IEDefender Removal Guide
Do you know what IEDefender is?
DESCRIPTION
IEDefender, or IE Defender, is a rogue anti-spyware application simply because of its aggressive advertising and scare tactics. IEDefender and its affiliates infect users through video codecs that come bundled with a Trojan that is triggered by a Browser Helper Object.
IEDefender and its affiliates display exaggerated security alerts difficult to close in an attempt to trick you into purchasing the full IEDefender version.
Once the Trojan is installed on your machine, your web browser is hijacked. So if you do a search through Google, Yahoo or MSN search engines, your browser will display a fake error message within your search results. The IE Defender fake error message even use the search engine’s name within the message in order to confuse you into believing it’s coming from the search engine itself.
IE Defender error message states that you’re infected with spyware and that you need to download IEDefender to solve your problem. Once you click on the IE Defender fake message, you’ll be directed to IE Defender’s homepage, or a link to a page that shows another fake security message. IEDefender is also known as IE Defender v2.2 or IE Defender v2.3.
If you’re infected with IE Defender, you will see a hijacked search result listing in Google, Yahoo or MSN as shown on the samples below.
Google fake warning message sample:
Google Error:
“Your computer is infected! Some of your search results were changed by spyware. You have to clean your pc and we recommend to use our antispyware!”
Yahoo fake warning message sample:
Yahoo Error:
“Your computer is infected! Some of your search results were changed by spyware. You have to clean your pc and Yahoo Team recommend to use our ANTISPYWARE!”
The Truth (in non-techie terms): Distributors of trojans conduct illicit installation methods to extort money from you. Do not click on IEDefender fake security messages.
IEDefender Automatic Removal Instructions
This automatic removal method is for non-techie computer users. If you’re too lazy to learn about spyware removal or how to access sensitive files in your computer, then this is the method for you.
Before you start: Print or bookmark these instructions because you’ll have to reboot into Safe Mode. Also back up your computer in case you make a mistake.
- Download and save SmitFraudFix to your desktop.
- Restart your computer in Safe Mode (how to do safe mode). Once the
desktop appears, double click on the SmitfraudFix.exe on your desktop. - After the credits screen, you’ll see a menu. Select the option number 2, which is ‘Clean (safe mode recommended)’, and then
press Enter to delete infect files. - SmitFraudFix will begin cleaning your computer and take a series of cleanup processes. When the process is over, it will automatically begin the Disk Cleanup program.
- Once the Disk Cleanup program is complete, you will be prompted with the message ‘Registry cleaning - Do you want to clean the registry’. Answer Y (Yes) and hit Enter. Reboot your computer.
- SmitFraudFix will now check if wininet.dll is infected. SmitFraudFix will ask you whether to replace the infected file (if there’s any) ‘Replace infected
file?’ Answer by typing Y (Yes) and hit Enter. - Reboot your computer to complete the cleaning process.
- After reboot, a Notepad screen may appear containing a log of all the files
removed from your computer. If it doesn’t appear, a file will be created called
rapport.txt in the root of your drive, (Local Disk C:). - Restart your computer in Safe Mode (how to do safe mode).
- Go to C:\Windows\Temp, click Edit, click Select All, press DELETE, and then
click Yes to confirm that you want all the items to go to the Recycle Bin. - Go to C:\Documents and Settings\[LISTED USER]\Local Settings\Temp, click Edit, click Select All, press DELETE, and then click Yes to confirm that
you want all the items to go to the Recycle Bin. - Reboot your computer back to normal mode. Go to Windows Update and download all critical updates.
IE Defender Manual Removal Instructions
This manual removal method is for techie computer users. IE Defender manual removal may be difficult and time consuming to remove. There’s no guarantee that IE Defender will be removed completely. So read the IE Defender removal steps carefully and good luck.
Before you start: Close all programs and Internet browsers. Also back up your computer in case you make a mistake and your computer stops working.
- Uninstall IE Defender Program
Click on Start > Settings > Control Panel > Double-click on Add/Remove Programs. Search for and uninstall IE Defender if found. - To stop IE Defender processes (view process removal steps)
Go to Start > Run > type taskmgr. The click the Processes tab and you’ll see a list of running processes.
Search and stop these IE Defender processes:
defender-install[1].exe
install_video_3912990[1].exe
iedefender.exe
G66-tmp_.exe
install_video_3912981[1].exe
ieDefender-setup[2].exe
videomp3_setup_3912958[2].exe
ieDefender-setup[1].exe
ieDefender[1].exe
For each unwanted process, right-click on it and then select “End task”. - To Unregister IE Defender DLLs (view DLL removal steps)
Search and unregister these IE Defender DLLs:
geebb.dll
toprates.dll
stream32a.dll
mlljh.dll
ddcdedd.dll
ddccawv.dll
werbetpql.dll
fcccdbc.dll
blopenvxdt.dll
popnetnpr.dll
rqrrrrp.dll
ssqpp.dll
version69ie7fix.dll
crypt32d.dll
vturp.dll
ttvbonsmf.dll
byvsr.dll
nsl2D.dll
ddccy.dll
fcccyxx.dll
nsaA7.dll
sysdivx.dll
XunLeiBHO_Now.dll
VideoMP3.dll
mp3avi.dll
%SYSTEMROOT%\system32\advpac.dll
awtqnlk.dll
windivx.dll
ddccd.dll
advpac.dll
prosearchsite.dll
blopenvtlv.dll
blopenvtok.dll
esent9.dll
ttvbonvgl.dll
mscfg32.dll
gdpbvwyr.dll
fkxlgaeu.dll
bidisplv.dll
isfmdl.dll
gebcc.dll
fccbcyv.dll
nsr18.dll
rqrqomn.dll
pdnmcqhd.dll
adspipe.dll
gzmrt.dll
mwgvsu.dll
IntelVideo.dll
dx50codec.dll
fccaxxu.dll
sysvideo32.dll
tuvttrr.dll
tdlRMS.dll
gebca.dll
wvuus.dll
werbetxdp.dll
awtqqpq.dll
ttvbontvm.dll
msvideo.dll
dmqhahxp.dll
mljji.dll
vmopgitk.dll
wvurqpp.dll
cbxwwvu.dll
pmnnl.dll
wiecjprp.dll
vtutt.dll
ldqzxhsj.dll
nsz379.dll
adssite_sidebar.dll
IR9V0_QCX.dll
a3gpcodec.dll
ASKPBAR.DLL
To locate the IE Defender DLL path, go to Start > Search > All Files or Folders. Type IE Defender and in the Look in: select either My Computer or Local Hard Drives. Click the Search button.
Once you have the IE Defender DLL path, go to Start and then click on Run. In the Run command box, type cmd, and then click on OK.
To locate the exact DLL path, type cd in order to change the current directory. To display the contents of the directory, use the dir command. To remove the DLL file type regsvr32 /u FILENAME.dll (FILENAME is the name of the file that you want to unregister). - To unregister IE Defender registry keys (view registry keys removal steps)
Go to Start > Run > type regedit > press OK.
Edit the value (on the right pane) by right-clicking on it and selecting the Modify option. Select the Delete option.
Search and delete these IE Defender registry keys: - If your homepage has been changed, go to Start > Control Panel > Internet Options > click on the General > click Use Default under Home Page. Add the your desired default homepage, then click Apply > click OK. Open a new web browser to check that you have your desired default homepage.
- Remove IE Defender Directories.
To find IE Defender directories, go to Start > My Computer > Local Disk (C:) > Program Files > Show the contents of this folder.Search and delete the following IE Defender directories:
%ProgramFiles%\IE Defender
Right-click on the IE Defender folder and select Delete.
A message will appear saying ‘Are you sure you want to remove the folder IE Defender and move all its contents to the Recycle Bin?’, click Yes.
Another message will appear saying ‘Renaming, moving or deleting IE Defender could make some programs not work. Are you sure you want to do this?’, click Yes. - To remove IE Defender icons on your Desktop, drag and drop them to the Recycle Bin.
You’ve completed the IE Defender manual removal instructions!
I hope this article has helped you solve your IE Defender problems. If you want to contribute to this article, post your comment below.
Disclaimer: This article is for educational purposes. By using this information you agree to be bound by the disclaimer. There’s no guarantee that IE Defender will be completely removed from your computer. Seek professional help if your computer continues to experience problems.
Did You Find this Article Helpful?
Subscribe to Spyware Techie for more!
Or get latest articles to your via email:
thanx for the instructions ….
will inform you if it works ….
I just got infected with IE Defender. I can’t get rid of it. This is a real tough one to remove. Thanks for the info. Maybe I should reformat rather than try to figure this one out?
Hey samuel!
Before you reformat you should try removing it with a free product like smitfraudfix. There’s more IEDefender information on bleepingcomputer.com/forums/topic114240.html. There’s also a cool discussion with one of the IEDefender people fighting on castlecops castlecops.com/postx206334-0-0.html. It’s hilarious! IEDefender is “defending” themselves.
The trojan that is distributing IE Defender is called Zlob-x.a. Hope it helps.
I tried SmitfraundFix.exe and deleted all temp files, then IEDefender was deleted. Thanks.
I did everything posted here and the problems persist. WTF. Any help would be greatly apreciated.
I tried SmitfraundFix.exe and worked like charm(no more porn on my Google search result.). there are plenty of informations about IE Defender on the net, but this is the best and simplest.
thanks allot.
sooo, yeah… i freaked out when it kept telling me to download it, and i didn’t read that this stupid thing was fake, so i bought it…. and now i’m freaking out more!! if i remove it, what will happen now? do u think i can get my money back or is that fake too!? i hope they don’t steal all my info :(
pleeeeaaase help, any feedback would be appreciated!
Hi, lots of help but ran Smitfraud in safe and problem still there. Downloaded trial version of spyhunter and ran that, want registration and £30.00 to remove so re-ran in safe mode and manually edit registry and removed files. ALL CLEAN NOW
thanks
Iain
This is so confusing! The stupid thing is still on my computer and I don’t know how to do any of what is up thereeeee! :[ UGHHHH
OMG, THANKS SO MUCH!!!!!!!! It worked perfectly and dleted iedefender!!!!!!!!
THANK YOU!!!!!!!!!!!
hello, how do you know if the virus is gone
thanks! it really workS! i had removed Ie(funking)defender in no time! yea!! you rock!! thanks again-bash*))
Thanks so much for the information, it’s been very helpful so far. I’ve only encountered one snag: when I try to run the disc cleanup, a blue screen of death pops up reading “page fault in nonpaged area”. This even happens in safe mode. Oh well, I’m sure I’ll figure it out somehow.