Comments on: IE Antivirus or IEAntivirus 3.2 Removal Guide http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/ A techie's take on Spyware. Fri, 04 Jul 2008 23:56:57 +0000 http://wordpress.org/?v=2.3.1 By: Leo http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6831 Leo Thu, 03 Jul 2008 03:25:01 +0000 http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6831 This is a log of my scan using SmitFraudFix. I never instaled IE Anti Virus but I do get the pop up stating a critical error each time I try to open any kind of folder. SmitFraudFix v2.328 Scan done at 23:19:46.57, Wed 07/02/2008 Run from C:\Users\fLuiD\Desktop\SmitfraudFix OS: Microsoft Windows [Version 6.0.6001] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Windows\System32\svchost.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\hp\support\hpsysdrv.exe C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe C:\Windows\RtHDVCpl.exe C:\Windows\System32\jureg.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Windows\system32\schtasks.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Common Files\AOL\1209725682\ee\aolsoftware.exe C:\Windows\system\wcdvtray.exe C:\Windows\System32\rundll32.exe C:\Program Files\Winamp\winampa.exe C:\Windows\System32\rundll32.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Ares\Ares.exe C:\Program Files\AIM6\aim6.exe C:\Windows\ehome\ehmsas.exe C:\Windows\ehome\ehsched.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\ehome\ehRecvr.exe C:\Program Files\AIM6\aolsoftware.exe c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe C:\hp\kbd\kbd.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Windows\system32\jusched.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\AOL 9.0\waol.exe C:\Program Files\AOL 9.0\shellmon.exe C:\Program Files\BitLord2\BitLord.exe c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe C:\Windows\system32\SearchProtocolHost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\explorer.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\cmd.exe C:\Windows\system32\DllHost.exe c:\windows\system32\rundll32.exe C:\Windows\system32\wbem\wmiprvse.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix !!!Attention, following keys are not inevitably infected!!! »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "LoadAppInit_DLLs"=dword:00000000 »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\Windows\\system32\\userinit.exe," »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: NVIDIA nForce Networking Controller DNS Server Search Order: 192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End This is a log of my scan using SmitFraudFix. I never instaled IE Anti Virus but I do get the pop up stating a critical error each time I try to open any kind of folder.

SmitFraudFix v2.328

Scan done at 23:19:46.57, Wed 07/02/2008
Run from C:\Users\fLuiD\Desktop\SmitfraudFix
OS: Microsoft Windows [Version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\jureg.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\AOL\1209725682\ee\aolsoftware.exe
C:\Windows\system\wcdvtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\AIM6\aim6.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\ehome\ehsched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\AIM6\aolsoftware.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Windows\system32\jusched.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\BitLord2\BitLord.exe
c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\DllHost.exe
c:\windows\system32\rundll32.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler’s .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLs”=”"
“LoadAppInit_DLLs”=dword:00000000

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
“Userinit”=”C:\\Windows\\system32\\userinit.exe,”

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

]]> By: Gary http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6321 Gary Mon, 23 Jun 2008 00:56:02 +0000 http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6321 Spybot has an update that completely fixed the problem. Hope you already have it on your machine so all you have to do is launch it and update it. Spybot has an update that completely fixed the problem. Hope you already have it on your machine so all you have to do is launch it and update it.

]]> By: fernando http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6316 fernando Sun, 22 Jun 2008 22:02:25 +0000 http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6316 I don't know what happened cause I didn't find the: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ie antivirus And the pop ups continue : "System Error Atention WinuE! ... Also the file ieantivirus.dll couldn't delete Thank you Bye I don’t know what happened cause I didn’t find the:

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ie antivirus

And the pop ups continue :

“System Error
Atention WinuE! …

Also the file ieantivirus.dll
couldn’t delete

Thank you
Bye

]]> By: Telly http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6287 Telly Sat, 21 Jun 2008 10:39:18 +0000 http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6287 If you have Antivirus 2008, is it the same thing? Can you remove it the same way? If you have Antivirus 2008, is it the same thing? Can you remove it the same way?

]]> By: Mad http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6280 Mad Sat, 21 Jun 2008 06:14:48 +0000 http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6280 I did all the things to remove the IE antivirus but when i open my drive it pop out and said "System Error!"bla bla bla then click ok to download antispyware.Can someone help me please !!? I did all the things to remove the IE antivirus but when i open my drive it pop out and said “System Error!”bla bla bla then click ok to download antispyware.Can someone help me please !!?

]]> By: lz http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6278 lz Sat, 21 Jun 2008 03:35:11 +0000 http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6278 cant remove, keep pop up,plsss help, the virus popup during i click any folder of my computer cant remove, keep pop up,plsss help,
the virus popup during i click any folder of my computer

]]> By: lz http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6275 lz Sat, 21 Jun 2008 03:32:02 +0000 http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6275 cant remove, keep pop up,plsss help cant remove, keep pop up,plsss help

]]> By: Susan http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6156 Susan Mon, 16 Jun 2008 21:40:06 +0000 http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6156 The SmitFraudFix doesn't work - this virus has blecked me from downloading it, (as it has all other fixes). It also erased that portion of windows that lets me search for files and stuff so I can remove it manually. I am not a happy camper! The SmitFraudFix doesn’t work - this virus has blecked me from downloading it, (as it has all other fixes). It also erased that portion of windows that lets me search for files and stuff so I can remove it manually. I am not a happy camper!

]]> By: Zodiak http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6120 Zodiak Sun, 15 Jun 2008 13:37:14 +0000 http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-6120 Thank's, thats all i can say... words cant describe how much i lub u xD <3 Thank’s, thats all i can say…
words cant describe how much i lub u xD
<3

]]> By: larrylchan http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-5762 larrylchan Wed, 04 Jun 2008 14:06:16 +0000 http://www.spyware-techie.com/how-to-remove-ie-antivirus-or-ieantivirus/#comment-5762 On the 3rd of June I purchase the ieanti.virus 3.2 Before I have a chance to print out the purchase license the page disappear so now I cannot operate it please contact to tell what to do to correct it. Thank you On the 3rd of June I purchase the ieanti.virus 3.2 Before I have a chance to print out the purchase license the page disappear so now I cannot operate it please contact to tell what to do to correct it.

Thank you

]]>