The purpose of this “IE Defender” article is to educate users on how to identify and remove IE Defender. This guide will be updated as more information becomes available. If you have any information about IE Defender or you would like to share your experience dealing with IE Defender, we encourage you to post your comments. If you find this article useful and wish to conveniently view our recently added or updated articles, subscribe to our RSS feed.

Do you have IE Defender?

IE Defender Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCart

IEDefender is classified as a rogue anti-spyware application because of its misleading and aggressive advertising practices. IEDefender creators and their marketing affiliates propagate and install IEDefender’s rogue anti-spyware application through a download that is bundled with a Trojan generated by a Browser Helper object (BHO). Most of these Trojan bundled downloads circulate in web sites that offer a “video codec” to view free adult entertainment videos.

Once your computer gets infected with the Trojan, it will start showing up an annoying popup message: “NOTICE: Your system is infected and your computer performance is not at the highest level. Full system optimization will greatly increase your computer’s performance and prevent data loss”. Do NOT click on this fake error message because it will redirect your IE to IEDefender’s website where you will be forced to download IEDefender’s anti-spyware application.

Moreover, the Trojan, which has come bundled from either IEDefender and/or their affiliates, hijacks your search engines (such as Google, Yahoo and MSN) and displays a fake warning message within your search results claiming that your computer is in serious danger because of hazardous parasites in your system. This is the manner how they attempt to trick the users into purchasing IEDefender full commercial version. Again, do NOT click on this fake error message because it will direct you IEDefender’s homepage where you will be offered to purchase IEDefender’s application.

Type: Trojans

Start of page

Detect IE Defender Using SpyHunter

The detection of IE Defender may be a difficult process and its removal may prove to be even more problematic, especially if it’s done without the assisstance of a removal tool. If you use a spyware removal tool such as SpyHunter, you can have SpyHunter automatically detect the files of IE Defender and any other type of malware, spyware, adware, computer worm, rootkit, trojan, browser helper object infection that may be hidden on your PC. Why you should try SpyHunter’s Detection Scanner.

To safely detect IE Defender, follow the instructions below:

1. Once you download SpyHunter’s Detection Scanner, select “Start Scan” to run a full system scan to search for IE Defender and any other security threat that may be on your PC.
   
   
2. Once SpyHunter has detected IE Defender, you will need to purchase SpyHunter to continue on to the removal process.
   
   
3. To complete the cleaning process, reboot your computer and run SpyHunter again to check for any remaining IE Defender infections.
   
   

* SpyHunter’s Detection Scanner only allows you to detect IE Defender and other malware threats found on your PC. In order to remove IE Defender, you need to purchase the full version of SpyHunter. If SpyHunter is not able to remove IE Defender or any other malware threats, SpyHunter’s Spyware HelpDesk can generate free custom malware fixes tailored for your PC. The full version of SpyHunter also provides real-time protection with daily definition updates to keep your PC on top of the latest security trends.

Start of page

Still Can’t Remove IE Defender?

Exclusive Offer for SpyHunter Customers: FREE Custom Malware Fixes!
Have SpyHunter’s Spyware HelpDesk create FREE custom malware fixes tailored to your PC!

If SpyHunter’s scanning process is unable to detect IE Defender threat, SpyHunter customers have the option to generate a free diagnostic report to receive a custom fix for their problem using SpyHunter’s built in Spyware HelpDesk tool.

Spyware HelpDesk is both a service and a tool which allows our technicians to generate custom fixes specific to your PC. These custom fixes are transmitted to your SpyHunter utility which will disable and eradicate your malware threat completely off your PC. In order to better understand the process involved in generating custom fixes with SpyHunter’s Spyware HelpDesk, read how to use SpyHunter’s Spyware HelpDesk to create a custom malware fix for IE Defender.

Some types of threats hide pieces of code from Windows, install additional components, and others have polymorphic capabilities to make removal harder. You can read the various scenarios as to why you can’t remove IE Defender with SpyHunter or manually. With SpyHunter’s Spyware Helpdesk, you’ll be able have a custom fix that is specific to your spyware infection on your PC.

Start of page

IE Defender Anatomy

As new IE Defender details are reported by our customers and findings from our Threat Research Center, we will update this section.

IE Defender Solution: With SpyHunter you can remedy IE Defender in one simple press of a button. We recommend you download SpyHunter’s Spyware Detection Tool to safely detect IE Defender.

MD5 Details of IE Defender Files

The following IE Defender files with its MD5s were created in the system:

File Name	File Size	MD5

Start of page

IE Defender Video Demo

Click on the “How IE Defender Infects Your Computer” video to see a IE Defender infection in action! See through the eyes of an unsuspecting Internet user while him/her is being victimized by IE Defender.

At the end of this video, there’s a link to download SpyHunter’s Free Spyware Scanner. SpyHunter’s Free Spyware Scanner is for detection purposes only. To remove IE Defender, you must purchase SpyHunter’s full version.

Tip: Turn your sound ON and watch the video in Full Screen mode to fully experience how IE Defender infects a computer. The video contains clickable buttons.


Start of page

IE Defender Installation Process

Listed below are files needed for the installation of IE Defender. You can use this information to manually search and remove IE Defender from your PC.

Use Caution! Some technical expertise is needed. Manual removal of IE Defender is a delicate procedure and does not guarantee complete removal of the malware, since some malicious files tend to hide or may have the ability to recreate themselves. It is strongly advised that you backup your PC before you attempt to manually remove IE Defender. ESG is not responsible for any damage to your computer resulting in any way from your use of this IE Defender installation process.

If you are still having problems with IE Defender, we recommend you download SpyHunter’s Spyware Detection Tool to safely detect IE Defender. SpyHunter can facilitate the process of detecting and ultimately removing the unwanted files without having to deal with sensitive areas within your system.

If SpyHunter does not fully fix your problem, there may be many reasons as to its inability to remove the unwanted files. With SpyHunter’s Spyware HelpDesk, as a custom-automated-fix tool, you can achieve complete removal.

On the IE Defender files listed below, you will find that some files may have environment variables (ex. “%Program Files%”). Read more on “Environment Variables List” for information on what each environment variable means.

Remove IE Defender directories, paths or folders

When IE Defender is executed, it creates the following directories, paths or folders:
Find out how to remove IE Defender directories, paths or folders

• %ProgramFiles%\IE Defender

Stop IE Defender processes

IE Defender creates the following cookies:
Find out how to remove IE Defender processes

• mp3avi.dll
• ieDefender-setup[2].exe
• a3gpcodec.dll
• IR9V0_QCX.dll
• gzmrt.dll
• adspipe.dll
• pdnmcqhd.dll
• rqrqomn.dll
• nsr18.dll
• fccbcyv.dll
• gebcc.dll
• isfmdl.dll
• bidisplv.dll
• fkxlgaeu.dll
• gdpbvwyr.dll
• mscfg32.dll
• msvideo.dll
• ttvbontvm.dll
• videomp3_setup_3912958[2].exe
• fcccdbc.dll
• werbetpql.dll
• ddccawv.dll
• ddcdedd.dll
• mlljh.dll
• stream32a.dll
• toprates.dll
• geebb.dll
• iedefender.exe
• ASKPBAR.DLL
• IntelVideo.dll
• mwgvsu.dll
• sysdivx.dll
• nsaA7.dll
• fcccyxx.dll
• ddccy.dll
• nsl2D.dll
• byvsr.dll
• ttvbonsmf.dll
• vturp.dll
• crypt32d.dll
• version69ie7fix.dll
• ssqpp.dll
• rqrrrrp.dll
• install_video_3912981[1].exe
• ttvbonvgl.dll
• esent9.dll
• awtqqpq.dll
• werbetxdp.dll
• wvuus.dll
• gebca.dll
• tdlRMS.dll
• tuvttrr.dll
• sysvideo32.dll
• fccaxxu.dll
• %SYSTEMROOT%\system32\advpac.dll
• ieDefender[1].exe
• dx50codec.dll
• VideoMP3.dll
• XunLeiBHO_Now.dll
• ieDefender-setup[1].exe
• adssite_sidebar.dll
• nsz379.dll
• ldqzxhsj.dll
• vtutt.dll
• wiecjprp.dll
• pmnnl.dll
• cbxwwvu.dll
• wvurqpp.dll
• vmopgitk.dll
• mljji.dll
• dmqhahxp.dll
• install_video_3912990[1].exe
• popnetnpr.dll
• blopenvxdt.dll
• defender-install[1].exe
• blopenvtok.dll
• blopenvtlv.dll
• prosearchsite.dll
• advpac.dll
• ddccd.dll
• windivx.dll
• awtqnlk.dll
• G66-tmp_.exe

Delete IE Defender Dlls

The following IE Defender DLL files are created:
Find out how to remove IE Defender dlls

• ASKPBAR.DLL
• a3gpcodec.dll
• IR9V0_QCX.dll
• adssite_sidebar.dll
• nsz379.dll
• ldqzxhsj.dll
• vtutt.dll
• wiecjprp.dll
• pmnnl.dll
• cbxwwvu.dll
• wvurqpp.dll
• vmopgitk.dll
• mljji.dll
• dmqhahxp.dll
• msvideo.dll
• ttvbontvm.dll
• awtqqpq.dll
• werbetxdp.dll
• wvuus.dll
• gebca.dll
• tdlRMS.dll
• tuvttrr.dll
• sysvideo32.dll
• fccaxxu.dll
• dx50codec.dll
• IntelVideo.dll
• mwgvsu.dll
• gzmrt.dll
• adspipe.dll
• pdnmcqhd.dll
• rqrqomn.dll
• nsr18.dll
• fccbcyv.dll
• gebcc.dll
• isfmdl.dll
• bidisplv.dll
• fkxlgaeu.dll
• gdpbvwyr.dll
• mscfg32.dll
• ttvbonvgl.dll
• esent9.dll
• blopenvtok.dll
• blopenvtlv.dll
• prosearchsite.dll
• advpac.dll
• ddccd.dll
• windivx.dll
• awtqnlk.dll
• %SYSTEMROOT%\system32\advpac.dll
• mp3avi.dll
• VideoMP3.dll
• XunLeiBHO_Now.dll
• sysdivx.dll
• nsaA7.dll
• fcccyxx.dll
• ddccy.dll
• nsl2D.dll
• byvsr.dll
• ttvbonsmf.dll
• vturp.dll
• crypt32d.dll
• version69ie7fix.dll
• ssqpp.dll
• rqrrrrp.dll
• popnetnpr.dll
• blopenvxdt.dll
• fcccdbc.dll
• werbetpql.dll
• ddccawv.dll
• ddcdedd.dll
• mlljh.dll
• stream32a.dll
• toprates.dll
• geebb.dll

Remove other malicious IE Defender files

The following IE Defender files are created:
Find out how to remove IE Defender malicious files

• IE Defender 2.2.lnk
• ASKPBAR.DLL
• VideoMP3.dll
• XunLeiBHO_Now.dll
• IR9V0_QCX.dll
• sysdivx.dll
• nsaA7.dll
• fcccyxx.dll
• ddccy.dll
• nsl2D.dll
• byvsr.dll
• ttvbonsmf.dll
• vturp.dll
• crypt32d.dll
• version69ie7fix.dll
• ssqpp.dll
• rqrrrrp.dll
• install_video_3912981[1].exe
• ttvbonvgl.dll
• esent9.dll
• awtqqpq.dll
• werbetxdp.dll
• wvuus.dll
• gebca.dll
• tdlRMS.dll
• tuvttrr.dll
• sysvideo32.dll
• fccaxxu.dll
• iedefender.exe
• dx50codec.dll
• IE Defender 2.3.lnk
• a3gpcodec.dll
• VideoMP3.dll-REMOVED
• IE Defender 2.4.lnk
• adssite_sidebar.dll
• nsz379.dll
• ldqzxhsj.dll
• vtutt.dll
• wiecjprp.dll
• pmnnl.dll
• cbxwwvu.dll
• wvurqpp.dll
• vmopgitk.dll
• mljji.dll
• dmqhahxp.dll
• install_video_3912990[1].exe
• popnetnpr.dll
• blopenvxdt.dll
• defender-install[1].exe
• blopenvtok.dll
• blopenvtlv.dll
• prosearchsite.dll
• advpac.dll
• ddccd.dll
• windivx.dll
• awtqnlk.dll
• G66-tmp_.exe
• ieDefender[1].exe
• mp3avi.dll
• ieDefender-setup[2].exe
• IntelVideo.dll
• mwgvsu.dll
• ieDefender-setup[1].exe
• gzmrt.dll
• adspipe.dll
• pdnmcqhd.dll
• rqrqomn.dll
• nsr18.dll
• fccbcyv.dll
• gebcc.dll
• isfmdl.dll
• bidisplv.dll
• fkxlgaeu.dll
• gdpbvwyr.dll
• mscfg32.dll
• msvideo.dll
• ttvbontvm.dll
• videomp3_setup_3912958[2].exe
• fcccdbc.dll
• werbetpql.dll
• ddccawv.dll
• ddcdedd.dll
• mlljh.dll
• stream32a.dll
• toprates.dll
• geebb.dll

The following registry keys and files add on infected machine browser add-ons sections:

Note: Browser add-ons may show popups, redirect searches, add undesirable toolbars, change home page, track your browsing habbits and steal sensitive information like bank accounts.

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EB6AF05-AB7F-47C2-8ABC-9B985FE27A69}

Remove other registry keys created by IE Defender

IE Defender creates the following registry keys:
Find out how to remove IE Defender registry keys

• 87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95
• AppID\mp3avi.dll
• EAEDDCA3-3989-4FF4-A773-3AC188C70A16
• 5D67E2E7-0C2B-4491-87C4-37F2AC6033D2
• 6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F
• 09D72564-27E2-4F12-8AB6-03F83E4567DE
• 7A23A1E8-B2AB-4C50-AD12-9E19B747E17C
• 64130BE8-2B67-4A65-9CA5-1CC6948C1471
• 10F3E8BD-257A-4702-A2F5-DC02055B068C
• BCBCEE7B-2001-4971-B991-EB6E81C96CC5
• 0EDFF8B7-208E-4491-8A56-C77D8E0B650E
• FBD52A1D-E303-48F3-B7F8-F82A7D6A4124
• E2278F85-4584-4BEE-928C-600B38C385C1
• 10DF1424-D96F-4576-8377-E0FB4451CD25
• FF64059D-4D2A-4D6B-AA0F-2EE4A2FE3856
• 7EFEBF39-AEF9-4F9D-86F6-E3824FF84FE2
• 5d577280-ecad-49b1-93a7-dc342d8c6e57
• B6F8D996-F682-468B-8DC2-E4216445645B
• c221c214-d188-48aa-a5fc-596227937e70
• E780E148-0BAC-4654-81A4-8A649F4D4A90
• 31E3F653-ED88-4355-B83E-FB263CD355E3
• c4545fc9-26d0-4ccf-b4fb-728aed895dbd
• F9EAAA11-DF98-4615-A2C7-7D03C86A6BE9
• DA927154-CC3A-41A7-9246-CE35FE2E6477
• F5E81149-92B2-47D2-A12B-1B966AB46EA7
• 762f6938-9fd1-40bf-8d4d-94ba1327765b
• B285004D-6D02-4212-91FC-B8F47B68C254
• F08487B1-AFEC-45CF-B2E9-D05DEE137D22
• 29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A
• 8FB4CA7F-837B-42EE-BEA6-4567FD1ED3C2
• CEADB2EC-7AEA-4374-A769-5A78817A6107
• 8c28c596-57e5-4b8d-bccd-f2389b4c96a7
• 913B63E8-513D-4172-AC66-56219CB6E94F
• 605be7be-1dd2-11b2-9677-a5427ab0e805
• 6dd7d9ec-1dd2-11b2-9199-c3a2ea003916
• 6430CCA7-032A-4EB0-BCFF-838998E73EF5
• 38329D14-1302-4CA7-BEE4-C954516C43B3
• AppID\E780E148-0BAC-4654-81A4-8A649F4D4A90
• E4A441DE-E415-4C43-A466-4993093FF411
• sysdivx.Video
• HKEY_CLASSES_ROOT\AppID\toprates.dll
• HKEY_CLASSES_ROOT\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}
• 0FB618BD-0695-46C0-8EE4-472BEBA1D429
• 0B686DCA-F3F7-4829-8EB4-B453EEEA7B05
• D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF
• 9A1EF21C-B0D4-4EB0-894F-CBAE2F4D0A82
• mp3avi.MP3
• 04F7FAC5-F506-4F29-9094-9CB9144B192C
• C7AFF24C-3480-627F-DA5D-3CE605870A92
• 48BF2BC0-2945-11D8-8CAC-00080FC65465
• E4DF0054-13B7-4A75-967E-1CC787C69FAA
• AppID\VideoMP3.dll
• VideoMP3.MP3
• 5CB10D4A-0C14-4546-865D-935ECBFFA346
• 49366a27-91dc-4bdd-895d-f611a64d67cc
• 3A2224A0-B114-4491-9305-FD0E4B55FA1E
• 4D6F67DF-65CA-4FFE-A7BD-3A45747525B7
• 0B241FD4-1EA1-4238-B505-07A484C49D1A
• DABA9520-AC17-4BA5-BBD4-470F16CF3357
• D54F0577-8770-4A63-B926-6A640ED57F06
• 1BAF960A-2844-4895-B4AF-EF0725609B17
• 9FAF7E8D-6E47-41B0-8EBE-E59ED63843AB
• 76aab9f4-9bc8-4cd0-adf5-0b2eda08ecc3
• 71314E7C-1713-49FA-90F2-54D275023981
• 6D64B03B-3B93-4AF2-BFC6-01264A4C7F2A
• 62EA9201-8CC7-4199-AC30-7744F836322E
• 43BA0532-0D69-458A-8C71-AD0F6AE70D19
• 2FA3B736-1AC7-454D-8E94-8BA8158BF064
• 4AB15165-917A-4AE4-AE42-7FF13F61805B
• 0F596190-DEC2-4D19-AB43-50B54243923F
• 8d829ad9-2dd1-4db2-8c45-b812c72bea01
• b594aa84-1dd1-11b2-af8a-d10b02977db1
• A716011B-4637-44D0-922B-F1E88CC7CC73
• BBB05D9E-0297-404D-A6BF-D8F2876B84A6
• 5E3B65A2-8F4B-4D6F-B14C-00FE82596AC6
• 81645B0C-FAAB-486C-965B-BAF2C7834B1D
• 8A8FDB69-C6CF-440D-AD12-4084A77093CF
• d31ec424-1dd1-11b2-9223-dc336077be0e
• 8E3FBDE2-7DBD-4040-85D9-29BBC559C129
• 15FEB658-AACC-412E-BC13-D54CFD74A8F6
• D0995F82-90C7-4C78-9B4C-C1700FB8B120
• MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rqrrrrp
• mscfg32.Video
• 609F107D-88EE-4D19-B56F-6C21A3E9DC1F
• HKEY_CLASSES_ROOT\AppID\{0EB6AF05-AB7F-47C2-8ABC-9B985FE27A69}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EB6AF05-AB7F-47C2-8ABC-9B985FE27A69}
• HKEY_CLASSES_ROOT\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}
• MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fccaxxu
• IEDefender
• F4D76F01-7896-458a-890F-E1F05C46069F
• 8388594E-D5C0-4933-A977-867D32D8FF19
• 2B659BB5-3E85-4BC6-BAFC-98FEDFF3AE99
• 0EEDB911-C5FA-486F-8334-57288578C627
• 5DE176A4-B5FF-4D50-B084-E047526B8E97
• F02B8C83-C817-4EA2-A499-29257DA0373A
• AppID\6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F
• 4E54D728-1FA3-4125-B468-C8B43C123E65
• 1648E328-3E5A-4EA5-A9C6-E5F09EE272DA
• 275296E0-75EC-4380-BB5F-900636889A8D
• 24690191-8659-4A38-A157-6CB338F785D9
• b5adafea-ec5c-4cfe-984f-b9d6c1339635
• C0530C77-FFF1-4701-BD4B-B62471213C77
• 3401DB32-7F00-4EC7-A890-A75F64973843
• 0493A8B0-1F7B-4771-90C3-474A54715499
• 8774d22a-6bcb-4cb5-aca3-f85f39b1fc49
• 6F4F1A56-48E8-4149-9562-1ACAE6705B70
• cd6a6f8d-6f11-4022-afbd-3f47f293b9e3
• 17D562A6-DA3D-4F87-B659-86CD06473AB5
• 15EB9F40-D775-4463-B75B-8687B3C66BB7
• 202EBB90-ABD4-46CC-BB5A-4F0ECC67B331
• A8565FBC-8D53-4D4F-9BB0-CBC68A22B126
• A19926CE-CA09-9EAE-7806-B9891B5461C8
• 80590BC5-F4BA-4AD1-B216-C19EE86E2A77
• 632F6863-1E54-49FC-A72F-BDEE592EAD52
• 9C8A568E-4201-478a-8536-526CF371D2E2
• 43f3b284-1b6a-4516-b0e7-8db38ffc5288
• F7CDF7FE-98B1-43FE-A694-E52E605AA60D
• FB3384D2-9394-45AF-ACE1-8EB45AC61FED
• 2AE4005E-689F-4FB9-8C3D-D2B8B58AC072
• B28A8965-62F9-620E-DA5C-4DE6708E0991
• 6265c870-869a-46f2-a2dd-4a7258d9a0bc
• a3a55b97-bdf9-4f05-a0aa-279ddf006514
• 64c35692-1dd2-11b2-90fc-e8593d14a627
• 02788C74-8A3E-455D-9820-59784297DF96
• 14A6B963-7C6C-414B-B5BD-9CD0929F928F
• 0459F04A-F7CC-4F98-B66E-E19690702AE4
• FEC3BE4F-E5AB-4B3F-9813-5326FA073155
• AppID\sysdivx.dll
• F94E2B67-3D7A-4F94-AF35-5BBEDAAD3AC4
• HKEY_CLASSES_ROOT\CLSID\{0EB6AF05-AB7F-47C2-8ABC-9B985FE27A69}
• HKEY_CLASSES_ROOT\toprates.Video
• MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awtqnlk

Important Article Disclaimer

Start of page