IE Antivirus or IEAntivirus 3.2 Removal Guide
Do you know what IE Antivirus is?
DESCRIPTION
IE Antivirus, also referred to as IE Antivirus 3.2 or IEAntivirus, is a rogue anti-spyware program that pretends to be a legitimate spyware removal tool. IE Antivirus was discovered by us to be a variant of other previous rogue applications such as Malware Bell, Files Secure and IE Defender. IE Antivirus is potent in the way that it displays erroneous scan results listing several infections that it supposedly found on your system. The scan results that IE Antivirus lists are totally bogus and cannot be trusted.
IE Antivirus is no good at removing spyware or any other known parasites. IE Antivirus may be installed through the well known Vundo or Zlob Trojan infection. Usually these types of Trojans are downloaded through a fake video codec or peer to peer websites. IE Antivirus’ ultimate goal is to get computer users to purchase the full version of IE Antivirus through it’s devious antics. IE Antivirus has it’s own website, IEAntivirus.com, which promotes and sells the IE Antivirus software. This website should be avoided because it is very devious in the way it advertises and promotes a potentially dangerous program.
In non-techie terms: IE Antivirus is just like other known rogue anti-spyware programs in that it attempts to take your money in return for a useless program. IE Antivirus is a complete waste of time and should not be downloaded or purchased under any circumstances.
Watch ‘IE Antivirus 3.2 (Rogue Anti-Spyware Program) Attacks PC’ Video
Turn your speakers ON and press PLAY to listen to the ‘IE Antivirus 3.2 (Rogue Anti-Spyware Program) Attacks PC’ video.
IE Antivirus screen shot image:
IEAntivirus.com website:
Name: Ieantivirus.com
Ieantivirus.com WHOIS Information:
Website IP Address: 89.149.227.195
Registration Service Provided By: ESTDOMAINS INC
Contact: 1.3027224217
Registrar: www.estdomains.com
Domain Name: IEANTIVIRUS.COM
Update Date: 23-Apr-2008
Creation Date: 21-Apr-2008
Expiration Date: 21-Apr-2009
Domain servers in listed order:
ns1.ieantivirus.com 89.149.226.22
ns2.ieantivirus.com 89.149.227.195
Aliases: IE Antivirus, IE Antivirus 3.2, IEAntivirus, IEAntivirus.com
IE Antivirus Automatic Removal Instructions
This automatic removal method is for non-techie computer users. If you’re too lazy to learn about spyware removal or how to access sensitive files in your computer, then this is the method for you.
Before you start: Print or bookmark these instructions because you’ll have to reboot into Safe Mode. Also back up your computer in case you make a mistake.
- Download and save SmitFraudFix to your desktop.
- Restart your computer in Safe Mode (how to do safe mode). Once the
desktop appears, double click on the SmitfraudFix.exe on your desktop. - After the credits screen, you’ll see a menu. Select the option number 2, which is ‘Clean (safe mode recommended)’, and then
press Enter to delete infect files. - SmitFraudFix will begin cleaning your computer and take a series of cleanup processes. When the process is over, it will automatically begin the Disk Cleanup program.
- Once the Disk Cleanup program is complete, you will be prompted with the message ‘Registry cleaning - Do you want to clean the registry’. Answer Y (Yes) and hit Enter. Reboot your computer.
- SmitFraudFix will now check if wininet.dll is infected. SmitFraudFix will ask you whether to replace the infected file (if there’s any) ‘Replace infected
file?’ Answer by typing Y (Yes) and hit Enter. - Reboot your computer to complete the cleaning process.
- After reboot, a Notepad screen may appear containing a log of all the files
removed from your computer. If it doesn’t appear, a file will be created called
rapport.txt in the root of your drive, (Local Disk C:). - Restart your computer in Safe Mode (how to do safe mode).
- Go to C:\Windows\Temp, click Edit, click Select All, press DELETE, and then
click Yes to confirm that you want all the items to go to the Recycle Bin. - Go to C:\Documents and Settings\[LISTED USER]\Local Settings\Temp, click Edit, click Select All, press DELETE, and then click Yes to confirm that
you want all the items to go to the Recycle Bin. - Reboot your computer back to normal mode. Go to Windows Update and download all critical updates.
IE Antivirus Manual Removal Instructions
This manual removal method is for techie computer users. IE Antivirus manual removal may be difficult and time consuming to remove. There’s no guarantee that IE Antivirus will be removed completely. So read the IE Antivirus removal steps carefully and good luck.
Before you start: Close all programs and Internet browsers. Also back up your computer in case you make a mistake and your computer stops working.
- Uninstall IE Antivirus Program
Click on Start > Settings > Control Panel > Double-click on Add/Remove Programs. Search for and uninstall IE Antivirus if found. - To stop IE Antivirus processes (view process removal steps)
Go to Start > Run > type taskmgr. The click the Processes tab and you’ll see a list of running processes.
Search and stop these IE Antivirus processes:
ieavinstaller.exe
uninst.exe
ieav.exe
For each unwanted process, right-click on it and then select “End task”. - To Unregister IE Antivirus DLLs (view DLL removal steps)
Search and unregister these IE Antivirus DLLs:
ieantivirus.dll
To locate the IE Antivirus DLL path, go to Start > Search > All Files or Folders. Type IE Antivirus and in the Look in: select either My Computer or Local Hard Drives. Click the Search button. Once you have the IE Antivirus DLL path, go to Start and then click on Run. In the Run command box, type cmd, and then click on OK.
To locate the exact DLL path, type cd in order to change the current directory. To display the contents of the directory, use the dir command. To remove the DLL file type regsvr32 /u FILENAME.dll (FILENAME is the name of the file that you want to unregister). - To unregister IE Antivirus registry keys (view registry keys removal steps)
Go to Start > Run > type regedit > press OK.
Edit the value (on the right pane) by right-clicking on it and selecting the Modify option. Select the Delete option.
Search and delete these IE Antivirus registry keys: - If your homepage has been changed, go to Start > Control Panel > Internet Options > click on the General > click Use Default under Home Page. Add the your desired default homepage, then click Apply > click OK. Open a new web browser to check that you have your desired default homepage.
- Remove IE Antivirus Directories.
To find IE Antivirus directories, go to Start > My Computer > Local Disk (C:) > Program Files > Show the contents of this folder.
Search and delete the following IE Antivirus directories:
%program_files%\ieantivirus
%programs%\ie antivirus 3.2.lnk
%desktopdirectory%\ie antivirus 3.2.lnk
C:\ProgramFiles\ieantivirus
Right-click on the IE Antivirus folder and select Delete. A message will appear saying ‘Are you sure you want to remove the folder IE Antivirus and move all its contents to the Recycle Bin?’, click Yes. Another message will appear saying ‘Renaming, moving or deleting IE Antivirus could make some programs not work. Are you sure you want to do this?’, click Yes. - To remove IE Antivirus icons on your Desktop, drag and drop them to the Recycle Bin.
You’ve completed the IE Antivirus manual removal instructions!
I hope this article has helped you solve your IE Antivirus problems. If you want to contribute to this article, post your comment below.
Disclaimer: This article is for educational purposes. By using this information you agree to be bound by the disclaimer. There’s no guarantee that IE Antivirus will be completely removed from your computer. Seek professional help if your computer continues to experience problems.
Did You Find this Article Helpful?
Subscribe to Spyware Techie for more!
Or get latest articles to your via email:
I did all of the above and i am still getting pop ups telling me to install IE Antivirus. How do i stop this?
when my computer scans and finds lots of threats, how am i supposed to know if they are real or not? this time i knew, because i’d heard bout ie antivirus before.. and problem solved. but what about next time? how do i protect my computer?
btw, thanks for the solution!
jess
i am realy stupid , i downloaded and payed for this thing before reserching it is there any way to get money back
gerald.. never ever do thattt… best stuff u can do is google it before u use the credit card.. !! u’re gonna find free stuff like i did ( :-D ) to remove all ur boo boos… i knoooow ie antivirus sucks
Gab:
SmitFraudFix is a specific tool that is designed to remove specific infection, apparently the issue that you are having is because you have several additional infections that SmitFraudFix does not target. You may want to try other free programs to get rid of IE Antivirus.
Jessie:
If the product you’re using is reliable then it is doing its job. If not, take one of the files that the scanner finds and search for it on google and see what other websites are saying or whether the file is associated with a spyware program.
hi,
i think the ie got blown away or so (no pop up yet so far)
thnx
Thanks so much for this I searched everywhere for how to remove the IE antivirus and I had to pay for some junk spywear. Your techniqe w/program knocked it off my computer. THANKS !!!! I’m so glad it doesnt pop up everytime now!
On the 3rd of June I purchase the ieanti.virus 3.2 Before I have a chance to print out the purchase license the page disappear so now I cannot operate it please contact to tell what to do to correct it.
Thank you
Thank’s, thats all i can say…
words cant describe how much i lub u xD
<3
The SmitFraudFix doesn’t work - this virus has blecked me from downloading it, (as it has all other fixes). It also erased that portion of windows that lets me search for files and stuff so I can remove it manually. I am not a happy camper!
cant remove, keep pop up,plsss help
cant remove, keep pop up,plsss help,
the virus popup during i click any folder of my computer
I did all the things to remove the IE antivirus but when i open my drive it pop out and said “System Error!”bla bla bla then click ok to download antispyware.Can someone help me please !!?
If you have Antivirus 2008, is it the same thing? Can you remove it the same way?
I don’t know what happened cause I didn’t find the:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ie antivirus
And the pop ups continue :
“System Error
Atention WinuE! …
Also the file ieantivirus.dll
couldn’t delete
Thank you
Bye
Spybot has an update that completely fixed the problem. Hope you already have it on your machine so all you have to do is launch it and update it.
This is a log of my scan using SmitFraudFix. I never instaled IE Anti Virus but I do get the pop up stating a critical error each time I try to open any kind of folder.
SmitFraudFix v2.328
Scan done at 23:19:46.57, Wed 07/02/2008
Run from C:\Users\fLuiD\Desktop\SmitfraudFix
OS: Microsoft Windows [Version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\jureg.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\AOL\1209725682\ee\aolsoftware.exe
C:\Windows\system\wcdvtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\AIM6\aim6.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\ehome\ehsched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\AIM6\aolsoftware.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Windows\system32\jusched.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\BitLord2\BitLord.exe
c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\DllHost.exe
c:\windows\system32\rundll32.exe
C:\Windows\system32\wbem\wmiprvse.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\fLuiD\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler’s .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLs”=”"
“LoadAppInit_DLLs”=dword:00000000
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
“Userinit”=”C:\\Windows\\system32\\userinit.exe,”
»»»»»»»»»»»»»»»»»»»»»»»» Rustock
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: NVIDIA nForce Networking Controller
DNS Server Search Order: 192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{81638E9A-0E98-4557-9E1E-14373D5BDFE6}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End