Spyware Techie

Do you know what IEDefender is?

DESCRIPTION

IEDefender, or IE Defender, is a rogue anti-spyware application simply because of its aggressive advertising and scare tactics. IEDefender and its affiliates infect users through video codecs that come bundled with a Trojan that is triggered by a Browser Helper Object.

IEDefender and its affiliates display exaggerated security alerts difficult to close in an attempt to trick you into purchasing the full IEDefender version.

Once the Trojan is installed on your machine, your web browser is hijacked. So if you do a search through Google, Yahoo or MSN search engines, your browser will display a fake error message within your search results. The IE Defender fake error message even use the search engine’s name within the message in order to confuse you into believing it’s coming from the search engine itself.

IE Defender error message states that you’re infected with spyware and that you need to download IEDefender to solve your problem. Once you click on the IE Defender fake message, you’ll be directed to IE Defender’s homepage, or a link to a page that shows another fake security message. IEDefender is also known as IE Defender v2.2 or IE Defender v2.3.

If you’re infected with IE Defender, you will see a hijacked search result listing in Google, Yahoo or MSN as shown on the samples below.

Google fake warning message sample:

Google Error:
“Your computer is infected! Some of your search results were changed by spyware. You have to clean your pc and we recommend to use our antispyware!”

Yahoo fake warning message sample:

Yahoo Error:
“Your computer is infected! Some of your search results were changed by spyware. You have to clean your pc and Yahoo Team recommend to use our ANTISPYWARE!”

The Truth (in non-techie terms): Distributors of trojans conduct illicit installation methods to extort money from you. Do not click on IEDefender fake security messages.

IEDefender Automatic Removal Instructions

This automatic removal method is for non-techie computer users. If you’re too lazy to learn about spyware removal or how to access sensitive files in your computer, then this is the method for you.
Before you start: Print or bookmark these instructions because you’ll have to reboot into Safe Mode. Also back up your computer in case you make a mistake.

1. Download and save SmitFraudFix to your desktop.
2. Restart your computer in Safe Mode (how to do safe mode). Once the
   desktop appears, double click on the SmitfraudFix.exe on your desktop.
3. After the credits screen, you’ll see a menu. Select the option number 2, which is ‘Clean (safe mode recommended)’, and then
   press Enter to delete infect files.
4. SmitFraudFix will begin cleaning your computer and take a series of cleanup processes. When the process is over, it will automatically begin the Disk Cleanup program.
5. Once the Disk Cleanup program is complete, you will be prompted with the message ‘Registry cleaning - Do you want to clean the registry’. Answer Y (Yes) and hit Enter. Reboot your computer.
6. SmitFraudFix will now check if wininet.dll is infected. SmitFraudFix will ask you whether to replace the infected file (if there’s any) ‘Replace infected
   file?’ Answer by typing Y (Yes) and hit Enter.
7. Reboot your computer to complete the cleaning process.
8. After reboot, a Notepad screen may appear containing a log of all the files
   removed from your computer. If it doesn’t appear, a file will be created called
   rapport.txt in the root of your drive, (Local Disk C:).
9. Restart your computer in Safe Mode (how to do safe mode).
10. Go to C:\Windows\Temp, click Edit, click Select All, press DELETE, and then
    click Yes to confirm that you want all the items to go to the Recycle Bin.
11. Go to C:\Documents and Settings\[LISTED USER]\Local Settings\Temp, click Edit, click Select All, press DELETE, and then click Yes to confirm that
    you want all the items to go to the Recycle Bin.
12. Reboot your computer back to normal mode. Go to Windows Update and download all critical updates.

IEDefender Manual Removal Instructions

This manual removal method is for techie computer users. IEDefender manual removal may be difficult and time consuming to remove. There’s no guarantee that IEDefender will be removed completely. So read the IEDefender removal steps carefully and good luck.

Before you start: Close all programs and Internet browsers. Also back up your computer in case you make a mistake and your computer stops working.

1. Uninstall IEDefender Program

   Click on Start > Settings > Control Panel > Double-click on Add/Remove Programs. Search for and uninstall IEDefender v.3.8 if found.

2. To stop IEDefender processes (view process removal steps)

   Go to Start > Run > type taskmgr. The click the Processes tab and you’ll see a list of running processes.

   Search and stop these IEDefender processes:
   IEDefender.exe
   iedefender-setup.exe
   media_codec_install_wizard_3912981.exe

   For each unwanted process, right-click on it and then select “End task”.

3. To Unregister IEDefender DLLs (view DLL removal steps)

   Search and unregister these IEDefender DLLs:
   alisj.dll
   IntelVideo.dll (new file)
   IntelVideoDivX.dll (new file)
   bDivX.dll (new file)
   a3gpcodec.dll (new file)
   aDivX.dll (new file)
   dx50codec.dll (new file)
   IR9V0_QCX.dll (new file)
   IR9V0_QCX.dll (new file)
   mp3avi.dll (new file)
   Video32.dll (new file)
   XunLeiBHO_Now.dll (new file)

   To locate the IEDefender DLL path, go to Start > Search > All Files or Folders. Type IEDefender and in the Look in: select either My Computer or Local Hard Drives. Click the Search button.

   Once you have the IEDefender DLL path, go to Start and then click on Run. In the Run command box, type cmd, and then click on OK.

   To locate the exact DLL path, type cd in order to change the current directory. To display the contents of the directory, use the dir command. To remove the DLL file type regsvr32 /u FILENAME.dll (FILENAME is the name of the file that you want to unregister).

4. To unregister IEDefender registry keys (view registry keys removal steps)

   Go to Start > Run > type regedit > press OK.

   Edit the value (on the right pane) by right-clicking on it and selecting the Modify option. Select the Delete option.

   Search and delete these IEDefender registry keys:

   D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF
   87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95
   F4D76F01-7896-458a-890F-E1F05C46069F
   

5. If your homepage has been changed, go to Start > Control Panel > Internet Options > click on the General > click Use Default under Home Page. Add the your desired default homepage, then click Apply > click OK. Open a new web browser to check that you have your desired default homepage.
6. To remove IEDefender icons on your Desktop, drag and drop them to the Recycle Bin.

You’ve completed the IEDefender manual removal instructions!

I hope this article has helped you solve your IEDefender problems. If you want to contribute to this article, post your comment below.

Disclaimer: This article is for educational purposes. By using this information you agree to be bound by the disclaimer. There’s no guarantee that IEDefender will be completely removed from your computer. Seek professional help if your computer continues to experience problems.

Did You Find this Article Helpful?

Subscribe to Spyware Techie for more!

Or get latest articles to your via email:

Read Other Random Posts

• RegSweep Removal Guide
• Fapparatus.com Removal Guide
• WebHancer or WebHancer.com Removal Guide
• Will Windows XP Become Vulnerable to More Attacks After Microsoft Pulls the Plug?