» Ghostery IE.dll
Overview
Analysis
File Details
Behaviors (1)

Ghostery IE.dll

Ghostery IE

Evidon, Inc.

This web browser extension uses the Crossrider toolbar creation and distribution platform. The module Ghostery IE.dll by Evidon has been detected as a potentially unwanted program by 20 anti-malware scanners. It is installed within the context of Internet Explore as a BHO (Browser Helper Object) under the name ‘CrossriderApp0020900’. The library is built using the Crossrider cross-browser extension platform. While the file utilizes the Crossrider framework and delivery services, it is not owned by Crossrider.

File name:

Ghostery IE.dll

Publisher:

Evidon Inc. (signed by Evidon, Inc.)

Product:

Ghostery IE

Description:

Ghostery IE BHO

Version:

1.1.153.38

MD5:

8c9d97ee4382f7271a738384824cd460

SHA-1:

666526792523658e378a44d0e91e2d5fa933705a

SHA-256:

9731246a06c84e80b3fd17807965a6ff700286d0599ff7bac3b25e9e3f9e6fc7

Scanner detections:

20 / 68

Status:

Potentially unwanted

Explanation:

May modify the web browser's settings including changing the homepage and search provider in addition to delivering ads (by injecting banner and text-links directly in the webpage).

Analysis date:

4/26/2024 12:13:37 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Agent.NRK

861

Avira AntiVirus

ADWARE/CrossRider.Gen2

7.11.170.42

avast!

Win32:Installer-M [Adw]

2014.9-140927

Bitdefender

Adware.Agent.NRK

1.0.20.1350

Comodo Security

ApplicUnwnt

17450

Emsisoft Anti-Malware

Adware.Agent.NRK

8.14.09.27.12

ESET NOD32

Win32/Toolbar.CrossRider (variant)

7.9138

Fortinet FortiGate

Adware/Fam.NB

9/27/2014

F-Secure

Adware.Agent.NRK

11.2014-27-09_7

G Data

Win32.Trojan.Agent.BC0J0F

14.9.22

IKARUS anti.virus

AdWare.Agent

t3scan.2.2.29

K7 AntiVirus

Unwanted-Program

13.174.10530

Malwarebytes

PUP.Optional.SupremeSavings.A

v2014.09.27.12

McAfee

Artemis!8AF3DE18F7AD

5600.6995

MicroWorld eScan

Adware.Agent.NRK

15.0.0.810

nProtect

Adware.Agent.NRK

14.08.29.01

Reason Heuristics

Threat.Win.Reputation.IMP

14.9.27.0

Sophos

AppRider

4.96

Trend Micro House Call

TROJ_GEN.F47V0409

7.2.270

VIPRE Antivirus

Crossrider

24060

File size:

730.1 KB (747,624 bytes)

Product version:

1.1.153.38

Original file name:

Ghostery IE.dll

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\ghostery ie\ghostery ie.dll

Digital Signature

Signed by:

Evidon, Inc.

Authority:

The USERTRUST Network

Valid from:

3/13/2011 5:00:00 PM

Valid to:

3/13/2014 4:59:59 PM

Subject:

CN="Evidon, Inc.", O="Evidon, Inc.", STREET=28 W. 44th St., STREET=Ste. 800, L=New York, S=NY, PostalCode=10036, C=US

Issuer:

CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:

00A360D17B416CE4A553A541F18C27640A

Registration

CLSIDs:

{11111111-1111-1111-1111-110211091100}, {22222222-2222-2222-2222-220222092200}

ProgIDs:

CrossriderApp0020900.BHO.1, CrossriderApp0020900.Sandbox.1

COM registered:

Yes

File PE Metadata

Compilation timestamp:

4/3/2013 1:20:20 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:zwXghe209lcVzpbIQ0tvZ5BRWRbi3o78tKT+lSPoeIlYwsARHKN:sXgg20Hc9pbIQ0voQ3o7pT+lSDPpABKN

Entry address:

0x4B82D

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, BC, B1, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 85, C0, 74, 12, 83, E8, 08, 81, 38, DD, DD, 00, 00, 75, 07, 50, E8, A2, B7, FF, FF, 59, 5D, C3, 8B, FF, 55, 8B, EC, 83, EC, 10, A1, C0, 6F, 0A, 10, 33, C5, 89, 45, FC, 8B, 55, 18, 53, 33, DB, 56, 57, 3B, D3, 7E, 1F, 8B, 45, 14, 8B, CA, 49, 38, 18, 74, 08, 40, 3B, CB, 75, F6, 83, C9, FF, 8B, C2, 2B, C1, 48, 3B, C2, 7D, 01, 40, 89, 45, 18... 
[+]

Entropy:

6.6176

Code size:

518.5 KB (530,944 bytes)

Internet Explorer BHO

Display name:

CrossriderApp0020900

CLSID:

{11111111-1111-1111-1111-110211091100}

CLSID name:

Ghostery IE

Remove Ghostery IE.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.