What is Delve?
The Malwarebytes research team has determined that Delve is a browser hijacker. These so-called "hijackers" alter your startpage or searchscopes so that the effected browser visits their site or one of their choice. This one also displays advertisements.
How do I know if my computer is affected by Delve?
This is how the start-page looks:

And you may see this browser helper object in Internet Explorer:

or this warning:

and this entry in your list of installed programs:

How did Delve get on my computer?
Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.
How do I remove Delve?
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted application.
- Please download Malwarebytes Anti-Malware to your desktop.
- Double-click mbam-setup-version.exe and follow the prompts to install the program.
- At the end, be sure a check-mark is placed next to the following:
- Enable free trial of Malwarebytes Anti-Malware Premium
- Launch Malwarebytes Anti-Malware
- Then click Finish.
- If an update is found, you will be prompted to download and install the latest version.
- Once the program has loaded, select Scan now.
- When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
- Reboot your computer if prompted.
- No, Malwarebytes' Anti-Malware removes Delve completely.
We hope our application and this guide have helped you eradicate this hijacker.
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Delve hijacker. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.
Signs in a HijackThis log:
O2 - BHO: CrossriderApp0037158 - {11111111-1111-1111-1111-110311711158} - C:\Program Files\Delve\Delve-bho.dllAlterations made by the installer:
File system details --------------------------------------------- Adds the folder C:\Program Files\Delve Adds the file background.html"="12/12/2013 3:37 PM, 729 bytes, A Adds the file Delve.ico"="12/12/2013 3:37 PM, 9662 bytes, A Adds the file Delve-bg.exe"="5/4/2014 9:31 AM, 773120 bytes, A Adds the file Delve-bho.dll"="5/4/2014 9:31 AM, 640512 bytes, A Adds the file Delve-buttonutil.dll"="5/4/2014 9:31 AM, 428544 bytes, A Adds the file Delve-buttonutil.exe"="5/4/2014 9:31 AM, 331264 bytes, A Adds the file Delve-codedownloader.exe"="5/4/2014 9:31 AM, 523776 bytes, A Adds the file Delve-enabler.exe"="5/4/2014 9:31 AM, 344064 bytes, A Adds the file Delve-helper.exe"="5/4/2014 9:31 AM, 331776 bytes, A Adds the file Installer.log"="5/4/2014 9:31 AM, 175758 bytes, A Adds the file Uninstall.exe"="5/4/2014 9:31 AM, 376774 bytes, A Adds the folder C:\Users\{username}\AppData\LocalLow\Delve Registry details ------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311711158}] "(Default)"="REG_SZ", "Delve" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311711158}\Implemented Categories] "(Default)"="REG_SZ", "" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311711158}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}] "(Default)"="REG_SZ", "" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311711158}\InprocServer32] "(Default)"="REG_SZ", "C:\Program Files\Delve\Delve-bho.dll" "ThreadingModel"="REG_SZ", "Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311711158}\ProgID] "(Default)"="REG_SZ", "CrossriderApp0037158.BHO.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311711158}\Programmable] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311711158}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440344714458}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311711158}\VersionIndependentProgID] "(Default)"="REG_SZ", "CrossriderApp0037158" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322712258}] "(Default)"="REG_SZ", "CrossriderApp0037158.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322712258}\InprocServer32] "(Default)"="REG_SZ", "C:\Program Files\Delve\Delve-bho.dll" "ThreadingModel"="REG_SZ", "Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322712258}\ProgID] "(Default)"="REG_SZ", "CrossriderApp0037158.Sandbox.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322712258}\Programmable] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322712258}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440344714458}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322712258}\VersionIndependentProgID] "(Default)"="REG_SZ", "CrossriderApp0037158.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0037158.BHO] "(Default)"="REG_SZ", "CrossriderApp0037158" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0037158.BHO\CLSID] "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110311711158}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0037158.BHO\CurVer] "(Default)"="REG_SZ", "CrossriderApp0037158" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0037158.BHO.1] "(Default)"="REG_SZ", "CrossriderApp0037158" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0037158.BHO.1\CLSID] "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110311711158}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0037158.Sandbox] "(Default)"="REG_SZ", "CrossriderApp0037158.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0037158.Sandbox\CLSID] "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220322712258}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0037158.Sandbox\CurVer] "(Default)"="REG_SZ", "CrossriderApp0037158.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0037158.Sandbox.1] "(Default)"="REG_SZ", "CrossriderApp0037158.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0037158.Sandbox.1\CLSID] "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220322712258}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355715558}] "(Default)"="REG_SZ", "ICrossriderBHO" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355715558}\ProxyStubClsid] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355715558}\ProxyStubClsid32] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355715558}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440344714458}" "Version"="REG_SZ", "1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366716658}] "(Default)"="REG_SZ", "ISandBox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366716658}\ProxyStubClsid] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366716658}\ProxyStubClsid32] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366716658}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440344714458}" "Version"="REG_SZ", "1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440344714458}\1.0] "(Default)"="REG_SZ", "CrossriderApp0037158 Type Library" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440344714458}\1.0\0\win32] "(Default)"="REG_SZ", "C:\Program Files\Delve\Delve-bho.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440344714458}\1.0\FLAGS] "(Default)"="REG_SZ", "0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440344714458}\1.0\HELPDIR] "(Default)"="REG_SZ", "C:\Program Files\Delve" [HKEY_LOCAL_MACHINE\SOFTWARE\Delve\IE] "TotalProfiles"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Delve\IE\Profiles] "S-1-5-21-4016700205-1717049133-1125222536-1001"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Delve\Installer] "BundledIe"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311711158}] "(Default)"="REG_SZ", "CrossriderApp0037158" "NoExplorer"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID] "{11111111-1111-1111-1111-110311711158}"="REG_SZ", "1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delve] "CrAppId"="REG_SZ", "37158" "CrPublisherId"="REG_SZ", "22436" "DisplayIcon"="REG_SZ", "C:\Program Files\Delve\Uninstall.exe" "DisplayName"="REG_SZ", "Delve" "DisplayVersion"="REG_SZ", "1.31.153.4" "Publisher"="REG_SZ", "Delve" "UninstallString"="REG_SZ", "C:\Program Files\Delve\Uninstall.exe /fromcontrolpanel=1" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider] "Bic"="REG_SZ", "B05EC647B22742B090FBDA912459C0ABIE" "Verifier"="REG_SZ", "730128cd0950cb979b405d641dcdec8c" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\onBeforeNavigate] "37158"="REG_SZ", "" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\onRequest] "37158"="REG_SZ", "" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Delve] "ActiveAppId"="REG_SZ", "37158" "BhoRunningVersion"="REG_SZ", "153" "IsBhoEnabled"="REG_DWORD", 1 "LastSetSearch"="REG_DWORD", 1399188776 [HKEY_CURRENT_USER\Software\AppDataLow\Software\Delve\background] "__onDocumentStart_script__"="REG_SZ", "" "__onDocumentStart_script_store__"="REG_SZ", "" "IsEnabled"="REG_DWORD", 1 [HKEY_CURRENT_USER\Software\AppDataLow\Software\Delve\Code] "AppJavaScript"="REG_SZ", "{ javascript removed, full log available on request }" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Delve\Update] "LastCheck"="REG_DWORD", 1399188704 [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\Delve] "37158"="REG_SZ", "Delve"Malwarebytes Anti-Malware log:
Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 5/4/2014 Scan Time: 9:39:27 AM Logfile: mbamDelve.txt Administrator: Yes Version: 2.00.1.1004 Malware Database: v2014.05.04.03 Rootkit Database: v2014.03.27.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Chameleon: Disabled OS: Windows 7 Service Pack 1 CPU: x86 File System: NTFS User: Malwarebytes Scan Type: Threat Scan Result: Completed Objects Scanned: 215634 Time Elapsed: 3 min, 23 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Shuriken: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 18 PUP.Optional.Delve.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110311711158}, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440344714458}, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550355715558}, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660366716658}, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0037158.BHO.1, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110311711158}, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0037158.BHO, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110311711158}, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110311711158}, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220322712258}, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0037158.Sandbox.1, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0037158.Sandbox, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110311711158}\INPROCSERVER32, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Delve, Quarantined, [81e20845cfacae882383e2959b67e51b], PUP.Optional.Delve.A, HKLM\SOFTWARE\Delve, Quarantined, [560df05d06758fa70d9b9fd89969d927], PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [3d26f35abdbeae884e4d9f18798a2fd1], PUP.Optional.Delve.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Delve, Quarantined, [4b1861ecd2a99f975c4e2750c141f60a], PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\Delve, Quarantined, [c49f64e92d4e96a0684398df1be7f60a], Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 1 PUP.Optional.Delve.A, C:\Program Files\Delve, Quarantined, [81e20845cfacae882383e2959b67e51b], Files: 12 PUP.Optional.Delve.A, C:\Program Files\Delve\Delve-bho.dll, Quarantined, [20435fee1a616acc4a6e670ca958728e], PUP.Optional.Delve.A, C:\Users\{username}\Desktop\Delve(crossRider).exe, Quarantined, [f46ff5581f5c88aeb10781f2a75aeb15], PUP.Optional.Delve.A, C:\Program Files\Delve\background.html, Quarantined, [81e20845cfacae882383e2959b67e51b], PUP.Optional.Delve.A, C:\Program Files\Delve\Delve-bg.exe, Quarantined, [81e20845cfacae882383e2959b67e51b], PUP.Optional.Delve.A, C:\Program Files\Delve\Delve-buttonutil.dll, Quarantined, [81e20845cfacae882383e2959b67e51b], PUP.Optional.Delve.A, C:\Program Files\Delve\Delve-buttonutil.exe, Quarantined, [81e20845cfacae882383e2959b67e51b], PUP.Optional.Delve.A, C:\Program Files\Delve\Delve-codedownloader.exe, Quarantined, [81e20845cfacae882383e2959b67e51b], PUP.Optional.Delve.A, C:\Program Files\Delve\Delve-enabler.exe, Quarantined, [81e20845cfacae882383e2959b67e51b], PUP.Optional.Delve.A, C:\Program Files\Delve\Delve-helper.exe, Quarantined, [81e20845cfacae882383e2959b67e51b], PUP.Optional.Delve.A, C:\Program Files\Delve\Delve.ico, Quarantined, [81e20845cfacae882383e2959b67e51b], PUP.Optional.Delve.A, C:\Program Files\Delve\Installer.log, Quarantined, [81e20845cfacae882383e2959b67e51b], PUP.Optional.Delve.A, C:\Program Files\Delve\Uninstall.exe, Quarantined, [81e20845cfacae882383e2959b67e51b], Physical Sectors: 0 (No malicious items detected) (end)As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention