IEPlugin Description:

IEPlugin is an IE Browser Helper Object. It monitors site addresses, content entered into forms, and even local filenames browsed, and pops up advertisements when it sees a targeted keyword. It also installs a process to update itself, which will attempt to connect to its servers every minute or so, very annoying if you have auto-dial.

IEPlugin is written and distributed by InfoAge Marketing International, who also run the 123Webhost and JupiterTech hosting services. However, it seems as well as spyware, IMI are also involved in writing spam-sending software ("Godmail") and a marketing operation for pheromone pills ("Flatcash").

Also known as: BHO3Lib, ExplWWW or IExpl from internal names, packed: MimarSinan, TrojanDownloader.Win32.OneClickNetSearch.b, TrojanDropper.Win32.Delf.av, Win Server from its process., winobject, after the DLL containing the BHO code.

IEPlugin Automatic Removal:

Using Spyware Doctor to detect and remove IEPlugin AUTOMATICALLY!

IEPlugin Manual Removal:

There is no uninstall option. IMI provides three executable files which are supposed to remove it, but they are heavily covered by disclaimers and might do anything.

First you must prevent 'winserv' from starting up every time you start the computer. Run regedit and open the key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

There should be two values here called 'Win Server' and 'Win Server Updt'. Delete them both. Next, deregister the IEPlugin DLLs by executing the following commands.For Windows 95/98/Me, use:

"%WinDir%\SYSTEM\regsvr32.exe" /u "%WinDir%\winobject.dll"
"%WinDir%\SYSTEM\regsvr32.exe" /u "%WinDir%\systb.dll"

Or, for Windows NT/2000/XP:

regsvr32 /u "%WinDir%\winobject.dll"
regsvr32 /u "%WinDir%\systb.dll"

Now reset the computer, and you should be able to go into your Windows folder and delete:

winobject.dll
winserv.exe
wupdt.exe
systb.dll
kw.dat
toServer.pst
lu.dat
extract.exe
button0.ico
button1.ico
button2.ico
logo.ico

1. Kill these running processes with Task Manager:
   extract.exe
   trojandropper.win32.delf.av.exe
   wupdt.exe
    
2. Remove AutoRun Reference: Go to the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. If you find the value win server updt, delete it and reboot the machine immediately.
    
3. Unregister these DLLs with Regsvr32, then reboot:
   systemroot+\system32\ieplugin.dll
   systemroot+\system32\systb.dll
   systemroot+\system32\winobject.dll
   systemroot+\system\ieplugin.dll
   systemroot+\system\systb.dll
   systemroot+\system\winobject.dll
    
4. Remove these registry items (if present) with RegEdit:
   HKEY_CLASSES_ROOT\clsid\{556dde35-e955-11d0-a707-000000521958}
   HKEY_CLASSES_ROOT\clsid\{69135bde-5fdc-4b61-98aa-82ad2091bccc}
   HKEY_CLASSES_ROOT\clsid\{914afb33-550b-4bd0-b4ef-8da185504836}
   HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{69135bde-5fdc-4b61-98aa-82ad2091bccc}
   HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{914afb33-550b-4bd0-b4ef-8da185504836}
   HKEY_LOCAL_MACHINE\clsid\{69135bde-5fdc-4b61-98aa-82ad2091bccc}
   HKEY_LOCAL_MACHINE\clsid\{914afb33-550b-4bd0-b4ef-8da185504836}
   HKEY_LOCAL_MACHINE\software\classes\clsid\{69135bde-5fdc-4b61-98aa-82ad2091bccc}
   HKEY_LOCAL_MACHINE\software\classes\clsid\{914afb33-550b-4bd0-b4ef-8da185504836}
   HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{69135bde-5fdc-4b61-98aa-82ad2091bccc}
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{69135bde-5fdc-4b61-98aa-82ad2091bccc}
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{914afb33-550b-4bd0-b4ef-8da185504836}
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage
   \c:/windows/wupdt.exe
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\win server
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\win server updt
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
   \c:\windows\wupdt.exe
    
5. Remove these files (if present) with Windows Explorer:
   systemroot+\system32\ieplugin.dll
   systemroot+\system32\systb.dll
   systemroot+\system32\winobject.dll
   systemroot+\system\ieplugin.dll
   systemroot+\system\systb.dll
   systemroot+\system\winobject.dll
   extract.exe
   ie_plugin.inf
   trojandropper.win32.delf.av.exe
   wupdt.exe
    
6. After following the instructions above, you will still need to restore your original settings and prevent this from happening again. Here's how.

More Removal Instructions for Adware/Spyware Programs - 'I'