HackTool.Win32.IDMPatcher.AE

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>IEXPLORE
3. In the right panel, locate and delete the entry:
   name = "Internet Explorer"
4. Again In the right panel, locate and delete the entry:
   int = "1"
5. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>Firefox
6. In the right panel, locate and delete the entry:
   name = "Mozilla Firefox"
7. Again In the right panel, locate and delete the entry:
   int = "1"
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>chrome
9. In the right panel, locate and delete the entry:
   name = "Google Chrome"
10. Again In the right panel, locate and delete the entry:
    int = "1"
11. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>OPERA
12. In the right panel, locate and delete the entry:
    name = "Opera"
13. Again In the right panel, locate and delete the entry:
    int = "1"
14. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>IDMBI>Safari
15. In the right panel, locate and delete the entry:
    name = "Apple Safari"
16. Again In the right panel, locate and delete the entry:
    int = "1"
17. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>SpecialKeys
18. In the right panel, locate and delete the entry:
    UseKeyToPrevent = "1"
19. Again In the right panel, locate and delete the entry:
    UseKeyToForce = "0"
20. Again In the right panel, locate and delete the entry:
    AltP = "1"
21. Again In the right panel, locate and delete the entry:
    ShiftP = "0"
22. Again In the right panel, locate and delete the entry:
    CtrlP = "0"
23. Again In the right panel, locate and delete the entry:
    DelP = "0"
24. Again In the right panel, locate and delete the entry:
    AltF = "0"
25. Again In the right panel, locate and delete the entry:
    CtrlF = "0"
26. Again In the right panel, locate and delete the entry:
    ShiftF = "0"
27. Again In the right panel, locate and delete the entry:
    InsF = "1"
28. Again In the right panel, locate and delete the entry:
    CheckMouse = "0"
29. Again In the right panel, locate and delete the entry:
    SkipHtml = "1"
30. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager
31. In the right panel, locate and delete the entry:
    AppDataIDMFolder = "%Application Data%\IDM"
32. Again In the right panel, locate and delete the entry:
    CommonAppDataIDMFolder = "%All Users Profile%\IDM"
33. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>menuExt
34. In the right panel, locate and delete the entry:
    ffdownl1_str = "Download with IDM"
35. Again In the right panel, locate and delete the entry:
    ffdownlAll_str = "Download all links with IDM"
36. Again In the right panel, locate and delete the entry:
    ffdownlFLV_str = "Download last requested FLV video"
37. Again In the right panel, locate and delete the entry:
    ffdownl10FLV_str = "Choose from 10 last requested FLV videos"
38. Again In the right panel, locate and delete the entry:
    ffdownlppFLV_str = "Download FLV video with IDM"
39. Again In the right panel, locate and delete the entry:
    ffdownlFLVa_str = "Download last requested FLV video with IDM"
40. Again In the right panel, locate and delete the entry:
    ffdownl10FLVa_str = "Download FLV videos with IDM from 10 last requested"
41. Again In the right panel, locate and delete the entry:
    ExceptionServers = "{random characters}"
42. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>FoldersTree>Compressed
43. In the right panel, locate and delete the entry:
    ID = "7"
44. Again In the right panel, locate and delete the entry:
    mask = "zip rar r0* r1* arj gz sit sitx sea ace bz2 7z"
45. Again In the right panel, locate and delete the entry:
    pathW = ""
46. Again In the right panel, locate and delete the entry:
    rememberLastPath = "0"
47. Again In the right panel, locate and delete the entry:
    forSiteOnly = "0"
48. Again In the right panel, locate and delete the entry:
    sites = ""
49. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>FoldersTree>Documents
50. In the right panel, locate and delete the entry:
    ID = "5"
51. Again In the right panel, locate and delete the entry:
    mask = "doc pdf ppt pps docx pptx"
52. Again In the right panel, locate and delete the entry:
    pathW = ""
53. Again In the right panel, locate and delete the entry:
    rememberLastPath = "0"
54. Again In the right panel, locate and delete the entry:
    forSiteOnly = "0"
55. Again In the right panel, locate and delete the entry:
    sites = ""
56. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>FoldersTree>Music
57. In the right panel, locate and delete the entry:
    ID = "2"
58. Again In the right panel, locate and delete the entry:
    mask = "mp3 wav wma mpa ram ra aac aif m4a"
59. Again In the right panel, locate and delete the entry:
    pathW = ""
60. Again In the right panel, locate and delete the entry:
    rememberLastPath = "0"
61. Again In the right panel, locate and delete the entry:
    forSiteOnly = "0"
62. Again In the right panel, locate and delete the entry:
    sites = ""
63. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>FoldersTree>Programs
64. In the right panel, locate and delete the entry:
    ID = "1"
65. Again In the right panel, locate and delete the entry:
    mask = "exe msi"
66. Again In the right panel, locate and delete the entry:
    pathW = ""
67. Again In the right panel, locate and delete the entry:
    rememberLastPath = "0"
68. Again In the right panel, locate and delete the entry:
    forSiteOnly = "0"
69. Again In the right panel, locate and delete the entry:
    sites = ""
70. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DownloadManager>FoldersTree>Video
71. In the right panel, locate and delete the entry:
    ID = "3"
72. Again In the right panel, locate and delete the entry:
    mask = "avi mpg mpe mpeg asf wmv mov qt rm mp4 flv m4v webm ogv ogg mkv ts"
73. Again In the right panel, locate and delete the entry:
    pathW = ""
74. Again In the right panel, locate and delete the entry:
    rememberLastPath = "0"
75. Again In the right panel, locate and delete the entry:
    forSiteOnly = "0"
76. Again In the right panel, locate and delete the entry:
    sites = ""
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IDMan.CIDMLinkTransmitter>CLSID
78. In the right panel, locate and delete the entry:
    (Default) = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{AC746233-E9D3-49CD-862F-068F7B7CCCA4}
80. In the right panel, locate and delete the entry:
    (Default) = "IDMan.CIDMLinkTransmitter"
81. Again In the right panel, locate and delete the entry:
    AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{AC746233-E9D3-49CD-862F-068F7B7CCCA4}>LocalServer32
83. In the right panel, locate and delete the entry:
    (Default) = "{malware file path and name}"
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{AC746233-E9D3-49CD-862F-068F7B7CCCA4}
85. In the right panel, locate and delete the entry:
    (Default) = "IDMan"
86. Again In the right panel, locate and delete the entry:
    RunAs = "Interactive User"
87. Again In the right panel, locate and delete the entry:
    ROTFlags = "1"
88. Again In the right panel, locate and delete the entry:
    iedownl1_str = "Download with IDM"
89. Again In the right panel, locate and delete the entry:
    iedownlAll_str = "Download all links with IDM"
90. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
91. In the right panel, locate and delete the entry:
    DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Internet Explorer
93. In the right panel, locate and delete the entry:
    DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"
94. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Edge>Extensions>ngpampappnmepgilojfohadhhmbhlaek
95. In the right panel, locate and delete the entry:
    path = "%User Temp%\IDMGCExt.crx"
96. Again In the right panel, locate and delete the entry:
    version = "6.35.18"
97. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Edge>NativeMessagingHosts>com.tonec.idm
98. In the right panel, locate and delete the entry:
    (Default) = "%User Temp%\IDMMsgHost.json"
99. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>CocCoc>Browser>Extensions>ngpampappnmepgilojfohadhhmbhlaek
100. In the right panel, locate and delete the entry:
     path = "%User Temp%\IDMGCExt.crx"
101. Again In the right panel, locate and delete the entry:
     version = "6.35.18"
102. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>CocCoc>Browser>NativeMessagingHosts>com.tonec.idm
103. In the right panel, locate and delete the entry:
     (Default) = "%User Temp%\IDMMsgHost.json"
104. Again In the right panel, locate and delete the entry:
     EnableDriver = "1"
105. Again In the right panel, locate and delete the entry:
     FSPSSettingsChecked = "1"
106. Again In the right panel, locate and delete the entry:
     FSSettingsChecked = "1"
107. Again In the right panel, locate and delete the entry:
     mzcc_ext_vers = "73120"
108. Again In the right panel, locate and delete the entry:
     intAOFRWE = "1"
109. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Windows>CurrentVersion>explorer>Browser Helper Objects>{0055C089-8582-441B-A0BF-17B458C2A3A8}
110. In the right panel, locate and delete the entry:
     (Default) = "IDM Helper"
111. Again In the right panel, locate and delete the entry:
     NoExplorer = "1"
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{0055C089-8582-441B-A0BF-17B458C2A3A8}
113. In the right panel, locate and delete the entry:
     (Default) = "IDM Helper"
114. Again In the right panel, locate and delete the entry:
     NoExplorer = "1"
115. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Google>Chrome>NativeMessagingHosts>com.tonec.idm
116. In the right panel, locate and delete the entry:
     (Default) = "%User Temp%\IDMMsgHost.json"
117. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Google>Chrome>NativeMessagingHosts>com.tonec.idm
118. In the right panel, locate and delete the entry:
     (Default) = "%User Temp%\IDMMsgHost.json"
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Google>Chrome>Extensions>ngpampappnmepgilojfohadhhmbhlaek
120. In the right panel, locate and delete the entry:
     path = "%User Temp%\IDMGCExt.crx"
121. Again In the right panel, locate and delete the entry:
     version = "6.35.18"
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Google>Chrome>Extensions>ngpampappnmepgilojfohadhhmbhlaek
123. In the right panel, locate and delete the entry:
     path = "%User Temp%\IDMGCExt.crx"
124. Again In the right panel, locate and delete the entry:
     version = "6.35.18"
125. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

•For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Application Data%\IDM\idmfc.dat
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).

To delete malware/grayware/spyware folders:

For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %User Profile%\Downloads\Compressed
   • %All Users Profile%\IDM
   • %User Profile%\Downloads\Documents
   • %User Profile%\Downloads\Programs
   • %User Profile%\Downloads\Music
   • %User Profile%\Downloads\Video
   • %Application Data%\DMCache
   • %Application Data%\IDM
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %User Profile%\Downloads\Compressed
   • %All Users Profile%\IDM
   • %User Profile%\Downloads\Documents
   • %User Profile%\Downloads\Programs
   • %User Profile%\Downloads\Music
   • %User Profile%\Downloads\Video
   • %Application Data%\DMCache
   • %Application Data%\IDM
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Server 2008 (R2).