CrackedEarth

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Detection and Removal ·
· Research ·

Overview

Vendor Notes:

 from the doc " CrackedEarth is a homepage- and search-hijacker implemented as an Internet Explorer search hook class and a process run at startup."

Alias:

 Adware/LiveCam [Panda]

Category:

Hijacker: Any software that resets your browser's settings to point to other sites. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower.

Similar Pests:

 Hijacker

Origins

Date of Origin:

 June, 2003

Distribution

Prevalence:
  • CrackedEarth: < 0.00005%
    • More Info

    Clot Factor:
  • CrackedEarth: 1

    • The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

    Growth:
  • CrackedEarth: Insufficient data to report growth
    		•

    Operation

    Storage Required:
  • CrackedEarth: at least 493 KB
    		•

    Browser Performance:

    		 Likely to slow performance of Internet Explorer.

    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    		 The files are installed in a folder named 'CrackedEarth' in the root of the system drive. Before you delete them you should deregister the search hook. Open a DOS command prompt window (Start->Programs->Accessories) and enter: cd "%WinDir%\System" regsvr32 "\CrackedEarth\searchhook.dll" Next, open the registry (Start->Run->regedit) and find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Delete the 'SearchHook' value inside this key. You can also delete the key HKEY_CURRENT_USER\Software\SearchHook to clean up. Finally, delete the CrackedEarth folder and reset your home page.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Unregister DLLs:

    Unregister these DLLs with Regsvr32, then reboot:

    Clean Registry:

    Remove these registry items (if present) with RegEdit:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Restore Settings:

    After following the instructions above, you will still need to restore your original settings and prevent this from happening again. Here''s how.

    Research

    File Analyses:

    More Info:
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 April 15, 2005