Home Malware Programs Browser Hijackers Crownhub.com

Crownhub.com

Posted: December 13, 2011

Crownhub.com Screenshot 1Crownhub.com is a fraudulent e-search website that pretends to offer helpful links for your search queries while, in reality, Crownhub.com hands out potentially-dangerous links to sites that produce profit for itself. Any exposure, no matter how brief, to Crownhub.com should be taken as a potential route for infection, and you should scan your PC with suitable anti-malware software after even brief contact with Crownhub.com or a similar website. Crownhub.com's primary form of traffic comes through browser redirect attacks that redirect online searches to Crownhub.com and its affiliates. Since browser hijackers for Crownhub.com can attack a variety of browsers and may include high-level PC threats such as Trojans or rootkits, SpywareRemove.com malware researchers recommend that you find and remove Crownhub.com-affiliated infections with a trustworthy and updated anti-malware scanner.

Traveling the World... with Crownhub.com Showing You Unpleasant Destinations

Crownhub.com has the look of a real search engine, but behind its green globe and sleek interface, you'll find that Crownhub.com doesn't have any interest in giving you relevant or safe links. Despite its appearance, Crownhub.com lacks all of the safety measures and intricate sorting algorithms that real search engines use, and SpywareRemove.com malware experts note that Crownhub.com can be considered nothing more than a gateway to other types of hostile sites. Links that are related to Crownhub.com may be responsible for:

  • Phishing attacks that try to steal personal information (such as your e-mail address, location or credit card number). Phishing-based websites are often disguised in the form of fake contests, polls or account login forms.
  • Drive-by-download attacks that install malicious software without permission. Preventing JavaScript, Flash and other types of scripts from running by default can help to reduce the risk of these attacks.
  • Fake infection alerts, pop-up warnings, fraudulent scanners and other types simulated warnings that are designed to make you believe that your computer is infected with a PC threat that isn't present.

How to Opt Out of Crownhub.com's E-Vacation Plans

Crownhub.com is also associated with browser hijackers that may redirect your browser to Crownhub.com even if you're trying to find an unrelated website (particularly in the case of popular search engines like Google). Since browser hijackers for Crownhub.com may be accompanied by other types of PC threats, SpywareRemove.com malware researchers discourage any attempt to remove a Crownhub.com-affiliated infection without an appropriate anti-malware product. You may also need to use Safe Mode or another method of disabling the infection before complete removal can proceed and disinfect your PC.

Redirects to Crownhub.com may also redirect you to clones of the Crownhub.com website such as QuestDNS.com, QueryExplorer.com, QueryScan.com, Papergap.com, ScanBasic.com. You should consider all of these sites to be equally-harmful to your PC and avoid both them and their affiliates to keep your PC safe from drive-by-download assaults and other forms of browser-based danger.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%AppData%Crownhubtoolbarpreferences.dat File name: %AppData%Crownhubtoolbarpreferences.dat
File type: Data file
Mime Type: unknown/dat
%AppData%Crownhubtoolbarstat.log File name: %AppData%Crownhubtoolbarstat.log
Mime Type: unknown/log
%AppData%Crownhubtoolbarstats.dat File name: %AppData%Crownhubtoolbarstats.dat
File type: Data file
Mime Type: unknown/dat
%AppData%CrownhubtoolbaruninstallIE.dat File name: %AppData%CrownhubtoolbaruninstallIE.dat
File type: Data file
Mime Type: unknown/dat
%AppData%Crownhubtoolbardtx.ini File name: %AppData%Crownhubtoolbardtx.ini
Mime Type: unknown/ini
%AppData%Crownhubtoolbarguid.dat File name: %AppData%Crownhubtoolbarguid.dat
File type: Data file
Mime Type: unknown/dat
%AppData%Crownhubtoolbarlog.txt File name: %AppData%Crownhubtoolbarlog.txt
Mime Type: unknown/txt
%AppData%CrownhubtoolbaruninstallStatIE.dat File name: %AppData%CrownhubtoolbaruninstallStatIE.dat
File type: Data file
Mime Type: unknown/dat
%AppData%Crownhubtoolbarcouponscategories.xml File name: %AppData%Crownhubtoolbarcouponscategories.xml
Mime Type: unknown/xml
%AppData%Crownhubtoolbarcouponsmerchants.xml File name: %AppData%Crownhubtoolbarcouponsmerchants.xml
Mime Type: unknown/xml
%AppData%Crownhubtoolbarcouponsmerchants2.xml File name: %AppData%Crownhubtoolbarcouponsmerchants2.xml
Mime Type: unknown/xml
%AppData%Crownhubtoolbarversion.xml File name: %AppData%Crownhubtoolbarversion.xml
Mime Type: unknown/xml
%Temp%Crownhubtoolbar-manifest.xml File name: %Temp%Crownhubtoolbar-manifest.xml
Mime Type: unknown/xml

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINESOFTWAREClassesCrownhubIEHelper.DNSGuardCurVerHKEY_LOCAL_MACHINESOFTWAREClassesCrownhubIEHelper.DNSGuardCLSIDHKEY_LOCAL_MACHINESOFTWAREClassesCrownhubIEHelper.DNSGuardHKEY_LOCAL_MACHINESOFTWAREClassesCrownhubIEHelper.DNSGuard.1HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar "Crownhub Toolbar"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7} "Crownhub Toolbar"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{99079a25-328f-4bd4-be04-00955acaa0a7}InprocServer32 "C:PROGRA~1WINDOW~4ToolBarCrownhubdtx.dll"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}VersionIndependentProgID "CrownhubIEHelper.UrlHelper"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}ProgID "CrownhubIEHelper.UrlHelper.1"HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A40DC6C5-79D0-4ca8-A185-8FF989AF1115} "UrlHelper Class"HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{99079a25-328f-4bd4-be04-00955acaa0a7} "Crownhub Crownhub Toolbar"
Loading...