not know that they have it installed on their computers for a long time. Even though users have no idea that this threat is installed on their systems, they notice soon that something is wrong. The entrance of Trojan.Redirector means that a bunch of annoying advertisements, e.g. banners and pop-ups will start appearing on your screen. Users who see these ads tend to believe that they appear on their screens because they have an advertising-supported application (adware) installed on their computers or they have opened a web page showing advertisements, so Trojan.Redirector can work on the system for some time until it is detected and removed. Trojans are serious computer infections, so do not expect to get rid of this threat easily too. We know that many users will not be able to erase Trojan.Redirector manually alone because it applies many changes once it enters the computer. We cannot say that it will be easy but you should be able to remove Trojan.Redirector yourself with our help. Continue reading to find out why it must be deleted and how to do that easily and quickly.
It is evident that this infection does not want to be removed, and it does everything to stay on the system. For example, research carried out by our team of specialists has shown that it creates the point of execution folder in %WINDIR%\System32\Tasks and %WINDIR%\Tasks to be able to open reset.txt and update.txt scripts (you will find them in %COMMONPROGRAMFILES(x86)% and %COMMONPROGRAMFILES% directories). They are opened so that the Trojan would be able to reset the proxy set on Internet Explorer with every system restart. In other words, the Trojan.Redirector will still be active and will be able to set the proxy for the Internet Explorer browser again after the computer restart despite the fact that you undo the changes in the Local Area Network (LAN) Settings panel.
Trojan.Redirector screenshot
Scroll down for full removal instructions
To be able to show advertisements on your screen or even spy on you, Trojan.Redirector changes the data of the AutoConfigURL Value in the [HKLM/HKCU]\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS registry key. It does that to force the Internet Explorer browser to use the automatic configuration script. Once Trojan.Redirector modifies the aforementioned Value, the default settings in the Local Area Network (LAN) Settings window are changed too, for example, you will see http://wpad.com.gr/server.pac in the Address line, and two options Automatically detect settings and Use automatic configuration script will be enabled. The only way to undo those changes and make sure that they are not applied again without permission is to fully delete Trojan.Redirector. You will find out more about that in the last paragraph.
Before we tell you how Trojan.Redirector is distributed and how to delete it from the system, we want that you know why it makes all those modifications. According to our researchers, it just does that to display advertisements and replace the trustworthy search results of popular search engines with the sponsored ones. As our extensive research has shown, the only reason why Trojan.Redirector acts like this is to help cyber-criminals to earn money. Of course, a user will not get anything from that.
Trojans usually enter computers without permission. Trojan.Redirector is no exception. Our team of specialists has tested it thoroughly and found that this computer infection might borrow a name of a legitimate application or a cracked version of some kind of program, e.g. WinRAR 5.11 Final, WinRAR 5.2 msi, and Youtube Downloader 1.0.1. Users believe that the program is harmless and download it without fear. This is the major mistake they make.
It will not be easy to delete Trojan.Redirector fully because this threat makes many modifications on the infected computer. Therefore, we suggest that you use the manual removal guide you find below this article. If you do not trust yourself and do not think that you can get rid of it fully yourself, you should simply scan your computer with SpyHunter. It will make your computer clean within seconds.
Delete Trojan.Redirector manually
- Open the Windows Explorer (Win+E).
- Go to %COMMONPROGRAMFILES(x86) or %COMMONPROGRAMFILES%.
- Remove reset.txt and update.txt.
- Open %WINDIR%\System32\Tasks or %WINDIR%\Tasks.
- Delete the Task that has Adobe Flash in its name, e.g. Adobe Flash Scheduler or Adobe Flash Update.
- Close Explorer and tap Win+R simultaneously.
- Type regedit.exe and click OK.
- Move to HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS and HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS .
- Right-click on the AutoConfigURL Value and select Modify.
- Empty the Value data. Click OK.
In non-techie terms:
Internet is a dangerous place, so if you surf the web every day, you should not forget to install a reliable security tool on the computer. Our security specialists suggest being careful with software that is promoted on third-party websites too because you might install malware instead of a decent file or a program from such a web page. Of course, nobody will warn you about the dangers in advance.