Adlice forum

Software feedback => RogueKiller => Topic started by: mark_a_l on April 27, 2014, 12:17:07 AM

Title: iertutil.dll ??
Post by: mark_a_l on April 27, 2014, 12:17:07 AM

I updated to V8.8.15 _x64_ from and v8.7.11_x64 (Win 7) and now I get various things reported under drivers. The one that always comes up is something about iertutil.dll
Doing a google search, it appears this file must be present for windows to run, so I am not going to risk deleting it. Here is the pertinent part of the log file. Any idea why this is coming up? Google also seems to indicate others have had it reported by RK too.

[Address] EAT @explorer.exe (DllCanUnloadNow) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76E08F34)
[Address] EAT @explorer.exe (DllGetClassObject) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76E08FF0)
[Address] EAT @explorer.exe (FastMimeGetFileExtension) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76DEB720)
[Address] EAT @explorer.exe (FastMimeGetIsMimeFilterEnabled) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76DE5B20)
[Address] EAT @explorer.exe (FastMimeLookupKnownType) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76DE5A68)
[Address] EAT @explorer.exe (FastMimeSetIsMimeFilterEnabled) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76DE5FD8)
[Address] EAT @explorer.exe (IEGetFrameUtilExports) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76E08DD0)
[Address] EAT @explorer.exe (IEGetProcessModule) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76E08DB0)
[Address] EAT @explorer.exe (IEGetTabWindowExports) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76E08DC0)
[Address] EAT @explorer.exe (IERT_DelayLoadFailureHook) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76E091B0)
[Address] EAT @explorer.exe (ImpersonateUser) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76E10C98)
[Address] EAT @explorer.exe (LCIECalculatePackedStringSize) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76DFB5A4)
[Address] EAT @explorer.exe (LCIEPackString) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76DFB684)
[Address] EAT @explorer.exe (LCIEUnpackString) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76DFB520)
[Address] EAT @explorer.exe (ResetIEExtensibility) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76E11CF0)
[Address] EAT @explorer.exe (ResetIERegistrySettings) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76E11AE0)
[Address] EAT @explorer.exe (RevertImpersonate) : WININET.dll -> HOOKED (C:\Windows\system32\iertutil.dll @ 0x76E10D18)

Title: Re: iertutil.dll ??
Post by: mark_a_l on April 27, 2014, 04:42:49 AM

I did a windows update. There were only a few and I noticed the iertutil.dll  file now had a new date of 03/07/14 vice 02/05/14 and it now no longer is listed in the drivers scan results.

Title: Re: iertutil.dll ??
Post by: mark_a_l on April 27, 2014, 10:37:39 PM

Well, that did not do it. Sometimes it shows up and sometimes it does not.

Title: Re: iertutil.dll ??
Post by: Tigzy on April 28, 2014, 08:24:28 AM

Hello
That's because you have/ have not internet explorer started :)
No problem, the false positive is already addressed for the next release