EMIEsitelist and EMIEuserlist hidden directories and dat-files

Question

2014-04-05
Cross-posted from
http://answers.microsoft.com/en-us/windows/forum/windows8_1-security/erniesitelist-and-ernieuserlist/00407bd2-e349-423c-a8e5-cb6127840ea5
Original Post dated April 21, 2014
EmieSiteList and EmieUserList
Microsoft Security - Privacy Concerns
I found two unknown directories on my PC in my user profile.  I have, so far, been unable to identify what put them there, which process owns them, and when I delete them (using Admin escalated privileges) they come back after a few minutes or immediately
after reboot.
     c:\users\USERNAME\appdata\local\EmieSitelist\container.dat
     c:\users\USERNAME\appdata\local\EmieUserlist\container.dat
     C:\Users\USERNAME\AppData\LocalLow\EmieSiteList\container.dat
     C:\Users\USERNAME\AppData\LocalLow\EmieUserlist\container.dat
It was time, anyway, so I wiped the drive using factory low-level overwriting and performed a clean install of Windows 8.1 Pro using a freshly downloaded ISO from Microsoft; one with an ESD distribution, written to a new just out-of-the-bedamned-hardshell-plastic
flashdrive..
I just completed the clean install, in this sequence:
Boot to flashdrive and let Windows create partitions then install.  Reboot.  Check AppData; no folders found.
Activate.  Check AppData; no folders found.
Run first Update; install everything except Bing Bar and Desktop.    Check AppData; no folders found.  Reboot.  Check AppData; no folders found.
Add Feature Windows Media Center.  Check AppData; no folders found.  Reboot.  Check AppData; no folders found.
Run Updates a second time.  Check AppData; no folders found.  Reboot.  Check AppData; no folders found.
Remove MS C++ v12 x86 and x64 installed during Update.    Check AppData; no folders found.  Reboot.  Check AppData; no folders found.
Download from MSDN (http://msdn.microsoft.com/en-us/vstudio/default) Redistributables MS C++ x86 and x64, 2005, 2008, 2010, and 2012.4 versions, and install in sequence.  Check AppData
after each install; no folders found.  Reboot after each install and check AppData; no folders found.
Run Updates a third time.  Response was No Updates Available.  Check AppData; no folders found.
Reboot.  Check AppData; all four sub-directories are now present.
These sub-directories and dat-files are not, so far, present in the AppData\Roaming directory.
There is nothing except Microsoft Windows 8.1 Pro WMC and the 10 MS C++ packages installed; and MS Silverlight and AMD (videocard) Catalyst Control Center on the machine.  Windows Defender is present but is installed as part of Windows 8 and 8.1;
and its' updates are provided via the MS Update process.  All - repeat ALL of these items are provided by Microsoft.
My questions are:  What are the Emie directories for; what program created them, and what does the various container.dat files "contain"?  And . . . if not absolutely necessary, How do I get rid of them and keep them from coming back?
First attempt at Solution:
Permissions are Full for System, USERNAME, and group Administrators.  The USERNAME is the Owner, and Effective Permissions for each of the 3 is Full.
Open Command Prompt (Admin)
C:\Windows\system32>cd\
C:\>attrib -r -h +s C:\Users\USERNAME\AppData\Local\EmieSiteList\container.dat
C:\>attrib -r -h +s C:\Users\USERNAME\AppData\Local\EmieSiteList
C:\>attrib -r -h +s C:\Users\USERNAME\AppData\Local\EmieUserList
C:\>attrib -r -h +s C:\Users\USERNAME\AppData\Local\EmieUserList\container.dat
C:\>attrib -r -h +s C:\Users\USERNAME\AppData\LocalLow\EmieUserList\container.dat
C:\>attrib -r -h +s C:\Users\USERNAME\AppData\LocalLow\EmieUserList
C:\>attrib -r -h +s C:\Users\USERNAME\AppData\LocalLow\EmieSiteList
C:\>attrib -r -h +s C:\Users\USERNAME\AppData\LocalLow\EmieSiteList\container.dat
C:\>
BOTH Files and Directories are no longer Hidden.  The Directories still show that the files within are READ-Only, but checking the actual file shows that it is no longer R-O.
I then deleted each of the 4 directories and  closed Windows (File) Explorer.
After less than 3 minutes reading pages on the internet (at Microsoft's Ask Windows Community), I opened Windows Explorer to check and found that the sub-directories had re-created themselves in both the Local and LocalLow directories.
The container.dat files were back in the Local sub-dir and after another few minutes, also back in the LocalLow sub-dir.
Both the sub-directories and the container.dat files are once again Super-Hidden.
Analysis using Windows utilities and SysInternals and NirSoft tools have not identified which object or process or service owns these objects.
ADDED:  My system is a home system, not connected to any work domain via VPN or otherwise.  WHY is the Windows Update Team not spending time to implement condition-and-error-checking to ensure that unneeded updates, services, and changes are not made
without the system owner/operator permission?  Further, WHY is this particular issue so hard to find info about; what is being kept from customers and why?

Answer 1

Dear sir Shovel Driver,
   About:  EMIEsitelist  and  EMIEuserlist
.., hidden directories and dat-files
Internet Explorer 11 (on Windows 7 and Windows 8.1) provides increased performance, improved security, and support for the modern technologies like HTML5 and CSS3 that power today’s Web sites and services. By adding better backward compatibility with
Enterprise Mode, Internet Explorer 11 now helps customers stay up to date with the latest browser—and facilitates using the latest software, services, and devices.
IE11 Enterprise Mode can be set in the Group Policy Console, or by adding a
Registry setting:
REGISTRY:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main]
"EnterpriseMode"="Disable"
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode]
Or a edit a Group Policy setting, which you can find under:
[Windows-Key]+[R]->[Run]->Type here:
   gpedit.msc
Press [Enter], with an UAC Warning:
Do you want to allow the following program to make changes on this computer:
gpedit.msc ?
Select/Press: Yes
Go to in the Left pane of the GPedti.msc Window:
  Computer Configuration
  Administrative Templates
  Windows Components
  Internet Explorer
Change / Add at right list, down under:
  "Use the Enterprise Mode IE website list"
Set this option to - whatever you need;  Disabled,
Enabled (Default is: Not Configured)
When Enabled, you need to add a list with Web-Sites, Domains or Web-Pages.
This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode IE, instead of Standard mode, because of compatibility issues. Users can't edit this list.
If you enable this policy setting, Internet Explorer downloads the website list from your location
  (HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\Main\EnterpriseMode),
opening all listed websites using Enterprise Mode IE, Web-Sites are seperated by a sign: "
If you disable or don't configure this policy setting, Internet Explorer opens all websites using Standards mode.
Now to
properly close and conclude this
mystery:
EMIEsitelist and EMIEuserlist
.., are hidden directories and dat-files
Thses directories and dat files are used to store data for the IE11
EnterpriseMode.
It is not a: Virus, neither it is a Trojan, Hoax, KeyLogger or anything else bad.
TECHNET Sources:
 Turn on Enterprise Mode and Use a Site List (Deploy):
 http://technet.microsoft.com/en-us/ie/dn262703.aspx
 What is Enterprise Mode?:
 http://technet.microsoft.com/library/dn640687.aspx
If you find this usefull, please Vote at the button
"I Find This Usefull"
Thank you! ;)
Best regards, MPVS
MP|VS