Home Malware Programs Browser Hijackers AsktheCrew.net

AsktheCrew.net

Posted: October 12, 2011

AsktheCrew.net Screenshot 1AsktheCrew.net is a fraudulent search engine site that displays irrelevant, malicious or stolen search results to pad its web masters' wallets. Although AsktheCrew.net, like many other types of fake search engine sites, will also use browser hijackers to force you to view AsktheCrew.net search results, AsktheCrew.net-affiliated browser hijackers are equally-capable of redirecting you to different types of malicious websites that use similar scams. SpywareRemove.com malware research team discourages any contact with AsktheCrew.net, since exposure to AsktheCrew.net or AsktheCrew.net's links can be a vector for additional infection. If your PC has been infected by an AsktheCrew.net browser hijacker, use an appropriate anti-malware program to remove AsktheCrew.net and undo AsktheCrew.net's system setting changes.

Why AsktheCrew.net Isn't the Right Crew for Your Browser

AsktheCrew.net may tell you that AsktheCrew.net has all the answers that you could ever need, but even a cursory look at AsktheCrew.net will tell you the same thing that SpywareRemove.com malware experts found out – that AsktheCrew.net doesn't have useful or individual search results or web links to offer any of AsktheCrew.net's visitors. Instead, AsktheCrew.net makes do with sponsored links and stolen results from other search engines like Google and Bing.

Potential threats from even a brief visit to AsktheCrew.net can include:

  • Drive-by-download attacks that install malicious security programs without permission (including AsktheCrew.net's very own browser hijacker, amongst other possibilities). Disabling Flash and JavaScript for AsktheCrew.net and affiliated sites will help to protect your PC from these attacks.
  • Websites that sell fake software products such as rogue Registry cleaners, rogue anti-spyware programs or rogue anti-virus scanners.
  • Sites that steal private information by way of standard phishing techniques, such as by posing as an official site's login page or requesting information as part of a fake survey.

The Greatest Danger from AsktheCrew.net and Why You Can't Stay Away from It

The most significant PC threat from AsktheCrew.net is AsktheCrew.net's browser hijacker, is an infection that redirects your web browser to AsktheCrew.net whenever you try to use another search engine (such as Google). Since this 'feature' has no benefit for your web-browsing activities and will actively expose you to harmful websites, SpywareRemove.com malware researchers strongly encourage you to get rid of AsktheCrew.net's malicious program as soon as you have a competent anti-malware program for the job. Trying to change your browser settings, avoiding search engine sites or even deleting your web browser are all improper responses, since AsktheCrew.net's browser hijacker will still be on your system and remain capable of attacking.

You should also be aware that AsktheCrew.net browser hijackers can also redirect your PC to other websites besides AsktheCrew.net, although, in most cases, these sites will operate in a way that resembles AsktheCrew.net closely enough that they can't be mistaken for benevolent websites. You should consider these alternate search sites, such as Search3.google.com, Search.jzip.com, Globasearch.com and quick-search-results.com, to be just as harmful as AsktheCrew.net itself, and strive to avoid contact with them and their fake search results.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%Temp%\tmp[RANDOM NUMBERS].tmp File name: %Temp%\tmp[RANDOM NUMBERS].tmp
File type: Temporary File
Mime Type: unknown/tmp
C:\Windows\System32\Drivers\etc\ Hosts\malicious host of AsktheCrew.net File name: C:\Windows\System32\Drivers\etc\ Hosts\malicious host of AsktheCrew.net
Mime Type: unknown/net
%System%\uacinit.dll %System%\drivers\UAC[RANDOM CHARACTERS].sys File name: %System%\uacinit.dll %System%\drivers\UAC[RANDOM CHARACTERS].sys
File type: System file
Mime Type: unknown/sys
%System%\UAC[RANDOM CHARACTERS].dll File name: %System%\UAC[RANDOM CHARACTERS].dll
File type: Dynamic link library
Mime Type: unknown/dll
%System%\UAC[RANDOM CHARACTERS].dat File name: %System%\UAC[RANDOM CHARACTERS].dat
File type: Data file
Mime Type: unknown/dat

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{CLSID Path}HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\""={4B3803EA-5230-4DC3-A7FC-33638F3D3542} HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks={CFBFAE00-17A6-11D0-99CB-00C04FD64497} HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}HKEY_CLASSES_ROOT\TypeLib\{506F578A-91E1-46CE-830F-E2F4268E9966}HKEY_CLASSES_ROOT\TypeLib\{E79BB61D-7F1A-41DF-8AD0-402795E3B566}HKEY_CLASSES_ROOT\CLSID\{B1CF6225-211E-4B4C-B466-5F224E348FF3}HKEY_CLASSES_ROOT\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}HKEY_CLASSES_ROOT\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar={4B3803EA-5230-4DC3-A7FC-33638F3D3542}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}HKEY..\..\..\..{Subkeys}HKEY_CLASSES_ROOT\PROTOCOLS\Handler\tbrHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\CustomizeSearch=[site address]HKEY_CLASSES_ROOT\ctbcommon.Buttons HKEY_CLASSES_ROOT\ctbr.R404Pro
Loading...