iemate.dll - Dangerous
%program files%\iemate\iemate.dll
Manual removal instructions:
Antivirus Report of %program files%\iemate\iemate.dll:
%program files%\iemate\iemate.dll
We suggest you to remove %PROGRAM FILES%\IEMate\IeMate.dll from your computer as soon as possible.
%PROGRAM FILES%\IEMate\IeMate.dll is Trojan/Backdoor.
Kill the file %PROGRAM FILES%\IEMate\IeMate.dll and remove %PROGRAM FILES%\IEMate\IeMate.dll from Windows startup.
Malware dropper: iemate.exe
Removed: C:\Program Files\IEMate\IeMate.dll
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
F-Secure 8.0.14470.0 2009.10.08 -
Kaspersky 7.0.0.125 2009.10.08 -
McAfee 5765 2009.10.08 -
Microsoft 1.5101 2009.10.08 -
NOD32 4490 2009.10.08 -
Symantec 1.4.4.12 2009.10.08 -
Additional information
File size: 924638 bytes
MD5 : 39ed3f41e857623feee0f77c2224b7c7
SHA1 : 514991912f0417195fb7309d98a303250373eacf
-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys deleted:3
----------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081020090817
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009082720090828
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009082820090829
----------------------------------
Keys added:125
----------------------------------
HKLM\SOFTWARE\Classes\AppID\IeMate.DLL
HKLM\SOFTWARE\Classes\AppID\{F19926D0-05FC-4AE8-BB9C-FB7C43CEC00C}
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\InprocServer32
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\ProgID
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\Programmable
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\TypeLib
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\VersionIndependentProgID
/.../
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\0
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\0\win32
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\FLAGS
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\HELPDIR
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol\CLSID
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol\CurVer
/.../
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-9A18-40ED-9FE2-E92979DDE094}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE?°eAA
HKLM\SOFTWARE\Microsoft\DownloadManager
HKLM\SOFTWARE\IEMate
HKLM\SOFTWARE\IEMate\VisitedUrl
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\Security
HKCU\Software\Microsoft\Internet Explorer\MenuExt\????... Alt+S
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}
HKCU\Software\Microsoft\Internet Explorer\PhishingFilter
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009100920091010
----------------------------------
Values deleted:15
----------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081020090817\CachePath: "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012009081020090817"
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081020090817\CachePrefix: ":2009081020090817: "
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081020090817\CacheLimit: 0x00002000
/.../
----------------------------------
Values added:155
----------------------------------
HKLM\SOFTWARE\Classes\AppID\IeMate.DLL\AppID: "{F19926D0-05FC-4AE8-BB9C-FB7C43CEC00C}"
HKLM\SOFTWARE\Classes\AppID\{F19926D0-05FC-4AE8-BB9C-FB7C43CEC00C}\: "IeMate"
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\VersionIndependentProgID\: "iemate.status"
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\TypeLib\: "{1B7250A8-A42F-46B2-AA9C-B3CE623B438B}"
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\ProgID\: "iemate.status.1"
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\InprocServer32\: "C:\Program Files\IEMate\IeMate.dll"
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\InprocServer32\ThreadingModel: "Apartment"
/.../
HKLM\SOFTWARE\Classes\Interface\{E0DA85F6-519D-4351-9C78-062EF5D850E5}\: "IIeMateObj"
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\0\win32\: "C:\Program Files\IEMate\IeMate.dll"
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\HELPDIR\: "C:\Program Files\IEMate\"
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\FLAGS\: "0"
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\: "IeMate 1.0 Aa?I?a"
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol\CurVer\: "IeMate.CIEMateProtocol.1"
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol\CLSID\: "{44C5AE91-A034-473D-9518-CC9F053D27CA}"
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol\: "CIEMateProtocol Class"
/.../
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-9A18-40ED-9FE2-E92979DDE094}\: "IEMate"
HKLM\SOFTWARE\IEMate\VisitedUrl\u0: "http://www.iemate.com/install/done.htm|I...
HKLM\SOFTWARE\IEMate\id: "im"
HKLM\SOFTWARE\IEMate\reg: 0x00000000
HKLM\SOFTWARE\IEMate\name: "IE??"
HKLM\SOFTWARE\IEMate\update: 0x4ACED4FD
HKLM\SOFTWARE\IEMate\log: "c:\program files\iemate\log"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\Service: "IEProtector"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\DeviceDesc: "IEProtector"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\Security\Security: 01 00 14 /.../ 00 00 00
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\Type: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\ErrorControl: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\ImagePath: "\??\C:\Program Files\IEMate\IEProtector.sys"
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\DisplayName: "IEProtector"
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}\Codepage: 0x000003A8
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}\DisplayName: "??"
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}\URL: "http://www.baidu.com/baidu?tn=5gocom_3_d...
HKCU\Software\Microsoft\Internet Explorer\PhishingFilter\Enabled: 0x00000001
HKCU\Software\Microsoft\Internet Explorer\PhishingFilter\ShownVerifyBalloon: 0x00000002
/.../
----------------------------------
Values modified:6
----------------------------------
HKCU\Software\Microsoft\Internet Explorer\Main\Window_Placement: 2C 00 00 /.../ 02 00 00
HKCU\Software\Microsoft\Internet Explorer\Main\Window_Placement: 2C 00 00 /.../ 01 00 00
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope: "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope: "{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}"
HKCU\Software\Microsoft\Internet Explorer\Security\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F\UserFile: 01 00 00 /.../ 23 34 16
HKCU\Software\Microsoft\Internet Explorer\Security\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F\UserFile: 01 00 00 /.../ 7E B2 CA
----------------------------------
Files added:98
----------------------------------
C:\Documents and Settings\Administrator\Application Data\iemate\domainhit.dat
C:\Documents and Settings\Administrator\Application Data\iemate\domainhit0.idx
C:\Documents and Settings\Administrator\Application Data\iemate\domainhit1.idx
C:\Documents and Settings\Administrator\Application Data\iemate\history.dat
C:\Documents and Settings\Administrator\Application Data\iemate\history0.idx
C:\Documents and Settings\Administrator\Application Data\iemate\history3.idx
C:\Documents and Settings\Administrator\Application Data\iemate\urlhit.dat
C:\Documents and Settings\Administrator\Application Data\iemate\urlhit0.idx
C:\Documents and Settings\Administrator\Application Data\iemate\urlhit1.idx
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009100920091010\index.dat
C:\Documents and Settings\Administrator\Local Settings\Temp\25123.dmp
C:\Documents and Settings\Administrator\Local Settings\Temp\TFR4.tmp
C:\Program Files\IEMate\cab.dll
C:\Program Files\IEMate\crashinfo.txt
C:\Program Files\IEMate\IEDriver.dll
C:\Program Files\IEMate\IEManager.dll
C:\Program Files\IEMate\IEMate.dll
C:\Program Files\IEMate\IEMate.DMP
C:\Program Files\IEMate\IEMateLib.DLL
C:\Program Files\IEMate\IEMateLib2.DLL
C:\Program Files\IEMate\IEMateLib3.DLL
C:\Program Files\IEMate\IEProtect.dll
C:\Program Files\IEMate\IEProtector.sys
C:\Program Files\IEMate\IERepair.exe
C:\Program Files\IEMate\navagation.ini
C:\Program Files\IEMate\NsPlugin.dll
C:\Program Files\IEMate\option.ini
/.../
C:\Program Files\IEMate\plugins\imFilter.dll
C:\Program Files\IEMate\plugins\inlinesearch.dll
C:\Program Files\IEMate\plugins\suggest.dll
C:\Program Files\IEMate\regedit.dll
C:\Program Files\IEMate\search.ini
C:\Program Files\IEMate\stock.dll
C:\Program Files\IEMate\uninst.exe
C:\Program Files\IEMate\update.ini
C:\WINDOWS\system32\IeProt.dat
----------------------------------
Files deleted:3
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009081020090817\index.dat
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009082720090828\index.dat
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009082820090829\index.dat
----------------------------------
Files [attributes?] modified:1
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
----------------------------------
Folders added:8
----------------------------------
C:\Documents and Settings\Administrator\Application Data\iemate
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009100920091010
C:\Documents and Settings\Administrator\Start Menu\Programs\IE?°eAA
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson
C:\Program Files\IEMate
C:\Program Files\IEMate\page
C:\Program Files\IEMate\page\img
C:\Program Files\IEMate\plugins
----------------------------------
Folders deleted:3
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009081020090817
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009082720090828
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009082820090829
----------------------------------
Total changes:417
----------------------------------
-------------------------------------------------------------------------------------
Internet activity:
Code:
HTTP GET http://hq.stock.sohu.com/zs/zs-1.html?ui...
HTTP GET http://www.iemate.com/bug_report.jsp?dz=...
HTTP GET http://www.iemate.com/install/done.htm
HTTP GET http://www.iemate.com/favicon.ico
-------------------------------------------------------------------------------------
Detected by UnHackMe:
- none -
After first reboot detected by UnHackMe:
Item Name: {00000000-9A18-40ED-9FE2-E92979DDE094}
Author:
Related File: C:\Program Files\IEMate\IeMate.dll
Type: Browser Helper Objects
Item Name: {00000000-9A18-40ED-9FE2-E92979DDE094}
Author:
Related File: C:\Program Files\IEMate\IeMate.dll
Type: Browser Helper Objects
Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
| %program files%\iemate\iemate.dll | Malware |
| %program files%\iemate\iemate.dll | Dangerous |
| %program files%\iemate\iemate.dll | High Risk |
%PROGRAM FILES%\IEMate\IeMate.dll is Trojan/Backdoor.
Kill the file %PROGRAM FILES%\IEMate\IeMate.dll and remove %PROGRAM FILES%\IEMate\IeMate.dll from Windows startup.
Malware dropper: iemate.exe
Removed: C:\Program Files\IEMate\IeMate.dll
-------------------------------------------------------------------------------------
Classification:
Code:
Antivirus Version Last Update Result
F-Secure 8.0.14470.0 2009.10.08 -
Kaspersky 7.0.0.125 2009.10.08 -
McAfee 5765 2009.10.08 -
Microsoft 1.5101 2009.10.08 -
NOD32 4490 2009.10.08 -
Symantec 1.4.4.12 2009.10.08 -
Additional information
File size: 924638 bytes
MD5 : 39ed3f41e857623feee0f77c2224b7c7
SHA1 : 514991912f0417195fb7309d98a303250373eacf
-------------------------------------------------------------------------------------
Installation
When the program is executed, it creates the following registry subkeys and values:
----------------------------------
Keys deleted:3
----------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081020090817
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009082720090828
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009082820090829
----------------------------------
Keys added:125
----------------------------------
HKLM\SOFTWARE\Classes\AppID\IeMate.DLL
HKLM\SOFTWARE\Classes\AppID\{F19926D0-05FC-4AE8-BB9C-FB7C43CEC00C}
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\InprocServer32
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\ProgID
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\Programmable
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\TypeLib
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\VersionIndependentProgID
/.../
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\0
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\0\win32
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\FLAGS
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\HELPDIR
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol\CLSID
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol\CurVer
/.../
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-9A18-40ED-9FE2-E92979DDE094}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE?°eAA
HKLM\SOFTWARE\Microsoft\DownloadManager
HKLM\SOFTWARE\IEMate
HKLM\SOFTWARE\IEMate\VisitedUrl
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\Security
HKCU\Software\Microsoft\Internet Explorer\MenuExt\????... Alt+S
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}
HKCU\Software\Microsoft\Internet Explorer\PhishingFilter
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009100920091010
----------------------------------
Values deleted:15
----------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081020090817\CachePath: "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012009081020090817"
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081020090817\CachePrefix: ":2009081020090817: "
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012009081020090817\CacheLimit: 0x00002000
/.../
----------------------------------
Values added:155
----------------------------------
HKLM\SOFTWARE\Classes\AppID\IeMate.DLL\AppID: "{F19926D0-05FC-4AE8-BB9C-FB7C43CEC00C}"
HKLM\SOFTWARE\Classes\AppID\{F19926D0-05FC-4AE8-BB9C-FB7C43CEC00C}\: "IeMate"
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\VersionIndependentProgID\: "iemate.status"
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\TypeLib\: "{1B7250A8-A42F-46B2-AA9C-B3CE623B438B}"
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\ProgID\: "iemate.status.1"
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\InprocServer32\: "C:\Program Files\IEMate\IeMate.dll"
HKLM\SOFTWARE\Classes\CLSID\{00000000-9A18-40ED-9FE2-E92979DDE094}\InprocServer32\ThreadingModel: "Apartment"
/.../
HKLM\SOFTWARE\Classes\Interface\{E0DA85F6-519D-4351-9C78-062EF5D850E5}\: "IIeMateObj"
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\0\win32\: "C:\Program Files\IEMate\IeMate.dll"
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\HELPDIR\: "C:\Program Files\IEMate\"
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\FLAGS\: "0"
HKLM\SOFTWARE\Classes\TypeLib\{B5EF1414-9E2C-4F20-95F4-7ABEF377E752}\1.0\: "IeMate 1.0 Aa?I?a"
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol\CurVer\: "IeMate.CIEMateProtocol.1"
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol\CLSID\: "{44C5AE91-A034-473D-9518-CC9F053D27CA}"
HKLM\SOFTWARE\Classes\IeMate.CIEMateProtocol\: "CIEMateProtocol Class"
/.../
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-9A18-40ED-9FE2-E92979DDE094}\: "IEMate"
HKLM\SOFTWARE\IEMate\VisitedUrl\u0: "http://www.iemate.com/install/done.htm|I...
HKLM\SOFTWARE\IEMate\id: "im"
HKLM\SOFTWARE\IEMate\reg: 0x00000000
HKLM\SOFTWARE\IEMate\name: "IE??"
HKLM\SOFTWARE\IEMate\update: 0x4ACED4FD
HKLM\SOFTWARE\IEMate\log: "c:\program files\iemate\log"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\Service: "IEProtector"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\0000\DeviceDesc: "IEProtector"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IEPROTECTOR\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\Security\Security: 01 00 14 /.../ 00 00 00
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\Type: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\ErrorControl: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\ImagePath: "\??\C:\Program Files\IEMate\IEProtector.sys"
HKLM\SYSTEM\CurrentControlSet\Services\IEProtector\DisplayName: "IEProtector"
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}\Codepage: 0x000003A8
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}\DisplayName: "??"
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}\URL: "http://www.baidu.com/baidu?tn=5gocom_3_d...
HKCU\Software\Microsoft\Internet Explorer\PhishingFilter\Enabled: 0x00000001
HKCU\Software\Microsoft\Internet Explorer\PhishingFilter\ShownVerifyBalloon: 0x00000002
/.../
----------------------------------
Values modified:6
----------------------------------
HKCU\Software\Microsoft\Internet Explorer\Main\Window_Placement: 2C 00 00 /.../ 02 00 00
HKCU\Software\Microsoft\Internet Explorer\Main\Window_Placement: 2C 00 00 /.../ 01 00 00
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope: "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope: "{5606FFF9-DA61-4B40-92AF-E622ADB4DC2C}"
HKCU\Software\Microsoft\Internet Explorer\Security\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F\UserFile: 01 00 00 /.../ 23 34 16
HKCU\Software\Microsoft\Internet Explorer\Security\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F\UserFile: 01 00 00 /.../ 7E B2 CA
----------------------------------
Files added:98
----------------------------------
C:\Documents and Settings\Administrator\Application Data\iemate\domainhit.dat
C:\Documents and Settings\Administrator\Application Data\iemate\domainhit0.idx
C:\Documents and Settings\Administrator\Application Data\iemate\domainhit1.idx
C:\Documents and Settings\Administrator\Application Data\iemate\history.dat
C:\Documents and Settings\Administrator\Application Data\iemate\history0.idx
C:\Documents and Settings\Administrator\Application Data\iemate\history3.idx
C:\Documents and Settings\Administrator\Application Data\iemate\urlhit.dat
C:\Documents and Settings\Administrator\Application Data\iemate\urlhit0.idx
C:\Documents and Settings\Administrator\Application Data\iemate\urlhit1.idx
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009100920091010\index.dat
C:\Documents and Settings\Administrator\Local Settings\Temp\25123.dmp
C:\Documents and Settings\Administrator\Local Settings\Temp\TFR4.tmp
C:\Program Files\IEMate\cab.dll
C:\Program Files\IEMate\crashinfo.txt
C:\Program Files\IEMate\IEDriver.dll
C:\Program Files\IEMate\IEManager.dll
C:\Program Files\IEMate\IEMate.dll
C:\Program Files\IEMate\IEMate.DMP
C:\Program Files\IEMate\IEMateLib.DLL
C:\Program Files\IEMate\IEMateLib2.DLL
C:\Program Files\IEMate\IEMateLib3.DLL
C:\Program Files\IEMate\IEProtect.dll
C:\Program Files\IEMate\IEProtector.sys
C:\Program Files\IEMate\IERepair.exe
C:\Program Files\IEMate\navagation.ini
C:\Program Files\IEMate\NsPlugin.dll
C:\Program Files\IEMate\option.ini
/.../
C:\Program Files\IEMate\plugins\imFilter.dll
C:\Program Files\IEMate\plugins\inlinesearch.dll
C:\Program Files\IEMate\plugins\suggest.dll
C:\Program Files\IEMate\regedit.dll
C:\Program Files\IEMate\search.ini
C:\Program Files\IEMate\stock.dll
C:\Program Files\IEMate\uninst.exe
C:\Program Files\IEMate\update.ini
C:\WINDOWS\system32\IeProt.dat
----------------------------------
Files deleted:3
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009081020090817\index.dat
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009082720090828\index.dat
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009082820090829\index.dat
----------------------------------
Files [attributes?] modified:1
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
----------------------------------
Folders added:8
----------------------------------
C:\Documents and Settings\Administrator\Application Data\iemate
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009100920091010
C:\Documents and Settings\Administrator\Start Menu\Programs\IE?°eAA
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson
C:\Program Files\IEMate
C:\Program Files\IEMate\page
C:\Program Files\IEMate\page\img
C:\Program Files\IEMate\plugins
----------------------------------
Folders deleted:3
----------------------------------
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009081020090817
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009082720090828
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009082820090829
----------------------------------
Total changes:417
----------------------------------
-------------------------------------------------------------------------------------
Internet activity:
Code:
HTTP GET http://hq.stock.sohu.com/zs/zs-1.html?ui...
HTTP GET http://www.iemate.com/bug_report.jsp?dz=...
HTTP GET http://www.iemate.com/install/done.htm
HTTP GET http://www.iemate.com/favicon.ico
-------------------------------------------------------------------------------------
Detected by UnHackMe:
- none -
After first reboot detected by UnHackMe:
Item Name: {00000000-9A18-40ED-9FE2-E92979DDE094}
Author:
Related File: C:\Program Files\IEMate\IeMate.dll
Type: Browser Helper Objects
Item Name: {00000000-9A18-40ED-9FE2-E92979DDE094}
Author:
Related File: C:\Program Files\IEMate\IeMate.dll
Type: Browser Helper Objects
Removal Results: Success
Number of reboot: 1
-------------------------------------------------------------------------------------
Recommended software:
UnHackMe anti-rootkit and anti-malware
http://www.unhackme.com
RegRun Security Suite (Good choice for removal and protection)
Dmitry Sokolov:
I created UnHackMe in 2006 to fix the problem that antivioruses did not fix: detecting rootkits.
Since that time I work every day to fix the issues that antiviruses cannot.
If your antivirus have not helped you solve the problem, you should try UnHackMe.
We are a small company and you can ask me directly, if you have any questions.