Description

CrackedEarth is a homepage- and search-hijacker implemented as an Internet Explorer search hook class and a process run at startup.

Note: older versions of the script at this site would report a false positive of CrackedEarth as being installed when in fact it was ShopNav.

Also known as

SearchHook, after its filename and registry key.

Distribution

Through ActiveX drive-by-download on pop-under adverts, misleadingly described, for example as an MP3 downloader, 'Porno viewer' or 'Internet enhancer'.

What it does

Advertising

Yes. The homepage-hijacker adds a crackedearth.com search bar added to the bottom of your normal start page, and sends address bar searches to genieknows.com via a crackedearth.com frameset. May also add crackedearth.

com bookmarks to your Favorites list.

Privacy violation

No.

Security issues

None known.

Stability problems

None known.

Removal

The files are installed in a folder named 'CrackedEarth' in the root of the system drive. Before you delete them you should deregister the search hook. Open a DOS command prompt window (Start->Programs->Accessories) and enter:

cd "%WinDir%\System"
regsvr32 "\CrackedEarth\searchhook.dll"

Next, open the registry (Start->Run->regedit) and find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Delete the 'SearchHook' value inside this key. You can also delete the key HKEY_CURRENT_USER\Software\SearchHook to clean up.

Finally, delete the CrackedEarth folder and reset your home page.