IE-AV (ieav.exe) Removal Instructions

By Pascal Bedin on May 4, 2008 | Reply

all message ieav.exe always the sheet message, it’s crazy.
Thank?s

By Andy on May 10, 2008 | Reply

i will try first

By Richard on Jun 7, 2008 | Reply

program not installed, but i keep getting the nag screen that says to install. How do i get rid of this pop-up screen, comes up no matter what i open, and asks me to download program.

please it is very annoying

By Nathaniel Zhu on Jun 7, 2008 | Reply

THIS VIRUS IS KILLING ME!!!!!!!!!!!!!!!!!!!!!

It always pops up saying some bullshit.

I cant get rid of it!!!

By xmann on Jun 11, 2008 | Reply

i have the same problem.i always get a pop up message.it says that i have a troyan infection and i have t download something.how do i lose it???ty

By Nikos on Jun 15, 2008 | Reply

However, If you haven’t downloaded ieav.exe yet and you get only the annoying popup window follow the next steps:

1. Search for the tapdfan.dll through c:\windows (mine was located in system32

2. Write down the path(s) and reboot in safe mode this time
3. Delete the files through console
4. Reboot (and good luck!!!) if you don’t get that window again try to use a program to clean your registry for orphan entries!!!

By Ba Nyar on Jun 16, 2008 | Reply

Hi Niko and All,
I have uninstalled and removed registry entry already. But I still can’t find the file tapdfan.dll although I am being nagged with that stupid message.

I searched the whole computer by showing all hidden files and showing Operating Systems files.

Thank you very much to all.

By Nikos on Jun 16, 2008 | Reply

Hi, im back again.

Just got noticed that the dll dont have the same filename.
What i did on my friend’s pc was an online scan using the kaspersky antivirus.

Unfortunatelly you have to delete the infections by your self. Let the scan finish, get the report and then boon in safe mode, open a console and start deleting the infections.

Hope that helped.

By Ba Nyar on Jun 17, 2008 | Reply

Hi Nikos,

Thank you veryyyyyyyyyyyyyy much. You are the best!
Yes, I have already solved that problem. Now, no more stupud popup and I dont need to format my computer. Thank you again and Thank to kaspersky online scan.

Thanks and best regards.
Ba Nyar

By SMF on Jun 17, 2008 | Reply

Hi Niko, I just looked in my system 32 and yes the name is not the same.

tapdfan.dll

bapdfim.dll

The second was on my pc. I deleted that and I am not getting anymore pop ups. I had to use unlocker because it was locked on to EXPLORER and unlocker unhooked it and then I used unlocker again to delete it. So far, I have not got the pop up taking me to try and download ieav.exe
I have not reboot and I guess I will come back and see how things are going with others.

By pleasehelpNikos on Jun 17, 2008 | Reply

So, I get that stupid pop-up thing too. How do I fix that? I never downloaded the program.;

By karlchen on Jun 17, 2008 | Reply

i alway get that fxxking popup.., i not download ieav.exe.., but popups everytime i want to open a folder.., i can’t find “tapdfan.dll” or “bapdfim.dll”
kasperky found only nonsense ^^
why there is now functional tool to remove this shit

By SMF on Jun 17, 2008 | Reply

For those who say they have never downloaded the program ieav.exe then you have to find the .DLL file that causes the annoying pop up which tells you to download their software. Go to your C:\WINDOWS\system32 folder and then right click anywhere inside and then try to use the Arrage Icons.. by Modified. This will either move those most recent files files to the very bottom or the very top. Most of the time it moves them to the bottom. I can’t tell you what the name will be since the file seems to be changed all the time hopefully it looks similar to theses tapdfan.dll or bapdfim.dll. I spotted mine because it looked like something some one already mentioned so, to be sure, I right clicked on the bapdfim.dll and then clicked properperties and then looked at the version history and then clicked on the item name(s) one by one until I seen a description BHO that stands for Browser Helper Object. I tried deleting it but I could not because it was snagged and hooked with EXPLORER so I downloaded unlocker (Free) do a google. And then I used unlocker to unlock it from Explorer and then I told unlocker to delete it. I had to do it a few times because it was being stubborn and it was freezing up but I managed to delet it and that was the end of the annoying pop ups. Hope you guys can get rid of it as easy as I did. Peace.

By skp on Jun 18, 2008 | Reply

That`s not even
tapdfan.dll
bapdfim.dll
these two i found “cosysnsy.dll” on my C:\WINDOWS\system32 by arranging by details so that you can find the recent modified or added DLL file on top.
It is easy to find it this way.
After removing the above said dll the popup stopped.
Just to try, before deleting the found dll file rename it with some other name & check that popup comes up or not.

If came try to find the other file which is causing the issue
If not then go ahead in deleting the file.

Hope this helps !!!

By hate this on Jun 18, 2008 | Reply

I tried to remove it but none of the methods wordked. I tried spybot, avg, tried to find the dll files but it was not there.Tried hijackit, tried to install it then remove it from the registy everytime you click on IE or a folder it will pop up with the download prompt. where is this pop up coming from ?

By Josh on Jun 20, 2008 | Reply

Hey. I have the solution for all of you that have NOT downloaded the exe yet. First, open My Computer. Go to C:\WINDOWS\system32. Right click and go to arrange icons and select modified. What this does is put the most recently added files to the bottom. Scroll all the way down and look for a .DLL (it is a sheet of paper with a green and yellow gear inside). If you scroll your mouse over it and it says “Type: Module” this is the file causing your problem. Write down or remember the .DLL’s name. Reboot your computer and go in to Safe Mode. Go to C:\WINDOWS\system32 again and right click, arrange icons by modified. Find all the .DLLs that have the type as Module at the BOTTOM OF THE LIST ONLY. Delete these and go to the recycle bin to completely delete them. Reboot again and your problem should be solved.

Any questions, email me at Seemliss@gmail.com or MSN/email me at Meateaterr@hotmail.com

-Josh

By Alex on Jun 20, 2008 | Reply

Thanks Josh !!!!!

Follow his instruction ppl.

By Vojko on Jun 22, 2008 | Reply

Hey Josh THANKS!!!!!!

It worked for me too. The file was “idef.dd”.

Vojko

By dave on Jun 22, 2008 | Reply

thank you thank you thank you josh you saved me from having to wipe my computer yeah your method definitly works thank you so much!!!!!!!!!!!!!!!!!!!

By Spitfire on Jun 22, 2008 | Reply

Thanks Josh !!!!! !!!!

This was the right way, but remember the date and time.

By he-angel on Jun 23, 2008 | Reply

MIne was called codef.dll

but the computer is still very slow, any tips?

By jerry on Jun 23, 2008 | Reply

Thanks Josh I the files that was causing this on my computer was ini.dll I try to delete but it would not delete so just renamed the .dll to .txt and it works no more stupid pop for installing ieav.exe

By joy on Jun 23, 2008 | Reply

thankx josh for the wonderful tip….it works….

By DEAD_MAN. on Jun 23, 2008 | Reply

Thanks JOSH. I resolved it.
File name was “opus32.dll”
Thanks a lot.

By Bingo on Jun 23, 2008 | Reply

Josh, this was very easy to remove with you help thank you!!!

Bingo (the bonking baby)

By Tibor on Jun 23, 2008 | Reply

Thanks for All!

The new filename is opus66.dll

Br. Tibor

By Kid on Jun 24, 2008 | Reply

Great josh!!

Yr s solution is Great!!

By joseph on Jun 24, 2008 | Reply

hey!!! this is the most effective way!! to remove that bastard virus..

first you must go to windows and open the folder”system32″
then lefttclick-arrange icons-modified, then after that go to the buttom, then try to leftclick the files from the bottom and choose properties, when there is the most latest file/files created, delete it using unlocker!!! thats iT!!!! then reboot….

By Ritu on Jun 24, 2008 | Reply

Josh, the solution given by you really worked..
Thanks a ton, i was scared that i needed to format

By Tibor on Jun 24, 2008 | Reply

Hi Guys!

I think, i got a new version of this shit… I try to summarize very shortly how repaired my vista! It is very risky process, but better like a reinstall!
The new version of this program creating 5 different DLL-s in to the windows\system32 directory, plus modify the ci.dll and the MBR (master boot record) too… The filenames always changing in every normal reboot! (Congratulation for the writer…)
!!Before you do anything what i wrote down you need to sure, your original install CD/DVD is working!!
Steps:
1.) Boot your vista with a normal way
2.) Find the .dll-s which “Type: Module” plus ci.dll
3.) Release them with the unlocker and delete them
4.) If it is done “Power Off!” not shutdown!!!
5.) Reboot with your original install CD
6.) Chose your language, etc
7.) In the second step, you have to chose the repair booting problems (first menu point), which repair your MBR
8.) Reboot, and try to start your windows
if you got error message on a booting period like xy.dll is missed no problem!
9.) Reboot with the CD again! And chose the repair option page / command prompt!
10.) Copy back the missed .dll-s from the original CD windows\system32 directory to “your boot disc”\”your windows dir”\system32 dir.
!!! You have to repeat this task from point 8.) to 10.) till to your windows starting again without any problem… !!!

That was the solution for me!

Bye, Tibor

By Mart on Jun 25, 2008 | Reply

How do these things get into computer? My PC was infected by this IEAV popup, although it is not connected to internet yet. I only brought home some downloads on DVD from my work computer (which is connected to internet, but it is MAC, so it didnt get infected). Does it go with .EXE files or what?
thanx 4 any answer

By Jon on Jun 25, 2008 | Reply

Thanks Josh

Worked for me too. As with all the others above, it seems that the name of the file has a random generator that can create the instalation dll. file with any name. So your method is the only tried and true one at the moment. Glad I did not install it.

My file was KS94.dll

By Spy on Jun 25, 2008 | Reply

Kaspersky is the answer.

By Dick on Jun 25, 2008 | Reply

You guys are awesome! Thanks a lot!

By chris on Jun 25, 2008 | Reply

what if you downloaded it but not installed it? can you still find the file ?

By Tom on Jun 25, 2008 | Reply

Spyware = porn? I saw the popups after the laptop was used by the kids.

By Deb on Jun 26, 2008 | Reply

Tom, sorry to tell u. Yes, they are related.

By keith on Jun 26, 2008 | Reply

hey josh..gr8 find!!!..but i need help on how to get rid of it on vista..coz i see no ption of arranging the icons on recently modified basis.
and yea…this shit is really annoying me!!!…

please help!!!

By kva on Jun 29, 2008 | Reply

Can you send me the link to ieav.exe ?

thanks.

By Alison on Jun 30, 2008 | Reply

Was in system32, did the arrange by modified, found it and killed it with the unlocker, then deleted it. So far, no stupid popups.

By Ivan on Jun 30, 2008 | Reply

Josh Did It … It Works

“Oggview.dll”

Hey. I have the solution for all of you that have NOT downloaded the exe yet. First, open My Computer. Go to C:\WINDOWS\system32. Right click and go to arrange icons and select modified. What this does is put the most recently added files to the bottom. Scroll all the way down and look for a .DLL (it is a sheet of paper with a green and yellow gear inside). If you scroll your mouse over it and it says “Type: Module” this is the file causing your problem. Write down or remember the .DLL’s name. Reboot your computer and go in to Safe Mode. Go to C:\WINDOWS\system32 again and right click, arrange icons by modified. Find all the .DLLs that have the type as Module at the BOTTOM OF THE LIST ONLY. Delete these and go to the recycle bin to completely delete them. Reboot again and your problem should be solved.

By emji on Jun 30, 2008 | Reply

Thanks a lot to everybody!

Just cleaned the dll by entering safe mode (prompt)

By simin on Jul 2, 2008 | Reply

hi every one

i couldn,t find any “*.dll” file with module type, but i used system restore and it worked for me.
in my case after system restore two files named “domsys.dll” and “xmlsys.dll” were gone. size of both of them was 26 kb and the type was “Application extention”. be carefull this type is a common type for windows files.
maybe it works for u too!
goodluck

By Soubhik on Jul 2, 2008 | Reply

hi josh
One time i installed it i colud not understand what can i do? how to remove from my computer about annoying error msg to download exe file,
1 time i download and then remove also ! what can i do now?
please help me

By Nikola on Jul 3, 2008 | Reply

Thanks Josh!! It started to be very annoying, but i listened to you, and deleted it in safe mode, and now it’s a big relief. Also had 2 .dll files, both were same, around 26kb

By bryan on Jul 3, 2008 | Reply

I am so lost, how do i do this? windows vista… what is this right click on on windows system 32 and arrange modified? i am lost, and this software is ruining everything

By thecool on Jul 5, 2008 | Reply

josh man u rock. ty so much I ran 2 diffrent malware removers and they missed it but due to you I just fixed this problem. Thanks a lot and may the heavens bless u and ur kids.

By wenomRaid on Jul 5, 2008 | Reply

hi all ppl i wanna say thnx ppl who is tryng to help there… i faced today with this problem and all day was tryng to fix it… this is what iwe done…
1. downloaded spyware doctor updated and scaned SYSTEM 32 folder and there was found 2 trojan downlaoder infections
2. also reset all internet configurations like browsers…
3.renamed all DLL files from 24-26 killobytes than just restarted and boom no more stupid pop up ….. good luck to fix

By SuperFreak on Jul 5, 2008 | Reply

Found in System32, agin_bho.dll and agino32.dll - both of them are 26KB.

By R3mus on Jul 6, 2008 | Reply

Well I got this a few days ago while trying to install a patch for a program Ive got. Turns out the patch didnt do anything, I thought it was cause Ive got Windows VISTA. Well when the popups started to come I got stressed, but now the resources in windows are getting used up and explorer keeps crashing. After some quick snooping around, I found some files that were edited the day I installed that patch.

Ive narrowed the files down to two, agino32.dll and snop_bho.dll, and both are 26kb and are application extensions. Kapersky is scanning System 32 at the moment, and has only found 1 infection. Hopefully my guess is accurate and I can solve the problem. Thanks everyone for your advice and help, I was really hoping not to have to reformat.

By selva on Jul 6, 2008 | Reply

hi there, that method is correct. C:\WINDOWS\SYSTEM32\ - arrange icons by modified then delete the DLL file. It could be any name (IMPORTANT), in my pc its (ant_sr.dll) if you delete the file!! that’s it! now you get rid of that stupid prob!

By Tomas on Jul 6, 2008 | Reply

Josh, you really help for me. My file was wdol_bho.dll and it is about 26kb.

By Nicoru on Jul 7, 2008 | Reply

Hey you people first i want to thank you voor your help and mabey i can help you now becouse i notist something with the name of the .dll this may help you to vind out the name

: avg_sr.dll, antsafe.dll, ant_ss.dll, avirasafe.dll, AVIRAS~1.DLL, , other semi-random filenames made up from the following fragments: avg, ant, avira, safe, _sr, _ss

as you notis the names are those of anti virus software they do this so you software will not find it.

and the dll is always 26kb.

thanks again and i hope this will help you

By YL on Jul 7, 2008 | Reply

WHAT HAPPENS if you HAVE downloaded the file. How, i seriously need help please. Thxs.

By Alan on Jul 7, 2008 | Reply

yes!! i did it
thnx josh. this was the second time i got this…
last time i believed in that stupid notice and eventually i had to reset my comp…

btw my comp language is not eng so i had troubles solving it.
what i did was remember back the approx date and time i got the first notice,
and look what file is the closest to it.. and just to remind u guys, the file is always 26kb
and theres 2 of them (for me) one of them had “safe” in the name

thanks alot.

By Ryn on Jul 8, 2008 | Reply

Good post by Josh…
It was work to me…i was thinking to recovery my sys edi…
U safe me…
thanks

By Stafford Cox on Jul 8, 2008 | Reply

Mine was called Epson32.dll and was 26k too. Deleted it in safe mode as administrator, job done. You guys are the NUTS!!

Thanks a lot

By Exuss on Jul 8, 2008 | Reply

Mine were named nvgflt.dll, nvfilter.dll, and nvgfilter.dll, as well as nvapps.xml. The .dll files were all 20kb in size. the maker is getting smarter - varying the file size now.

By anumon on Jul 11, 2008 | Reply

Thanks JOSH x 4 …

i found four dll files in d:\WINDOWS\system32

1.navf.dll 2.navfilter.dll 3.navflt.dll 4.nvfilter.dll

all same date with same 19.0kb size

i deleted these files in safe mode, now no more popup’s.

By JetDollars on Jul 14, 2008 | Reply

Josh,

You are the best. Your instruction is spotted on.

Thanks

JetDollars

By ask57 on Jul 14, 2008 | Reply

Thanks SMF. Your solution was the FIRST posted in this or any other site that actually works for everyone with regard to the dll file. Your mention of unlocker was also greatly appreciated. Many heartfelt thanks from a fellow traveller.

By sorrow on Jul 20, 2008 | Reply

josh i tried out your method but im unable to find any files which show type as module infact if i take my mouse pointer over it most of the .dll files are only showing
date created and size please help me if u read this post ……… or if anyone else knows any alternate method please help me i have already formatted my computer thrice becoz of this problem and i dont want to do it again so plz help me someone………plz

By brian Ross on Jul 21, 2008 | Reply

Most of you were right about this dumb pop up. Critical error! Attention some dangerous viruses detected in your system. Microsoft windows XP files corrupted.
It only pop up when I opened a certain folder or ran windows update. Here is what worked for me since I didn’t install the software they website wanted you to install.

1)Go to C:\WINDOWS\system32 folder. go up to view by details.
2) Then click on date modified. I started having problems on July 20th. So I found the .dll called: “iexflt.dll”
3) write down the .dll file from the day and time you were having problems.
4) Reboot in safe mode. go delete the file and empty trash.
5) Reboot and you are good to go. Enjoy!

Now why doesn’t my Symantec software pick this up??

By Laura on Jul 22, 2008 | Reply

Thanks! I did it.

Situation: I did not install that file, but it continue poping out the reminders.

Method:
1. Find the .dll under c:\windows\system32 which was installed recently. I got 2 .dll files.
2. Shutdown the computer.
3. restart computer, keep tapping F8 and go to Safe model
4. Delete those two files.
5. Reboot the computer.

Good Luck to all!

By Juan on Jul 28, 2008 | Reply

Easy: dombho.dll,
Size is 20KB

Thanks, I was becaming mad with this trojan.

By Pippo on Jul 28, 2008 | Reply

Did what SMF said on Jun 17th, 2008 at 10:25 pm. Was called domie.dll. Thanks SMF!

By robert on Aug 8, 2008 | Reply

8/7/08

gldman.dll

By Hamid on Aug 15, 2008 | Reply

I have vista. I did the same thing Josh said. However, I couldn’t find Type:Module. Anyway, I found two .dll s with around 27 Kbs, modified on the date of infection. I tried to delete them but it was not possible from within safe mode. The computer did not answer and was stuck. I wrote down their names and deleted them in safe mode command prompt. Now, although I have not to go through a reformatting, but I feel my system is rather slow. I thank Josh a lot.

By Ankuresh on Aug 16, 2008 | Reply

just reboot your pc in safe mode then go to c drive.
Now go to windows system 32 and search the items installed of that date when ieav started conflicting.
Do this to other folders too.
Then delete the suspicious files.

One more thing u should do, delete a file which is present in the c drive which is a long autorun type command.this will not be of the date when ieav installed.Most probably this will be of the date of your windows installation.do it carefully and keep only one thing in mind that u do not delete the ‘boot’ file.actually by this file only they give u those annoying warnings and ask u to download ieav.

note: if u have by mistake downloaded and installed the ieav antivirus (as it says itself) then uninstalling it from control panel or other simple ways will not do the job.
FOR this u need to right click the shortcut icon(usually on the desktop & not the downloaded file then) of ieav then click file location. after u will find uninstall ieav.
uninstall it from there.

YOU MAY NEED TO RECONFIGURE YOUR ANTIVIRUS AND FIREWALL APPLICATIONS AND UNINSTALL DOWNLOAD MANAGERS(IF U HAVE ONE)BECAUSE SOME VIRUS ARE ASSICIATED THERE TOO.
If u do not do this u might be again asked to download files every time u use internet explorer.

Thanks

By YL on Aug 17, 2008 | Reply

can someone answer me?

By pmn on Aug 23, 2008 | Reply

tnx smf!

By pmn on Aug 23, 2008 | Reply

tnx smf! (mine was megupload.dll , megupl.dll and megupl~1.dll)

By ANttu on Aug 25, 2008 | Reply

I had a problem, something pop up message is coming to the screen and download this, what i should to do?

By ANttu on Aug 25, 2008 | Reply

I’ve forget to say that it says that i have trojan horse then i should download this program?