What is Tellurium Generate?
The Malwarebytes research team has determined that Tellurium Generate is a browser hijacker. These so-called "hijackers" alter your startpage or searchscopes so that the affected browser visits their site or one of their choice. This one also displays advertisements.
How do I know if my computer is affected by Tellurium Generate?
You may see this warning during install:

You may see this Internet Explorer browser helper object :

and this icon in the Internet Explorer menu-bar:

and this entry in your list of installed programs:

How did Tellurium Generate get on my computer?
Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.
How do I remove Tellurium Generate?
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted application.
- Please download Malwarebytes Anti-Malware to your desktop.
- Double-click mbam-setup-version.exe and follow the prompts to install the program.
- At the end, be sure a check-mark is placed next to the following:
- Enable free trial of Malwarebytes Anti-Malware Premium
- Launch Malwarebytes Anti-Malware
- Then click Finish.
- If an update is found, you will be prompted to download and install the latest version.
- Once the program has loaded, select Scan now.
- When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
- Reboot your computer if prompted.
- No, Malwarebytes' Anti-Malware removes Tellurium Generate completely.
We hope our application and this guide have helped you eradicate this hijacker.
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Tellurium Generate hijacker. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.
Signs in a HijackThis log:
O2 - BHO: CrossriderApp0053917 - {11111111-1111-1111-1111-110511391117} - C:\Program Files\Tellurium Generate\Tellurium Generate-bho.dllAlterations made by the installer:
File system details --------------------------------------------- Adds the folder C:\Program Files\Tellurium Generate Adds the file background.html"="5/6/2014 9:34 PM, 729 bytes, A Adds the file Installer.log"="5/11/2014 11:24 AM, 112499 bytes, A Adds the file Tellurium Generate.ico"="5/6/2014 9:35 PM, 9662 bytes, A Adds the file Tellurium Generate-bg.exe"="5/11/2014 11:24 AM, 798208 bytes, A Adds the file Tellurium Generate-bho.dll"="5/11/2014 11:24 AM, 677376 bytes, A Adds the file Tellurium Generate-buttonutil.dll"="5/11/2014 11:24 AM, 425984 bytes, A Adds the file Tellurium Generate-buttonutil.exe"="5/11/2014 11:24 AM, 344064 bytes, A Adds the file Tellurium Generate-codedownloader.exe"="5/11/2014 11:24 AM, 567296 bytes, A Adds the file Tellurium Generate-enabler.exe"="5/11/2014 11:24 AM, 406528 bytes, A Adds the file Tellurium Generate-helper.exe"="5/11/2014 11:24 AM, 340992 bytes, A Adds the file Uninstall.exe"="5/11/2014 11:24 AM, 673388 bytes, A Adds the folder C:\Users\{username}\AppData\LocalLow\Tellurium Generate Registry details ------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511391117}] "(Default)"="REG_SZ", "Tellurium Generate" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511391117}\Implemented Categories] "(Default)"="REG_SZ", "" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511391117}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}] "(Default)"="REG_SZ", "" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511391117}\InprocServer32] "(Default)"="REG_SZ", "C:\Program Files\Tellurium Generate\Tellurium Generate-bho.dll" "ThreadingModel"="REG_SZ", "Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511391117}\ProgID] "(Default)"="REG_SZ", "CrossriderApp0053917.BHO.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511391117}\Programmable] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511391117}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440544394417}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511391117}\VersionIndependentProgID] "(Default)"="REG_SZ", "CrossriderApp0053917" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522392217}] "(Default)"="REG_SZ", "CrossriderApp0053917.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522392217}\InprocServer32] "(Default)"="REG_SZ", "C:\Program Files\Tellurium Generate\Tellurium Generate-bho.dll" "ThreadingModel"="REG_SZ", "Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522392217}\ProgID] "(Default)"="REG_SZ", "CrossriderApp0053917.Sandbox.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522392217}\Programmable] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522392217}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440544394417}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522392217}\VersionIndependentProgID] "(Default)"="REG_SZ", "CrossriderApp0053917.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0053917.BHO] "(Default)"="REG_SZ", "CrossriderApp0053917" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0053917.BHO\CLSID] "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110511391117}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0053917.BHO\CurVer] "(Default)"="REG_SZ", "CrossriderApp0053917" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0053917.BHO.1] "(Default)"="REG_SZ", "CrossriderApp0053917" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0053917.BHO.1\CLSID] "(Default)"="REG_SZ", "{11111111-1111-1111-1111-110511391117}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0053917.Sandbox] "(Default)"="REG_SZ", "CrossriderApp0053917.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0053917.Sandbox\CLSID] "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220522392217}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0053917.Sandbox\CurVer] "(Default)"="REG_SZ", "CrossriderApp0053917.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0053917.Sandbox.1] "(Default)"="REG_SZ", "CrossriderApp0053917.Sandbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0053917.Sandbox.1\CLSID] "(Default)"="REG_SZ", "{22222222-2222-2222-2222-220522392217}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555395517}] "(Default)"="REG_SZ", "ICrossriderBHO" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555395517}\ProxyStubClsid] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555395517}\ProxyStubClsid32] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555395517}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440544394417}" "Version"="REG_SZ", "1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566396617}] "(Default)"="REG_SZ", "ISandBox" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566396617}\ProxyStubClsid] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566396617}\ProxyStubClsid32] "(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566396617}\TypeLib] "(Default)"="REG_SZ", "{44444444-4444-4444-4444-440544394417}" "Version"="REG_SZ", "1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440544394417}\1.0] "(Default)"="REG_SZ", "CrossriderApp0053917 Type Library" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440544394417}\1.0\0\win32] "(Default)"="REG_SZ", "C:\Program Files\Tellurium Generate\Tellurium Generate-bho.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440544394417}\1.0\FLAGS] "(Default)"="REG_SZ", "0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440544394417}\1.0\HELPDIR] "(Default)"="REG_SZ", "C:\Program Files\Tellurium Generate" [HKEY_LOCAL_MACHINE\SOFTWARE\InstalledBrowserExtensions\20912] "53917"="REG_SZ", "Tellurium Generate" [HKEY_LOCAL_MACHINE\SOFTWARE\InstalledBrowserExtensions\20912\Status] "Installed"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110511391117}] "(Default)"="REG_SZ", "CrossriderApp0053917" "NoExplorer"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID] "{11111111-1111-1111-1111-110511391117}"="REG_SZ", "1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tellurium Generate] "CrAppId"="REG_SZ", "53917" "CrPublisherId"="REG_SZ", "20912" "DisplayIcon"="REG_SZ", "C:\Program Files\Tellurium Generate\Uninstall.exe" "DisplayName"="REG_SZ", "Tellurium Generate" "DisplayVersion"="REG_SZ", "1.34.4.10" "Publisher"="REG_SZ", "David Houghton" "UninstallString"="REG_SZ", "C:\Program Files\Tellurium Generate\Uninstall.exe /fcp=1" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider] "Bic"="REG_SZ", "0D10FB311C074961B97F2DDA1AFA5340IE" "Verifier"="REG_SZ", "0b50280cb9cbfd9e09b425b08a2289bf" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\Button] "53917"="REG_DWORD", 1 "Index"="REG_DWORD", 1 [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\onBeforeNavigate] "53917"="REG_SZ", "{"1":{"code":"function(details, opaque) {\n console.log('change');\n messagesHandler.sendMessageToBackground( MESSAGE.CHECK_SUSPENDED );\n }","value":"{\"messagesHandler\":{}}"}}" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider\onRequest] "53917"="REG_SZ", "" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Tellurium Generate] "ActiveAppId"="REG_SZ", "53917" "BhoRunningVersion"="REG_SZ", "153" "IsBhoEnabled"="REG_DWORD", 1 "LastSetSearch"="REG_DWORD", 1399800471 [HKEY_CURRENT_USER\Software\AppDataLow\Software\Tellurium Generate\background] "__onDocumentStart_script__"="REG_SZ", "" "__onDocumentStart_script_store__"="REG_SZ", "" "IsEnabled"="REG_DWORD", 1 [HKEY_CURRENT_USER\Software\AppDataLow\Software\Tellurium Generate\Code] [HKEY_CURRENT_USER\Software\AppDataLow\Software\Tellurium Generate\Db\Internal\__contextmenu_data__] "Expiration"="REG_DWORD", 1896130800 "Value"="REG_SZ", "{ javascript removed, full log available on request }" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Tellurium Generate\Update] "LastCheck"="REG_DWORD", 1399800247 [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\20912] "53917"="REG_SZ", "Tellurium Generate" [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\20912\Status] "Installed"="REG_DWORD", 1 [HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\David Houghton] "53917"="REG_SZ", "Tellurium Generate"Malwarebytes Anti-Malware log:
Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 5/11/2014 Scan Time: 11:45:36 AM Logfile: mbamTelluria.txt Administrator: Yes Version: 2.00.1.1004 Malware Database: v2014.05.11.03 Rootkit Database: v2014.03.27.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Chameleon: Disabled OS: Windows 7 Service Pack 1 CPU: x86 File System: NTFS User: Malwarebytes Scan Type: Threat Scan Result: Completed Objects Scanned: 217625 Time Elapsed: 10 min, 52 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Shuriken: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 20 PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110511391117}, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440544394417}, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550555395517}, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660566396617}, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0053917.BHO.1, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110511391117}, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0053917.BHO, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110511391117}, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110511391117}, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220522392217}, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0053917.Sandbox.1, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0053917.Sandbox, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110511391117}\INPROCSERVER32, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Tellurium Generate, Quarantined, [2ff04c045b209f97151d5c208280966a], PUP.Optional.TelluriumGenerate.A, HKLM\SOFTWARE\Tellurium Generate, Quarantined, [88971f31057674c2b480b8c4e71b8d73], PUP.Optional.CrossRider.A, HKLM\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\20912, Quarantined, [52cdda766714f83e9e0b2f58ab5743bd], PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [a7782a260a71072ff543a21da55e0af6], PUP.Optional.TelluriumGenerate.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Tellurium Generate, Quarantined, [77a8f35da0dbf640d660f884d82a7d83], PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\20912, Quarantined, [43dcd977bcbf75c1decc8afd42c020e0], PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\David Houghton, Quarantined, [df40331d4239e25451e7d3a99a683cc4], Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 1 PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate, Quarantined, [2ff04c045b209f97151d5c208280966a], Files: 12 PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate\Tellurium Generate-bho.dll, Quarantined, [0916a6aa9ddedb5bcd04e890e31e1ee2], PUP.Optional.TelluriumGenerate.A, C:\Users\{username}\Desktop\Tellurium Generate.exe, Quarantined, [c15eba96d6a5dc5af0e1fb7da35e857b], PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate\background.html, Quarantined, [2ff04c045b209f97151d5c208280966a], PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate\Installer.log, Quarantined, [2ff04c045b209f97151d5c208280966a], PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate\Tellurium Generate-bg.exe, Quarantined, [2ff04c045b209f97151d5c208280966a], PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate\Tellurium Generate-buttonutil.dll, Quarantined, [2ff04c045b209f97151d5c208280966a], PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate\Tellurium Generate-buttonutil.exe, Quarantined, [2ff04c045b209f97151d5c208280966a], PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate\Tellurium Generate-codedownloader.exe, Quarantined, [2ff04c045b209f97151d5c208280966a], PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate\Tellurium Generate-enabler.exe, Quarantined, [2ff04c045b209f97151d5c208280966a], PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate\Tellurium Generate-helper.exe, Quarantined, [2ff04c045b209f97151d5c208280966a], PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate\Tellurium Generate.ico, Quarantined, [2ff04c045b209f97151d5c208280966a], PUP.Optional.TelluriumGenerate.A, C:\Program Files\Tellurium Generate\Uninstall.exe, Quarantined, [2ff04c045b209f97151d5c208280966a], Physical Sectors: 0 (No malicious items detected) (end)As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention