IE-AV (ie-av.exe) Removal Instructions (IE AV)

By karen on Jul 20, 2008 | Reply

I have this ie-av.exe popup that I couldn’t uninstall. I appreciate if you can email me a free removal tool. Thanks in advance.

By Tommy on Jul 20, 2008 | Reply

You can use spyhunter to scan your drives. It would show you the paths of infected files and registry keys. Then you can follow the instructions and manually remove the virus. Even though scanning is free, it would be nice if they don’t charge $30 for their removal tool. Oh well, guess there’s no such thing as free lunch in the world. I am happy that ie antivirus is now gone from my laptop. Good luck with your journey.

By Mans on Jul 21, 2008 | Reply

I had the same problem. Have downloaded spyhunter and after running manualy deleted the files (then you know where they are). Problem solved. Funny that neither Ad Aware nor McAfee saw this virus. Anyway many thanks.

By Bryan on Jul 22, 2008 | Reply

I can not install spyhunter.
Computer message was that lanuage.dll can not be installed….

By Jessica on Jul 27, 2008 | Reply

I have the same issue. I am pre-download of this virus.. meaning that my computer is constantly telling me to download it. I CANNOT download or install anything because it has effectively shut off windows installer, system control panel and my ability to startup my internet connection. Basically I am stalemated.. how can I stop this thing??

By benscsio@yahooc.com.cn on Jul 27, 2008 | Reply

thank you but make no difference at all!
could you please give me a hand when you are free?

By Brian on Jul 27, 2008 | Reply

I am having the same problem as Jessica; I’m in a pre-download situation (as a result of trying to download ActiveX controls from Google), without having downloaded the ie.av executable. I can’t access anything through IE or perform any other task due to constant popups. Any way to get rid of this problem?

By spysucks on Aug 1, 2008 | Reply

I have this ie-av.exe which I have no clues how to delete. Which directory should I look at?

By chicks on Aug 1, 2009 | Reply

I have a rough but effective solution around the pro-download situation, but it requires you to be pretty quick on the draw.

Boot up/log in as usual.
AS SOON AS POSSIBLE, bring up the Task Manager using CTRL+ALT+DEL
Click on PROCESSES
Sort processes by name. (just makes it easier to find)
AS SOON AS you see ie-av.exe (it was just av.exe in my case, so it was right at the top of the list) in the list, select it and click END PROCESS
Click YES, when asked if you are sure.

You only have maybe 2 or 3 seconds to kill the process before it gets up and running (depending on how fast your computer is- for once, slower is better!), but once it is ended, you can freely remove it, backup files, etc. Good luck!

By jj biggs on Jan 25, 2010 | Reply

get freefixer. run it and delete the file using it. You’ll know it because it will be very very recent – the program lists entries oldest to newest. It will tell you that it will delete it on next reboot so let it and you’re back to normal. fixed myself in less than 10 minutes! No lie.

By kafnhalf on Jan 28, 2010 | Reply

Okay i have av.exe that keeps popping up it shows that it is scanning and saying i have over 30 virus’s/trojans and other bugs/problems. now how and what should i do about it.And i want to know how it got on this PC

By Gordon on Jan 31, 2010 | Reply

Looks like there is a new version of this going around. Like kafnhalf, my kids got this on their computer. I used Process Explorer from Sysinternals to find and delete the av.exe file. It was buried deep in C:/documents and settings/customer/applications data/??? Sorry, I don’t remember the full path. However, ONCE I DELETED IT THE COMPUTER WILL NO LONGER RUN PROGRAMS. Windows XP starts up, desktop appears, but no tray icons. Click on a program icon and a popup comes up asking what program should be used to open this file.

I just tried to do a repair install of WinXP and the problem persists.

Now what??

By shaza on Feb 2, 2010 | Reply

I restarted in safe mode and did a system restore
that got rid of it

By rumon on Feb 5, 2010 | Reply

Seems you deleted the regestry keys that starts the normal stuff, I created a new user on my pc and it fixed the problem

By Mark on Feb 5, 2010 | Reply

I’m having the same problem as Gordon. No programs will run now and each time I try, I get prompted for what program should be used.

HELP!!

By BrainFart on Feb 6, 2010 | Reply

Just reboot in “safe” mode (F8 as boot up)and do a system restore to a day or 2 before the attack… Worke for me ! GL

By David Guest on Feb 7, 2010 | Reply

to repair PC after deleting av.exe you need to find & remove all references to it in registry. until you do that, your programs will not run – not even system restore.
I had this issue & fixed it by restoring my ERNDT backups ( excellent freeware which has now saved me a couple of times).
i have now ditched avast, which totally missed this infection, and installed microsoft security essentials.

By David Guest on Feb 7, 2010 | Reply

correction; I meant this.
ERUNT
The Emergency Recovery Utility NT
google it, install it (free) , will let you recover from future disasters.

ps the reson you see “windows needs to know what program to use to run…” almost everything
after manually deleting av.exe is that it has created registry entries which call it whenever you try to run anything. so you have to located & delete them. microsoft system restore will fail because windows will still look for av.exe after reboot in order to run the restore process.

By tnt on Feb 9, 2010 | Reply

Ok… i got the av.exe virus on my laptop today about 8 hours ago. I push ctrl + alt + delete and end the av.exe process. For those of you that have difficulties running any program due to the virus poping up.. try right clicking your program and click “start.” Any program you’re trying to run should work. Getting rid of av.exe… I’m still in the process.. *sigh*

By tnt on Feb 9, 2010 | Reply

Ok,av.exe is located in c:/documents and settings/USERNAME/local settings/application data/ and the file should be hidden somewhere in application data… to find it you must go to “tools,” “folder options,” “view,” and uncheck “hide protected operating system files (recommended).” Click “apply” and you will see the av.exe file. DELETE!

By Simon on Feb 10, 2010 | Reply

There is a new version of this going around. I have no idea how it got on my PC though. I am sure this page will be getting a lot of hits soon.

By Jake on Feb 10, 2010 | Reply

I got the same nasty xp spyware/av.exe bug. I used freefixer.com suggested by jj biggs. Found the file av.exe, deleted it and the bug appers to be gone. That was a bad one.

By Andy on Feb 11, 2010 | Reply

I followed tnt’s instructions and found and deleted av.exe but now windows doesn’t know how to run anything….

By Matt on Feb 12, 2010 | Reply

IF YOU WANT TO OPEN A .EXE PROGRAM IN WINDOWS VISTA, FIRST CLOSE AV.EXE IN TASK MANAGER, THEN RIGHT CLICK ON THE .EXE FILE YOU WANT TO RUN AND HIT RUN AS ADMINISTRATOR, AV.EXE WILL NOT RESTART

MALWAREBYTES WILL FIX THE PROBLEM

By Dave on Feb 12, 2010 | Reply

I just got hit by this crap too. The reason your exe files may not run is that it hooks itself as a shell to be used to run all exe programs. In order to fix that you have to patch the .exe entry by deleting the defaulticon and shell entries in HKEY_CLASSES_ROOT. I also noticed that the default entry in the .exe key on my infected machine is set to secfile, and on a clean system it is set to exefile.

By Chris O on Feb 15, 2010 | Reply

The following is a ‘fix’ for those of you that have manually deleted the nasty av.exe and find you can no longer open Programs without being prompted with… which .exe program would you like to use etc.

My PC got infected with this today, and stupid Avast didn’t recognise it AT ALL!!!!!

1)Copy / Paste the following into Notepad
2)Save as a .reg file.
3)Double-click, then Import to Registry.

You will then be able to start Programs as normal.

I then suggest doing a thorough scan for any av.exe related files that may still be lingering in the Registry etc.

Here it is:_

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.exe]
@=”exefile”
“Content Type”=”application/x-msdownload”

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@=”{098f2470-bae0-11cd-b579-08002b30bfeb}”

[HKEY_CLASSES_ROOT\exefile]
@=”Application”
“EditFlags”=hex:38,07,00,00
“TileInfo”=”prop:FileDescription;Company;FileVersion”
“InfoTip”=”prop:FileDescription;Company;FileVersion;Create;Size”

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@=”%1″

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
“EditFlags”=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@=”\”%1\” %*”

[HKEY_CLASSES_ROOT\exefile\shell\runas]

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@=”\”%1\” %*”

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@=”{86C86720-42A0-1069-A2E8-08002B30309D}”

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PEAnalyser]
@=”{09A63660-16F9-11d0-B1DF-004F56001CA7}”

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@=”{86F19A00-42A0-1069-A2E9-08002B30309D}”

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@=”{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}”

[HKEY_CLASSES_ROOT\regfile]
@=”Registration Entries”
“EditFlags”=dword:00100000
“BrowserFlags”=dword:00000008

[HKEY_CLASSES_ROOT\regfile\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,72,00,65,00,67,00,65,00,64,00,69,00,74,00,2e,00,65,00,78,00,65,00,\
2c,00,31,00,00,00

[HKEY_CLASSES_ROOT\regfile\shell]
@=”open”

[HKEY_CLASSES_ROOT\regfile\shell\edit]

[HKEY_CLASSES_ROOT\regfile\shell\edit\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,\
54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,25,00,31,00,00,\
00

[HKEY_CLASSES_ROOT\regfile\shell\open]
@=”Mer&ge”

[HKEY_CLASSES_ROOT\regfile\shell\open\command]
@=”regedit.exe \”%1\”"

[HKEY_CLASSES_ROOT\regfile\shell\print]

[HKEY_CLASSES_ROOT\regfile\shell\print\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,\
54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,2f,00,70,00,20,\
00,25,00,31,00,00,00

[HKEY_CLASSES_ROOT\.lnk]
@=”lnkfile”

[HKEY_CLASSES_ROOT\.lnk\ShellEx]

[HKEY_CLASSES_ROOT\.lnk\ShellEx\{000214EE-0000-0000-C000-000000000046}]
@=”{00021401-0000-0000-C000-000000000046}”

[HKEY_CLASSES_ROOT\.lnk\ShellEx\{000214F9-0000-0000-C000-000000000046}]
@=”{00021401-0000-0000-C000-000000000046}”

[HKEY_CLASSES_ROOT\.lnk\ShellEx\{00021500-0000-0000-C000-000000000046}]
@=”{00021401-0000-0000-C000-000000000046}”

[HKEY_CLASSES_ROOT\.lnk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@=”{00021401-0000-0000-C000-000000000046}”

[HKEY_CLASSES_ROOT\.lnk\ShellNew]
“Command”=”rundll32.exe appwiz.cpl,NewLinkHere %1″

[HKEY_CLASSES_ROOT\lnkfile]
@=”Shortcut”
“EditFlags”=dword:00000001
“IsShortcut”=”"
“NeverShowExt”=”"

[HKEY_CLASSES_ROOT\lnkfile\CLSID]
@=”{00021401-0000-0000-C000-000000000046}”

[HKEY_CLASSES_ROOT\lnkfile\shellex]

[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers]

[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers\Offline Files]
@=”{750fdf0e-2a26-11d1-a3ea-080036587f03}”

[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}]

[HKEY_CLASSES_ROOT\lnkfile\shellex\DropHandler]
@=”{00021401-0000-0000-C000-000000000046}”

[HKEY_CLASSES_ROOT\lnkfile\shellex\IconHandler]
@=”{00021401-0000-0000-C000-000000000046}”

[HKEY_CLASSES_ROOT\lnkfile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\lnkfile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@=”{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}”

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}]
@=”Shortcut”

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32]
@=”shell32.dll”
“ThreadingModel”=”Apartment”

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\PersistentAddinsRegistered]

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}]
@=”{00021401-0000-0000-C000-000000000046}”

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\PersistentHandler]
@=”{00021401-0000-0000-C000-000000000046}”

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\ProgID]
@=”lnkfile”

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\shellex]

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\shellex\MayChangeDefaultMenu]

By mgm on Feb 17, 2010 | Reply

tried your fix but no luck, any suggestions?

By Matt Nel on Feb 18, 2010 | Reply

Hi guys – Its easy to remove. Funny thing that windows defender and AVG dont pick this up.

HOW TO FIX:
————
STEP 1 – Locate the av.exe file and delete. Make sure you kill the process AV first.

Windows 7 – you can find it below
C:\Users\[YOUR USERNAME]\AppData\Local\av.exe

STEP 2 – At this point you will find your applications dont open but there is a way around this.

STEP 3 – Open MS Word -> Tools -> Macros -> Create. Make sure you type in a name. If you dont have internet explorer open then paste

Shell “C:\Program Files\Internet Explorer\iexplore.exe”, vbNormalFocus

above the “End Sub” and click on the “Run Sub” button (Green Play button). This will load your browser. Now paste in the below link into your browser

“http://www.dougknox.com/xp/file_assoc.htm”

and click on the “EXE File Association Fix” link and download the zip file and extract the file “xp_exe_fix.reg” – I have windows 7 and this even worked and I assume XP will work too.

Step 4 – Now we need to open the registry to import this file and fix the problem. Switching back to MS Word. Remove the text we previously pasted to open up IE with

Shell “C:\Windows\regedit.exe”, vbNormalFocus

and once again click on the “Run” button (Green Play button)

The registry will now open – click File -> Import -> browse for the “xp_exe_fix.reg” and click “Open”

PROBLEM FIXED!!!!!!!!!!!!!!!!

By Matt Nel on Feb 18, 2010 | Reply

Oops – I forgot to mention in STEP 3 that you will need to open up any existing word document which you have previously saved on your computer!

By Gary on Feb 18, 2010 | Reply

Easy fix.. download COMBOFIX.exe start in safemode with networking.. download from bleepingcomputer.com simple fast an gets rid of this stupid AV.exe .. I got infect from a webpage..

By scott on Feb 20, 2010 | Reply

the problem with this fix for me is regedit is an application that cant be found. Can you help with that?

By SpunkyJVR on Feb 23, 2010 | Reply

FYI: The av.exe is happening due to an exploitation of Adobe freeware products (possibly others as well). Download the latest versions of all Adobe freeware products – particularly Flash Player and Reader. DO NOT just upgrade your existing version(s)! Go to adobe.com and download the latest versions.

By SpunkyJVR on Feb 23, 2010 | Reply

Note: this doesn’t solve the infection problem; but will help prevent against future infection.

By Anthony on Feb 26, 2010 | Reply

I recently had a little run in with av.exe, i stopped the process but for some reason it’s gone missing. I ran a search across my entire system for the program, but it came up negative. Any help with this matter would be greatly appreciated.

By Anthony on Feb 26, 2010 | Reply

Nevermind, now nothing will open even once i tried chris o’s fix.

By Chris on Feb 26, 2010 | Reply

Thanks for all the info. Got this last night on my desktop system. Gonna hit it when I get home from work. Norton picked it up but it had already gotten through an infected the system.
I have my registry backed up but not sure if I will be able to get to that back up.
What a PINA.

By Rami on Feb 27, 2010 | Reply

I GOT THIS LAST NIGHT AND THIS IS WHAT I DID:

1. Created a notepad and names it av.exe

2. copy/paste over the av.exe which is causing the problem (because mine was hidden i couldn’t find it) i have windows vista so this is the directory where i found this av.exe
C:\Users\[YOUR USERNAME]\AppData\Local\av.exe

3. i started getting this message “windows needs to know what program to use to”

4. i restarted the computer and pressed F8 and told the computer the do a system restore because a system restore from inside windows wont work because you’ll still get the same error message.

5. system restore worked and fortunately i know the software which got me into this mess “mediaring talk” and deleted it.

hope this works for you all!!

By duane fields on Feb 27, 2010 | Reply

Archived from groups: microsoft.public.windowsxp.configuration_manage (More info?)

You have to be set to view Hidden files and folders.

To display Hidden files and folders

Start | Settings | Control Panel | Folder Options | View tab
Check:
? Display the contents of system folders
? Show hidden files and folders
UNCheck:
? Hide protected operating system files
Apply | OK

[[Hidden files and folders will appear dimmed to indicate they are not
typical items.]]

THEN you can go to above and see these folders to find that av.exe to delete it.

By Norman Zonka on Feb 28, 2010 | Reply

Very convincing trojan and AVG missed it.

I deleted it and it then deleted my *task manager*.

Reboot and perform ’system restore’.

By Norman Zonka on Feb 28, 2010 | Reply

I must add i only got suspicious when the fake scan took 30 seconds whilst a real virus scan takes over 2 hours!

By Mike on Feb 28, 2010 | Reply

On Vista it’s in Located in “C:\Users\Default\AppData\Local”. End the task, delete it and run a system restore. Always run task manager when you’re online. Because a virus won’t allow you to access it if it’s not running already.

By Harry on Mar 7, 2010 | Reply

Ok, i got this crap as well. I also got rid of it. What you gotta do is stop av.exe messing around by killing its registry entries. So I typed the following into notepad:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]
[-HKEY_CURRENT_USER\Software\Classes\secfile]
[-HKEY_CLASSES_ROOT\secfile]
[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\.exe]
@=”exefile”
“Content Type”=”application/x-msdownload”

Then, saved to desktop and renamed it “fix.reg”. Name it whatever but it has to be a reg file. Then double-click it. Click yes to the messages that pop up. The registry will be updated, av.exe wont be able to run anymore. To get rid of the av.exe files, get the Malwarebytes Antimalware software (malwarebytes.org) and use that to remove the files.

By Dave on Mar 8, 2010 | Reply

This also happened to my system,the side bar was gone apps would not run correctly.here is how I fixed it click START then ACCESSORIES.now click the command prompt once it comes up type in “SFC/scannow” then hit enter sfc stands for system file checker if your system is having problems this resets the changed paths back to factory spec.

hope it helps Dave

By Lena on Mar 9, 2010 | Reply

I’m using a laptop with vista. When I click on “open folder location” of av.exe in task manager it opens “C:\Users\Default\AppData\Local”. I checked the “show hidden folders” option but av.exe does not show up anywhere!! Please help!

By ajay on Mar 10, 2010 | Reply

Harry, your suggestion worked perfectly. Thanks for your advise and sharing.

By n.k.o. on Mar 14, 2010 | Reply

I just did what harry says and it told me I couldn’t go through with it bcause it’s not a reg file. Why is this I have an XP by the way.

By n.k.o. on Mar 14, 2010 | Reply

I just did what Harry said and It told me that I couldn’t go through with it bcause it’s not a reg file even though I saved it as “.reg” Why is this? I have XP by the way, some help would be nice I just got the virus like thisd past Friday.

By n.k.o. on Mar 14, 2010 | Reply

Strangely enough though, unlike most of you guys, my malwarebites thing is running and it just detected 3 infected objects, however I don’t know if deleting them will permanately solve the problems, as it has already shown its annoying lil’ tendencies to resurface…

By Gareth on Mar 15, 2010 | Reply

Guys, I may well be repeating what’s been mentioned already, but I’ll give you my experience of removing av.exe. No system restore or anything was needed, it was quite straightforward.

- Bring up the Task Manager and kill av.exe
- Go to C:\Users\[USERNAME]\AppData\Local\
- Set ‘View Hidden Files’ under View, Options
- You should now be able to see av.exe. Delete the f#cker
- Now you’ll find that you can’t open executable applications as you normally would.
- Go to \Windows\ and right-click on Regedit.exe … run as administrator
- Remove any references to av.exe. I didn’t delete any Values, I just removed parts of the strings pertaining to av.exe. For example, HKEY_CLASSES_ROOT\.exe\shell\open\command\(Default) will be left as “%1″ %*
- Once done, my system worked fine. Good luck.

By gohan on Mar 15, 2010 | Reply

thanks mate, even a month later, and with a XP machine, your stuff still works!!
your my god