Should I block it?

98%

Yes, 98% block recommendation.

Possible reasons:

Multiple malware detections

Performance resource utilization

Additional versions

1.00.01	16.67%
1.00.01	5.56%
1.00.01	50.00%
1.00.01	27.78%

(Note, Web Cake publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

PE file structure

Show functions

Import table

advapi32.dll

RegOpenKeyW, RegCreateKeyW, RegSetValueW, RegQueryValueW, RegQueryInfoKeyW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegOpenKeyExW, RegEnumKeyExW

kernel32.dll

GetProcAddress, GetModuleHandleW, lstrcmpiW, WaitForSingleObject, lstrcmpW, GetProcessHeap, MultiByteToWideChar, lstrlenA, HeapFree, HeapAlloc, HeapReAlloc, InterlockedIncrement, WideCharToMultiByte, GetModuleFileNameW, FreeLibrary, LoadLibraryExW, SetThreadLocale, GetThreadLocale, CloseHandle, CreateFileW, WriteConsoleW, SetStdHandle, GetConsoleMode, GetConsoleCP, FindResourceExW, FindResourceW, LoadResource, LockResource, SizeofResource, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, EnterCriticalSection, GetLastError, RaiseException, InterlockedDecrement, lstrlenW, SetFilePointer, LoadLibraryW, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetModuleFileNameA, GetStartupInfoW, GetFileType, SetHandleCount, Sleep, IsProcessorFeaturePresent, GetStringTypeW, LCMapStringW, SetLastError, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, GetCurrentProcess, TerminateProcess, FlushFileBuffers, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStdHandle, WriteFile, ExitProcess, HeapCreate, GetCommandLineA, DecodePointer, EncodePointer, CreateThread, GetCurrentThreadId, ExitThread, RtlUnwind, HeapSize, HeapDestroy

ole32.dll

CoTaskMemRealloc, CoTaskMemAlloc, CoCreateGuid, CoInitialize, CoUninitialize, CoCreateInstance, StringFromGUID2, CoTaskMemFree

rpcrt4.dll

UuidToStringW, NdrStubCall2, NdrStubForwardingFunction, IUnknown_Release_Proxy, NdrDllUnregisterProxy, NdrDllRegisterProxy, NdrCStdStubBuffer2_Release, NdrDllCanUnloadNow, NdrDllGetClassObject, NdrOleAllocate, NdrOleFree, IUnknown_QueryInterface_Proxy, RpcStringFreeW, IUnknown_AddRef_Proxy

user32.dll

InvalidateRect, GetWindow, GetClassNameW, CharNextW, wsprintfW

ws2_32.dll

WSAGetOverlappedResult, WSASend, WSAResetEvent, WSARecv, WSAEnumNetworkEvents, WSASetEvent, WSACreateEvent, WSASocketW, WSACloseEvent, GetAddrInfoW, WSAEventSelect, FreeAddrInfoW, WSAConnect

Export table

DllCanUnloadNow

DllGetClassObject

DllInstall

DllRegisterServer

DllUnregisterServer

WebCakeIEClient.dll

WebCake Runtime by Web Cake (Signed)

Remove WebCakeIEClient.dll

Version:	1.00.01
MD5:	07a532c6044b985507a37eb80af98b30
SHA1:	238f78360b456ee74cc8397e2dd38dabcd9a44fb
SHA256:	c5caced3cbea6696ae44f5f9021b3cb7bb8d6110e4becae11b782d3f5c3679a3

Warning 17 antivirus scanners has detected malware.

Overview

webcakeieclient.dll is malware that is loaded as dynamic link library that runs in the context of Internet Explorer. It is installed in Internet Explorer as a Browser Helper Object (BHO) which has full acess to the web browser's behaviors and content. This is typically installed with the program WebCake 3.00 published by Web Cake LLC and is most likely removed by most users once installed (84% removed). The file is digitally signed by Web Cake which was issued by the VeriSign certificate authority (CA).

Details

File name:	webcakeieclient.dll
Publisher:	WebCake LLC
Product name:	WebCake Runtime
Typical file path:	C:\Program Files\webcake\webcakeieclient.dll
File version:	1.00.01
Size:	193.27 KB (197,912 bytes)
Build date:	5/24/2013 2:58 PM
Certificate
Issued to:	Web Cake
Authority (CA):	VeriSign
Effective date:	Monday, April 8, 2013
Expiration date:	Thursday, April 9, 2015
Digital DNA
File packed:	No
.NET CLR:	No

More details

Programs

The following program will install this file

WebCake

Web Cake LLC

84% remove

The WebCake web browser plugin by sterkly LLC declares that it can sweeten browsing experience. It can modify Windows hosts file and DNS settings. Once installed, the WebCake Safe will display a see similar button on the product images of the shopping websites such as Amazon, Expedia, Best Buy, Facebook and so on. As long as you click the see similar button, the WebCake will pop up ads.

Behaviors

Internet Explorer Browser Helper Object

Located in the registry at 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects'

BHO CLSID: {2A5A2A90-3B30-4E6E-A955-2F232C6EF517}

Malware detections

Based on 40+ industry antivirus scanners, 17 of them detected the following malware.

Antivirus engine	Engine version	Detection
avast!	8.0.1489.320	Win32:Adware-gen [Adw]
AVG	2014.0.3629	AdInject.WebCake
BitDefender	7.2	Adware.WebCake.A
CAT Quick Heal	9.13.12.00	Adware.WebCake (Not a Virus)
Comodo Internet Security	16770	ApplicUnwnt
Dr.Web	8.13.9.29	Adware.Plugin.11
Emsisoft Anti-Malware	3.0.0.583	Adware.WebCake.A (B)
ESET NOD32	7.8691	probably a variant of Win32/Adware.Yontoo.A
F-Secure	11.0.19100.45	Adware.WebCake.A
G Data	13.9.22	Adware.WebCake.A
Ikarus	T3.1.5.4.0	AdWare.Win32.WebCake
Microsoft Security Essentials	1.9700.0	Adware:Win32/WebCake
eScan by MicroWorld	12.0.250.0	Adware.WebCake.A
nProtect	2013-08-15.01	Adware.WebCake.C
PC Tools	9.0.0.2	SecurityRisk.WebCake
Symantec	20131.1.0.101	WebCake
VIPRE Antivirus	20530	Yontoo (fs)

Distribution by Windows OS

OS version	distribution
Windows 7 Ultimate	44.44%
Windows 8	16.67%
Windows 7 Home Premium	11.11%
Windows 8 Pro	11.11%
Windows 7 Professional	5.56%
Windows Vista Home Premium	5.56%
Microsoft Windows XP	5.56%

Distribution by country

United States installs about 22.22% of WebCake Runtime.

Distribution by PC manufacturer

PC Manufacturer	distribution
ASUS	28.57%
Hewlett-Packard	19.05%
Dell	19.05%
Acer	14.29%
MSI	9.52%
GIGABYTE	4.76%
American Megatrends	4.76%

Remove Adware and Spyware Programs, FREE Download!