IE Defender Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCart

IEDefender is classified as a rogue anti-spyware application because of its misleading and aggressive advertising practices. IEDefender creators and their marketing affiliates propagate and install IEDefender’s rogue anti-spyware application through a download that is bundled with a Trojan generated by a Browser Helper object (BHO). Most of these Trojan bundled downloads circulate in web sites that offer a “video codec” to view free adult entertainment videos.

Once your computer gets infected with the Trojan, it will start showing up an annoying popup message: “NOTICE: Your system is infected and your computer performance is not at the highest level. Full system optimization will greatly increase your computer’s performance and prevent data loss”. Do NOT click on this fake error message because it will redirect your IE to IEDefender’s website where you will be forced to download IEDefender’s anti-spyware application.

Moreover, the Trojan, which has come bundled from either IEDefender and/or their affiliates, hijacks your search engines (such as Google, Yahoo and MSN) and displays a fake warning message within your search results claiming that your computer is in serious danger because of hazardous parasites in your system. This is the manner how they attempt to trick the users into purchasing IEDefender full commercial version. Again, do NOT click on this fake error message because it will direct you IEDefender’s homepage where you will be offered to purchase IEDefender’s application.

Type: Trojans

How Can You Detect IE Defender?

IE Defender Technical Report

As new IE Defender details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following IE Defender files with its MD5s were created in the system:

IE Defender Video Demo

Click on the “How IE Defender Infects Your Computer” video to see a IE Defender infection in action! See through the eyes of an unsuspecting Internet user while him/her is being victimized by IE Defender.

At the end of this video, there’s a link to download SpyHunter’s Free Spyware Scanner. SpyHunter’s Free Spyware Scanner is for detection purposes only. To remove IE Defender, you must purchase SpyHunter’s full version.

Tip: Turn your sound ON and watch the video in Full Screen mode to fully experience how IE Defender infects a computer. The video contains clickable buttons.

IE Defender has typically the following processes in memory:

• mp3avi.dll
• ieDefender-setup[2].exe
• a3gpcodec.dll
• IR9V0_QCX.dll
• gzmrt.dll
• adspipe.dll
• pdnmcqhd.dll
• rqrqomn.dll
• nsr18.dll
• fccbcyv.dll
• gebcc.dll
• isfmdl.dll
• bidisplv.dll
• fkxlgaeu.dll
• gdpbvwyr.dll
• mscfg32.dll
• msvideo.dll
• ttvbontvm.dll
• videomp3_setup_3912958[2].exe
• fcccdbc.dll
• werbetpql.dll
• ddccawv.dll
• ddcdedd.dll
• mlljh.dll
• stream32a.dll
• toprates.dll
• geebb.dll
• iedefender.exe
• ASKPBAR.DLL
• IntelVideo.dll
• mwgvsu.dll
• sysdivx.dll
• nsaA7.dll
• fcccyxx.dll
• ddccy.dll
• nsl2D.dll
• byvsr.dll
• ttvbonsmf.dll
• vturp.dll
• crypt32d.dll
• version69ie7fix.dll
• ssqpp.dll
• rqrrrrp.dll
• install_video_3912981[1].exe
• ttvbonvgl.dll
• esent9.dll
• awtqqpq.dll
• werbetxdp.dll
• wvuus.dll
• gebca.dll
• tdlRMS.dll
• tuvttrr.dll
• sysvideo32.dll
• fccaxxu.dll
• %SYSTEMROOT%\system32\advpac.dll
• ieDefender[1].exe
• dx50codec.dll
• VideoMP3.dll
• XunLeiBHO_Now.dll
• ieDefender-setup[1].exe
• adssite_sidebar.dll
• nsz379.dll
• ldqzxhsj.dll
• vtutt.dll
• wiecjprp.dll
• pmnnl.dll
• cbxwwvu.dll
• wvurqpp.dll
• vmopgitk.dll
• mljji.dll
• dmqhahxp.dll
• install_video_3912990[1].exe
• popnetnpr.dll
• blopenvxdt.dll
• defender-install[1].exe
• blopenvtok.dll
• blopenvtlv.dll
• prosearchsite.dll
• advpac.dll
• ddccd.dll
• windivx.dll
• awtqnlk.dll
• G66-tmp_.exe

IE Defender created the following directories, files, paths:

• %ProgramFiles%\IE Defender

IE Defender creates the following registry entries:

• 87B570FB-D2CF-4D3C-8E1B-E1E7018BBA95
• AppID\mp3avi.dll
• EAEDDCA3-3989-4FF4-A773-3AC188C70A16
• 5D67E2E7-0C2B-4491-87C4-37F2AC6033D2
• 6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F
• 09D72564-27E2-4F12-8AB6-03F83E4567DE
• 7A23A1E8-B2AB-4C50-AD12-9E19B747E17C
• 64130BE8-2B67-4A65-9CA5-1CC6948C1471
• 10F3E8BD-257A-4702-A2F5-DC02055B068C
• BCBCEE7B-2001-4971-B991-EB6E81C96CC5
• 0EDFF8B7-208E-4491-8A56-C77D8E0B650E
• FBD52A1D-E303-48F3-B7F8-F82A7D6A4124
• E2278F85-4584-4BEE-928C-600B38C385C1
• 10DF1424-D96F-4576-8377-E0FB4451CD25
• FF64059D-4D2A-4D6B-AA0F-2EE4A2FE3856
• 7EFEBF39-AEF9-4F9D-86F6-E3824FF84FE2
• 5d577280-ecad-49b1-93a7-dc342d8c6e57
• B6F8D996-F682-468B-8DC2-E4216445645B
• c221c214-d188-48aa-a5fc-596227937e70
• E780E148-0BAC-4654-81A4-8A649F4D4A90
• 31E3F653-ED88-4355-B83E-FB263CD355E3
• c4545fc9-26d0-4ccf-b4fb-728aed895dbd
• F9EAAA11-DF98-4615-A2C7-7D03C86A6BE9
• DA927154-CC3A-41A7-9246-CE35FE2E6477
• F5E81149-92B2-47D2-A12B-1B966AB46EA7
• 762f6938-9fd1-40bf-8d4d-94ba1327765b
• B285004D-6D02-4212-91FC-B8F47B68C254
• F08487B1-AFEC-45CF-B2E9-D05DEE137D22
• 29B1EDC5-5BF3-468F-B8E5-6B27090CEF0A
• 8FB4CA7F-837B-42EE-BEA6-4567FD1ED3C2
• CEADB2EC-7AEA-4374-A769-5A78817A6107
• 8c28c596-57e5-4b8d-bccd-f2389b4c96a7
• 913B63E8-513D-4172-AC66-56219CB6E94F
• 605be7be-1dd2-11b2-9677-a5427ab0e805
• 6dd7d9ec-1dd2-11b2-9199-c3a2ea003916
• 6430CCA7-032A-4EB0-BCFF-838998E73EF5
• 38329D14-1302-4CA7-BEE4-C954516C43B3
• AppID\E780E148-0BAC-4654-81A4-8A649F4D4A90
• E4A441DE-E415-4C43-A466-4993093FF411
• sysdivx.Video
• HKEY_CLASSES_ROOT\AppID\toprates.dll
• HKEY_CLASSES_ROOT\Interface\{48D78BE5-CFB9-4B66-9AC4-96D4CF21DE06}
• 0FB618BD-0695-46C0-8EE4-472BEBA1D429
• 0B686DCA-F3F7-4829-8EB4-B453EEEA7B05
• D4FD35A3-101C-4FAA-A9CA-E8C9461C3CEF
• 9A1EF21C-B0D4-4EB0-894F-CBAE2F4D0A82
• mp3avi.MP3
• 04F7FAC5-F506-4F29-9094-9CB9144B192C
• C7AFF24C-3480-627F-DA5D-3CE605870A92
• 48BF2BC0-2945-11D8-8CAC-00080FC65465
• E4DF0054-13B7-4A75-967E-1CC787C69FAA
• AppID\VideoMP3.dll
• VideoMP3.MP3
• 5CB10D4A-0C14-4546-865D-935ECBFFA346
• 49366a27-91dc-4bdd-895d-f611a64d67cc
• 3A2224A0-B114-4491-9305-FD0E4B55FA1E
• 4D6F67DF-65CA-4FFE-A7BD-3A45747525B7
• 0B241FD4-1EA1-4238-B505-07A484C49D1A
• DABA9520-AC17-4BA5-BBD4-470F16CF3357
• D54F0577-8770-4A63-B926-6A640ED57F06
• 1BAF960A-2844-4895-B4AF-EF0725609B17
• 9FAF7E8D-6E47-41B0-8EBE-E59ED63843AB
• 76aab9f4-9bc8-4cd0-adf5-0b2eda08ecc3
• 71314E7C-1713-49FA-90F2-54D275023981
• 6D64B03B-3B93-4AF2-BFC6-01264A4C7F2A
• 62EA9201-8CC7-4199-AC30-7744F836322E
• 43BA0532-0D69-458A-8C71-AD0F6AE70D19
• 2FA3B736-1AC7-454D-8E94-8BA8158BF064
• 4AB15165-917A-4AE4-AE42-7FF13F61805B
• 0F596190-DEC2-4D19-AB43-50B54243923F
• 8d829ad9-2dd1-4db2-8c45-b812c72bea01
• b594aa84-1dd1-11b2-af8a-d10b02977db1
• A716011B-4637-44D0-922B-F1E88CC7CC73
• BBB05D9E-0297-404D-A6BF-D8F2876B84A6
• 5E3B65A2-8F4B-4D6F-B14C-00FE82596AC6
• 81645B0C-FAAB-486C-965B-BAF2C7834B1D
• 8A8FDB69-C6CF-440D-AD12-4084A77093CF
• d31ec424-1dd1-11b2-9223-dc336077be0e
• 8E3FBDE2-7DBD-4040-85D9-29BBC559C129
• 15FEB658-AACC-412E-BC13-D54CFD74A8F6
• D0995F82-90C7-4C78-9B4C-C1700FB8B120
• MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rqrrrrp
• mscfg32.Video
• 609F107D-88EE-4D19-B56F-6C21A3E9DC1F
• HKEY_CLASSES_ROOT\AppID\{0EB6AF05-AB7F-47C2-8ABC-9B985FE27A69}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EB6AF05-AB7F-47C2-8ABC-9B985FE27A69}
• HKEY_CLASSES_ROOT\TypeLib\{74D46BBA-5638-473A-83B6-97E7804A7411}
• MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fccaxxu
• IEDefender
• F4D76F01-7896-458a-890F-E1F05C46069F
• 8388594E-D5C0-4933-A977-867D32D8FF19
• 2B659BB5-3E85-4BC6-BAFC-98FEDFF3AE99
• 0EEDB911-C5FA-486F-8334-57288578C627
• 5DE176A4-B5FF-4D50-B084-E047526B8E97
• F02B8C83-C817-4EA2-A499-29257DA0373A
• AppID\6FFE49B7-F475-4EAB-8E80-E5D74C4E8D5F
• 4E54D728-1FA3-4125-B468-C8B43C123E65
• 1648E328-3E5A-4EA5-A9C6-E5F09EE272DA
• 275296E0-75EC-4380-BB5F-900636889A8D
• 24690191-8659-4A38-A157-6CB338F785D9
• b5adafea-ec5c-4cfe-984f-b9d6c1339635
• C0530C77-FFF1-4701-BD4B-B62471213C77
• 3401DB32-7F00-4EC7-A890-A75F64973843
• 0493A8B0-1F7B-4771-90C3-474A54715499
• 8774d22a-6bcb-4cb5-aca3-f85f39b1fc49
• 6F4F1A56-48E8-4149-9562-1ACAE6705B70
• cd6a6f8d-6f11-4022-afbd-3f47f293b9e3
• 17D562A6-DA3D-4F87-B659-86CD06473AB5
• 15EB9F40-D775-4463-B75B-8687B3C66BB7
• 202EBB90-ABD4-46CC-BB5A-4F0ECC67B331
• A8565FBC-8D53-4D4F-9BB0-CBC68A22B126
• A19926CE-CA09-9EAE-7806-B9891B5461C8
• 80590BC5-F4BA-4AD1-B216-C19EE86E2A77
• 632F6863-1E54-49FC-A72F-BDEE592EAD52
• 9C8A568E-4201-478a-8536-526CF371D2E2
• 43f3b284-1b6a-4516-b0e7-8db38ffc5288
• F7CDF7FE-98B1-43FE-A694-E52E605AA60D
• FB3384D2-9394-45AF-ACE1-8EB45AC61FED
• 2AE4005E-689F-4FB9-8C3D-D2B8B58AC072
• B28A8965-62F9-620E-DA5C-4DE6708E0991
• 6265c870-869a-46f2-a2dd-4a7258d9a0bc
• a3a55b97-bdf9-4f05-a0aa-279ddf006514
• 64c35692-1dd2-11b2-90fc-e8593d14a627
• 02788C74-8A3E-455D-9820-59784297DF96
• 14A6B963-7C6C-414B-B5BD-9CD0929F928F
• 0459F04A-F7CC-4F98-B66E-E19690702AE4
• FEC3BE4F-E5AB-4B3F-9813-5326FA073155
• AppID\sysdivx.dll
• F94E2B67-3D7A-4F94-AF35-5BBEDAAD3AC4
• HKEY_CLASSES_ROOT\CLSID\{0EB6AF05-AB7F-47C2-8ABC-9B985FE27A69}
• HKEY_CLASSES_ROOT\toprates.Video
• MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awtqnlk

Important Article Disclaimer