52 replies to this topic

[miekiemoes]

IEDefender Removal Instructions:
ShadowPuterDude has authored an automated tool for removal of IEDefender. You can find the download and instructions here.

• NOTE: You will need to temporarily disable any programs you have running that will block attempts to edit the registry. As FixIEDef calls REGEDIT to delete registry keys added by Zlob, Trojan.Downloader.Delf, AntiSpyPro, and IE Defender.
  
• Download FixIEDef.exe by ShadowPuterDude to the Desktop.
  Note: FixIEDef now supports Non-English Language Systems
  
  
• Double-click FixIEDef.exe:
  
  
  
• That will open the About FixIEDef screen. Click OK to continue:
  
  
  
• Next, press the Scan! button:
  
  
  
• FixIEDef needs to run as Administrator to perform correctly. This message simply confirms it was able to run with admin privileges. Click OK to continue:
  
  
  
• Wait for the scan to finish. It shouldn't take very long:
  
  
  
• After the !!! All Finished !!! message is displayed, click Exit:
  
  
  
• That's it! You're done, and the infection should be removed.
  
  Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. See: http://www.beyondlog...processutil.htm

If after running this tool the Trojan.Win32.Obfuscated.gx infection is still present, post a HiJackThis log in the Malware Removal Forum.

Mirrors: Alternate official download locations for FixIEDef.exe

http://it-mate.co.uk...ef/fixiedef.exe
http://hosts-file.ne...ef/fixiedef.exe
http://avant.it-mate...=Tools/FixIEDef
http://archives.myst...pyware/FixIEDef

Edited by admin, 12 January 2008 - 11:50 AM.

[mhughes]

OMG, This IE Defender showed up on my computer on Friday and I've spent the ENTIRE weekend and $80 trying to get it removed. I downloaded spyware, registry cleaner, etc. and only by the grace of God was able to find your website and these instructions.

I followed them and it now seems to be gone!

I wish I had found this site before I spent $80 but at least I know it's here in case something else comes up!

Thank You, Thank You, Thank You for this most needed help!

[whatsleftnow]

what if there is nothing checked?

[miekiemoes]

what if there is nothing checked?

How do you mean?

[mhughes]

I had to look at the list, then check the appropriate thing on the Hijack list. Then you click "fix" and it was gone. You have to put the check yourself by the matching link.

[Dommie]

I would like to thank you so very much for making that little program that removed Trojan.Zlob-X.a , I have been messing with it most of the day and was not geting any were , And then I started googleling an came accross your post... Thank You so very much You were a very HUGE help

[don77]

Hello and welcome Dommie
Thanks for taking the time to let us know
Glad to hear everything is sorted

[david317]

hi, thank you so much for the solution..


just i furthre question?

i ran hijakthis, tick the box and fixed, rebooted the computer and now my IE works fine, is it safe to assume that the virus is now gone? or should i do something else just to make sure?


thanks again

[deefadog]

Thanks for the solution, just spent 3 hours running all the usual scans and could not get rid of this on my inlaws pc! I'll hopefully sort it tomorrow now with the download.

So what's the purpose of this -to make people pay for the fake software to remove the virus they created in the first place?



Many thanks!!!!

[RatHat]

david317,

If you have any doubts about the state of your computer after running these fixes, please post a HijackThis log, along with a description of the problems you are experiencing in the Malware Forum.

One of the helpers here will pick it up and help you to complete any remaining cleaning that is required.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


deefadog,

Malware is now big business! Where it used to be done by people looking for kicks, it is now being written for profit. Many of the rogue anti spyware programs will ask you pay for them to clean infections that could have been written for them.

[rippards1]

So the tool created by ShadowPuterDude removes the alerts of course, but does it also remove the threat to the computer, the Trojan.Zlob-X.a? Is my computer safe from this trojan after i run this tool?

[nwskibunny]

Hey guys - thanks for the nifty tool ShadowPuterDude created - this fixed the problem.

It was really hard to even get to this board when I googled the trojan name, the popup was really killing me and it seems this trojan was also redirecting me to keep my browser from getting to the pages to remove it. I don't know if that is part of what it does but every google link I clicked was changed to a www.google.com/////////////// and it went nowhere.

Finally, I was able to copy the link and paste it and get the page to load up fast enough to get in and get the tool.

This trojan is a real major pain in the butt. I'd like to throttle the person that wrote it.

Always look for tools online before you spend a ton of money taking your pc in to have someone fix it for you - there is normally a way to handle it before you have to go to those lengths.

[pett]

Thanks for this excellent program.My son's computer was infected,spent 1 hr on the phone with him until I found your website,gone in 2 minutes
Thanks again

[Matt T]

So the tool created by ShadowPuterDude removes the alerts of course, but does it also remove the threat to the computer, the Trojan.Zlob-X.a? Is my computer safe from this trojan after i run this tool?

Hey rippards1 and Welcome to G2G!

It should, and probably has, but if you're unsure, post a HJT log in the [Malware Forum], but make sure you read the [Click Here] at the top, before posting .

[stratec]

Man, I am so glad I know about your site. I had Zlob and fixed is lickety split with your instructions. What a great service geekstogo provides to the world!
Eric