What is DeepDyve Plugin?
The Malwarebytes research team has determined that DeepDyve Plugin is a browser hijacker. These so-called "hijackers" alter your startpage or searchscopes so that the effected browser visits their site or one of their choice. This one also displays advertisements.
How do I know if my computer is affected by DeepDyve Plugin?
You may see this warning:

and this browser helper object in Internet Exporer:

accompanied by this icon in the Internet Explorer Menu Bar

and this entry in your list of installed programs:

How did DeepDyve Plugin get on my computer?
Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.
How do I remove DeepDyve Plugin?
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted application.
- Please download Malwarebytes Anti-Malware to your desktop.
- Double-click mbam-setup-version.exe and follow the prompts to install the program.
- At the end, be sure a check-mark is placed next to the following:
- Enable free trial of Malwarebytes Anti-Malware Premium
- Launch Malwarebytes Anti-Malware
- Then click Finish.
- If an update is found, you will be prompted to download and install the latest version.
- Once the program has loaded, select Scan now.
- When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
- Reboot your computer if prompted.
- No, Malwarebytes' Anti-Malware removes DeepDyve Plugin completely.
We hope our application and this guide have helped you eradicate this hijacker.
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the DeepDyve Plugin browser hijacker. It would have warned you before the potentially unwanted program could install itself, giving you a chance to stop it before it became too late.
Signs in a HijackThis log:
O2 - BHO: CrossriderApp0013872 - {11111111-1111-1111-1111-110111381172} - C:\Program Files\DeepDyve Plugin\DeepDyve Plugin-bho.dllAlterations made by the installer:
File system details --------------------------------------------- Adds the folder C:\Program Files\DeepDyve Plugin Adds the file background.html"="4/3/2014 1:33 AM, 729 bytes, A Adds the file DeepDyve Plugin.ico"="4/3/2014 1:33 AM, 9662 bytes, A Adds the file DeepDyve Plugin-bg.exe"="5/3/2014 6:37 PM, 798208 bytes, A Adds the file DeepDyve Plugin-bho.dll"="5/3/2014 6:37 PM, 677376 bytes, A Adds the file DeepDyve Plugin-buttonutil.dll"="5/3/2014 6:37 PM, 425984 bytes, A Adds the file DeepDyve Plugin-buttonutil.exe"="5/3/2014 6:37 PM, 344064 bytes, A Adds the file DeepDyve Plugin-codedownloader.exe"="5/3/2014 6:37 PM, 567296 bytes, A Adds the file DeepDyve Plugin-enabler.exe"="5/3/2014 6:37 PM, 406528 bytes, A Adds the file DeepDyve Plugin-helper.exe"="5/3/2014 6:37 PM, 340992 bytes, A Adds the file Installer.log"="5/3/2014 6:37 PM, 116879 bytes, A Adds the file Uninstall.exe"="5/3/2014 6:37 PM, 672985 bytes, A Adds the folder C:\Users\{username}\AppData\LocalLow\DeepDyve Plugin Registry details ------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111381172}] "(Default)"="REG_SZ", "DeepDyve Plugin" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111381172}\Implemented Categories] "(Default)"="REG_SZ", "" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111381172}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}] "(Default)"="REG_SZ", "" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111381172}\InprocServer32] "(Default)"="REG_SZ", "C:\Program Files\DeepDyve Plugin\DeepDyve Plugin-bho.dll" "ThreadingModel"="REG_SZ", "Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111381172}\ProgID] "(Default)"="REG_SZ", "CrossriderApp0013872.BHO.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111381172}\Programmable] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111381172}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144384472}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111381172}\VersionIndependentProgID] "(Default)"="REG_SZ", "CrossriderApp0013872" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122382272}] "(Default)"="REG_SZ", "CrossriderApp0013872.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122382272}\InprocServer32] "(Default)"="REG_SZ", "C:\Program Files\DeepDyve Plugin\DeepDyve Plugin-bho.dll" "ThreadingModel"="REG_SZ", "Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122382272}\ProgID] "(Default)"="REG_SZ", "CrossriderApp0013872.Sandbox.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122382272}\Programmable] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122382272}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144384472}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122382272}\VersionIndependentProgID] "(Default)"="REG_SZ", "CrossriderApp0013872.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013872.BHO] "(Default)"="REG_SZ", "CrossriderApp0013872" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013872.BHO\CLSID] "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110111381172}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013872.BHO\CurVer] "(Default)"="REG_SZ", "CrossriderApp0013872" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013872.BHO.1] "(Default)"="REG_SZ", "CrossriderApp0013872" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013872.BHO.1\CLSID] "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110111381172}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013872.Sandbox] "(Default)"="REG_SZ", "CrossriderApp0013872.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013872.Sandbox\CLSID] "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220122382272}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013872.Sandbox\CurVer] "(Default)"="REG_SZ", "CrossriderApp0013872.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013872.Sandbox.1] "(Default)"="REG_SZ", "CrossriderApp0013872.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0013872.Sandbox.1\CLSID] "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220122382272}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155385572}] "(Default)"="REG_SZ", "ICrossriderBHO" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155385572}\ProxyStubClsid] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155385572}\ProxyStubClsid32] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155385572}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144384472}" "Version"="REG_SZ", "1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166386672}] "(Default)"="REG_SZ", "ISandBox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166386672}\ProxyStubClsid] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166386672}\ProxyStubClsid32] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166386672}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144384472}" "Version"="REG_SZ", "1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144384472}\1.0] "(Default)"="REG_SZ", "CrossriderApp0013872 Type Library" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144384472}\1.0\0\win32] "(Default)"="REG_SZ", "C:\Program Files\DeepDyve Plugin\DeepDyve Plugin-bho.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144384472}\1.0\FLAGS] "(Default)"="REG_SZ", "0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144384472}\1.0\HELPDIR] "(Default)"="REG_SZ", "C:\Program Files\DeepDyve Plugin" [HKEY_LOCAL_MACHINE\SOFTWARE\DeepDyve Plugin\IE] "TotalProfiles"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\DeepDyve Plugin\IE\Profiles] "S-1-5-21-4016700205-1717049133-1125222536-1001"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\DeepDyve Plugin\Installer] "BundledIe"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\InstalledBrowserExtensions\8381] "13872"="REG_SZ", "DeepDyve Plugin" [HKEY_LOCAL_MACHINE\SOFTWARE\InstalledBrowserExtensions\8381\Status] "Installed"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110111381172}] "(Default)"="REG_SZ", "CrossriderApp0013872" "NoExplorer"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID] "{11111111-1111-1111-1111-110111381172}"="REG_SZ", "1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DeepDyve Plugin] "CrAppId"="REG_SZ", "13872" "CrPublisherId"="REG_SZ", "8381" "DisplayIcon"="REG_SZ", "C:\Program Files\DeepDyve Plugin\Uninstall.exe" "DisplayName"="REG_SZ", "DeepDyve Plugin" "DisplayVersion"="REG_SZ", "1.34.3.28" "Publisher"="REG_SZ", "DeepDyve" "UninstallString"="REG_SZ", "C:\Program Files\DeepDyve Plugin\Uninstall.exe /fromcontrolpanel=1" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider] "Bic"="REG_SZ", "CAD39F4B6B834337A3893909DF0E413EIE" "Verifier"="REG_SZ", "50bb7f7698c10448c26e173205aafaab" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\Button] "13872"="REG_DWORD", 1 "Index"="REG_DWORD", 1 [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\onBeforeNavigate] "13872"="REG_SZ", "" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\onRequest] "13872"="REG_SZ", "" [HKEY_CURRENT_USER\Software\AppDataLow\Software\DeepDyve Plugin] "ActiveAppId"="REG_SZ", "13872" "BhoRunningVersion"="REG_SZ", "153" "IsBhoEnabled"="REG_DWORD", 1 "LastSetSearch"="REG_DWORD", 1399135207 [HKEY_CURRENT_USER\Software\AppDataLow\Software\DeepDyve Plugin\background] "__onDocumentStart_script__"="REG_SZ", "" "__onDocumentStart_script_store__"="REG_SZ", "" "IsEnabled"="REG_DWORD", 1 [HKEY_CURRENT_USER\Software\AppDataLow\Software\DeepDyve Plugin\Code] "AppJavaScript"="REG_SZ", "{ javascript removed, full log available on request}" [HKEY_CURRENT_USER\Software\AppDataLow\Software\DeepDyve Plugin\Update] "LastCheck"="REG_DWORD", 1399135071 [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\8381] "13872"="REG_SZ", "DeepDyve Plugin" [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\8381\Status] "Installed"="REG_DWORD", 1 [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\DeepDyve] "13872"="REG_SZ", "DeepDyve Plugin"Malwarebytes Anti-Malware log:
Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 5/3/2014 Scan Time: 6:47:12 PM Logfile: mbamDeepDyve.txt Administrator: Yes Version: 2.00.1.1004 Malware Database: v2014.05.03.06 Rootkit Database: v2014.03.27.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Chameleon: Disabled OS: Windows 7 Service Pack 1 CPU: x86 File System: NTFS User: Malwarebytes Scan Type: Threat Scan Result: Completed Objects Scanned: 215609 Time Elapsed: 3 min, 52 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Shuriken: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 20 PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110111381172}, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440144384472}, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550155385572}, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660166386672}, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0013872.BHO.1, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110111381172}, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0013872.BHO, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110111381172}, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110111381172}, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220122382272}, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0013872.Sandbox.1, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0013872.Sandbox, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110111381172}\INPROCSERVER32, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DeepDyve Plugin, Quarantined, [ee140f3e34478caa5b34552253afa15f], PUP.Optional.DeepDyvePlugin.A, HKLM\SOFTWARE\DeepDyve Plugin, Quarantined, [62a087c64c2f41f551400374df23629e], PUP.Optional.CrossRider.A, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\8381, Quarantined, [be443a13245758dec42f5c2362a005fb], PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [eb17024b81fa2313c4c63681996a669a], PUP.Optional.DeepDyvePlugin.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\DeepDyve Plugin, Quarantined, [af5378d5136849ed583b3641a65ca65a], PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\8381, Quarantined, [9d6573da9ae11b1b975dccb3d82ae719], PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\DeepDyve, Quarantined, [49b99fae1f5cf4423e562057679b15eb], Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 1 PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin, Quarantined, [ee140f3e34478caa5b34552253afa15f], Files: 12 PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin\DeepDyve Plugin-bho.dll, Quarantined, [8e74df6eb7c4e254595d5c1752af9e62], PUP.Optional.DeepDyvePlugin.A, C:\Users\{username}\Desktop\-DeepDyve Plugin(crossRider).exe, Quarantined, [0002c58897e45ed8bef80370f40d31cf], PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin\background.html, Quarantined, [ee140f3e34478caa5b34552253afa15f], PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin\DeepDyve Plugin-bg.exe, Quarantined, [ee140f3e34478caa5b34552253afa15f], PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin\DeepDyve Plugin-buttonutil.dll, Quarantined, [ee140f3e34478caa5b34552253afa15f], PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin\DeepDyve Plugin-buttonutil.exe, Quarantined, [ee140f3e34478caa5b34552253afa15f], PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin\DeepDyve Plugin-codedownloader.exe, Quarantined, [ee140f3e34478caa5b34552253afa15f], PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin\DeepDyve Plugin-enabler.exe, Quarantined, [ee140f3e34478caa5b34552253afa15f], PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin\DeepDyve Plugin-helper.exe, Quarantined, [ee140f3e34478caa5b34552253afa15f], PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin\DeepDyve Plugin.ico, Quarantined, [ee140f3e34478caa5b34552253afa15f], PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin\Installer.log, Quarantined, [ee140f3e34478caa5b34552253afa15f], PUP.Optional.DeepDyvePlugin.A, C:\Program Files\DeepDyve Plugin\Uninstall.exe, Quarantined, [ee140f3e34478caa5b34552253afa15f], Physical Sectors: 0 (No malicious items detected) (end)As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention