SpyLocked Removal Instructions

By NickBC on Mar 20, 2007 | Reply

I have tried all likely resolutions and this is by far the easiest and most efficient one. Thank you!

By Tom on Mar 21, 2007 | Reply

how does spylocked relate to spydawn?

By Brian on Mar 21, 2007 | Reply

Tom,

According to Wikipedia, “SpyLocked is known to be associated with such rogue anti-spyware programs as Spydawn and SpySheriff. These programs share similar interface with the mentioned anti-spyware applications and have the same deceptive intentions.”

In short, it’s a new variant which can endanger your computer if you are not careful enough. That’s why we need to be extremely careful while we are surfing. Don’t install any video codec and ActiveX control if you aren’t sure.

By Kevin on Mar 22, 2007 | Reply

I have come to this page after going to pages listing more detailed instructions for deleting ‘all’(approximately 30 which were still in registry after uninstall was executed) related registry keys. All files/processes listed here on this page were already removed, but I STILL have a flashing icon in taskbar that alternates between flashing red “NO” symbol and a blue questionmark, which is STILL linked to the SpyLocked homepage. Has anyone who has tried the solution on this page had a similar problem? Wouldn’t this tend to indicate that the trojan is still on my hard-disk and could repair itself?

By Brian on Mar 22, 2007 | Reply

Kevin,

Those registry keys might belong to Zlob Trojan that executing the System Alert Popup on the taskbar.

Software\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler\{634be415-da12-496b-b89e-329b73c4807f}
Software\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler\{aed6f6a3-183c-488d-9f90-23db99f56e7f}
Software\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler\{8329660f-e248-4872-98cc-fb9c4fec7ba8}
SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\ EXPLORER\RUN\C:\WINDOWS\System32\issrch.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler\{2016a466-91a2-43c6-97d8-2fd380f065ef}

You can click on the following link to get more information on how to remove them:

http://www.xp-vista.com/spyware-removal/zlob-removal-instructions

After you manually delete the regkeys, you might still want to scan your drive with the automatic removal tool (the scanner is free) to ensure that you are free of infected files. Repeat the steps if any offended entries are found. The reason you need to do this because the spyware could recreate itself if zlob.trojan is not completely removed from your machine.

Good luck!

By Tim on Mar 23, 2007 | Reply

If you get either one of these messages, then you are probably infected with SpyLocked.

“System has detected a number of active spyware applications that may impact the performance of your computer. Click the icon to get rid of unwanted spyware by downloading an up-to-date anti-spyware solution.”

“Warning!
W32.Myzor.FK@yf is a virus that infects files with .exe extensions. It attempts to seal passwords and private information from the infected computer.”

By Brian on Mar 24, 2007 | Reply

You could get SpyLocked by opening an infected message in MySpace or other Social-networking websites. You could also get it from installing fake video/audio codec, fake software or fake software updates.

By Brian on Mar 24, 2007 | Reply

If your homepage was was changed to “asafetyproject . com” or “yourieprotect . com” then you most probably have been infected with SpyLocked, SpyDawn or MalwareWiped. You can easily get rid of them by following the removal instruction at the top of this page.

By Sunny on Mar 24, 2007 | Reply

Yes, I paid for it. I wasn’t smart enough to follow the complicated procedures. Accounting major But it’s a peace of mind to get rid of this stupid icon. Never download unknown files again This is a great lesson!

By bernad on Mar 25, 2007 | Reply

Never download unknown files again, that right. Particularly those applications from unknow vendor.

By Mike on Mar 25, 2007 | Reply

I’ve tried this and several other supposed methods of removing SpyLocked but none of them work. How do I get rid of this trojan?

By Brian on Mar 25, 2007 | Reply

Mike,

The instructions worked for a lot of people. You just need to know what you are doing first. If you let us know what you have tried and what errors you’ve encountered, we can probably give you a better answer.

If non of above work, you can still try the Automatic Removal tool. Of course, it’s at a cost but it will give you peace of mind. From what I learned, Spyhunter support would give you a custom fix remotely if somehow Spylocked or other spywares can’t be removed by the software.

Good luck!

By Greg on Mar 26, 2007 | Reply

Has anyone heard if spylocked or the Zlob trojan can and or will jump of onto an external device, such as an ipod?
And if it can do I just look for those .dlls?
Thanks for any help

By haseep on Mar 26, 2007 | Reply

yes thank

By haseep on Mar 26, 2007 | Reply

yes it’s good site for fixing error on pc.

By Mike on Mar 26, 2007 | Reply

All of those .DLL files in these instructions apparently don’t exist on my computer. I tried to unregister them and they I received a message stating that they couldn’t be found.

I also tried the smitfraudfix method; going into safe mode etc. That did absolutely nothing.

By Mark L on Mar 26, 2007 | Reply

Hey,
Yea I was infected, and it took a while to get rid of everything. I did it by using the spy hunter to look up the files, but proceeded to delete them manually. Anyways, thanks for the tips. Good luck

By c on Mar 26, 2007 | Reply

i manually deleted all the files by using spy hunter, but the icon is still on my computer… is there anything else i need to do? restart computer?

By Brian on Mar 26, 2007 | Reply

Greg, not that I know of.

By Brian on Mar 26, 2007 | Reply

Mike, you need to make sure if your machine was infected by Spylocked. It could be other spywares. I would suggest you to download the removal tool to scan the drive. You don’t have to pay for the scan which will tell you if there’s anything infected files. Hope this helps. Good luck!

By Brian on Mar 26, 2007 | Reply

Mark, job well done! Glad to hear that

By Brian on Mar 26, 2007 | Reply

C, can you elaborate a little bit more? Did you scan the drive with Spyhunter then delete the files/regkeys manually? Or you have the full version of Spyhunter? If you have a full version, you can go to “Help”-> Technical support system, open a support ticket, generate support log and send the support log information. When they receive your support log they can assist you to resolve the issue.

By MORGAN on Mar 27, 2007 | Reply

does this work

By Asad on Mar 27, 2007 | Reply

I have an icon still, and tried everything you guys said. i found 2 zlob virussed on the registry and removed them and restarted the computer but it is still there. I run the program again and they were really gone however the bloody icon was still there? GRRRRR!!!!

By Asad on Mar 27, 2007 | Reply

Yes, i have came up with a solution!!! You guys could thank me later!! There is a new infector called tahxqcj.dll located in the windows/system32 folder.

Deleting only works with one way(not even the safe mode):

Run CMD and go to the Windows/System32 folder by writing: ‘cd C:/Windows/System32′ and ENTER.

Then go to the task manager and end the process called explorer.exe (your back-screen should disappear). Then go back to the CMD window and type in ‘del tahxqcj.dll’ and ENTER. (The Spyware should be totally gone)

Then go back to the task manager and then file, new task and type in ‘explorer.exe’ and ENTER.

Wallah…All fixed!!!

By Susie on Mar 27, 2007 | Reply

Asad – Thank you! It’s gone, finally. The tahxqcj.dll file indicated it was created in 2005 (I think, but not when I got this bug). How is that possible?

By c on Mar 27, 2007 | Reply

it said that file could not be found

By c on Mar 27, 2007 | Reply

tried again and yay finally got it off, thank u

By Paula on Mar 27, 2007 | Reply

What is CMD? (Looks like DOS mode to me.) Do I need to manually delete all the files found by spyhunter first, and then follow the instructions to remove tahxqcj.dll? Thanks.

By Asad on Mar 27, 2007 | Reply

There is a new bad file called ‘qvjpt.dll’ located in system32 folder.

By Sir Nick on Mar 27, 2007 | Reply

I agree with Asad – great idea.

By Gale on Mar 27, 2007 | Reply

Please help! I tried Asad’s method but when I run the cmd it starts up like this

C:\Documents and Settings\(user)

What do I do? I can’t press backspace

Thank you

By Brian on Mar 27, 2007 | Reply

Gale, if you are not familiar with command prompt, you can use Windows’ search function to locate the dll then delete them.

By Gale on Mar 27, 2007 | Reply

Do I still have to do end the explorer.exe process though? Thank you

By Gale on Mar 27, 2007 | Reply

Ok I searched it with windows but it says that I cannot delete it. I think its because I didn’t end the process of explorer.exe. When I do end the process the search program disappears…Help, and thank you

By Tom on Mar 27, 2007 | Reply

Hi, I have the same problem as Gale, I think its also because I didn’t end the explorer.exe process. When I do, the search program for windows disappears.. Help please. Thank you!!

By John on Mar 27, 2007 | Reply

Explorer.exe is part of the system. Ending this particular process will cause problems for Windows. If you don’t feel comfortable remove Spylocked manually, the automatic tool is a great option for those who is not familiar with system editting. Yes, it might cost $30, but it also saves you a lot of headaches.

By Asad on Mar 28, 2007 | Reply

NO NO NO NO NO!!!!

You need to close explorer.exe (from task manager)

Closing explorer does no damage what’s so ever. It is just a bloody program!!!

^^^All the folders close as well^^^(including Search) so you need to delete it from command prompt!!!

Apologies for the spelling mistakes i made last time (’/’ should have been ‘\’). Start Command Prompt. You should write this in CMD(DOS): ‘cd C:\Windows\System32′ and ENTER. And then close explorer.exe and go back into CMD and type in ‘del (filename)’ and ENTER. Then go back to task manager, to file, new task and type in ‘explorer.exe’ and ENTER. This should work if you did it right like Susie and c did at the top.

And you guys, this is the free, fastest and easiest way to get rid of this virus.

PS. Gale, you can’t delete or backspace the thing at the start of when you run Command Prompt. Just ignore it. Type what I said and it should take you to the right folder.

By Asad on Mar 28, 2007 | Reply

You will likely see that the last two dlls in the list at the top would most likely be the virus because they are the new ones.

By Asad on Mar 28, 2007 | Reply

If anyone doesn’t understand how closing explorer.exe makes it so you can delete the virus here is the explanation:

When you close explorer.exe, it stops the functionality of everything that has got to do with viewing your c dive and stuff like that. Here is what i mean:

———————————————–
It closes all folder viewing windows.
Closes the task bar at the bottom.
Therefore it stops all the programs that run on the taskbar, like all the icons. This stops the functionality of the virus and there you can delete it(using CMD otherwise known as DOS) following my steps above.
———————————————–

By Cyrus on Mar 28, 2007 | Reply

How do I know if I have removed the program? Thanks in advance

By Brian on Mar 28, 2007 | Reply

Cyrus, the easiest way to do it is to download the removal tool, which will scan your machine for free.

By Cyrus on Mar 28, 2007 | Reply

ok thanx, I disconnected my infected computer from the internet, is that smart

By Cyrus on Mar 28, 2007 | Reply

So I the free scanner catches nothing I am good to go?

By Asad on Mar 28, 2007 | Reply

Cyrus,

What country are you from?

It is just that i did not understand what you said.

PS. Please everyone tell me which countries you live in. I live in Australia.

By randy on Mar 28, 2007 | Reply

asad, you’re a god. it works after everything else failed. a thousand thanks my friend.

By Keith on Mar 28, 2007 | Reply

Asad,

Ditto, worked great!!

By Asad on Mar 29, 2007 | Reply

Thanks a lot. Your Welcome.

PS. You did not say which country you live in?!

By Robert C on Mar 29, 2007 | Reply

Thank You ALL for your help!
I was able to manually get rid of SpyLocked

By Tom on Mar 29, 2007 | Reply

My computer could not find any of those DLL Files and also could not even find Spylocked.exe under my system processes, however I know that I am infected because I have the annoying flashing icon that links to the Spylocked website and get the annoying pop-up “warning”. Has anyone else experienced this or knows what my problem is?

By Ken on Mar 29, 2007 | Reply

Asad you are a lifesaver. Thanks so much for your help. p.s. i usually hit the “/” instead of the “\” too

By Asad on Mar 29, 2007 | Reply

Kind of you to put that concern Tom,

There are two new bad files:

oyopu.dll
yronl.dll

By Soodle on Mar 31, 2007 | Reply

Thanks for all the help about this Asad.
I’ve managed to get rid of the spylocked icon in the taskbar, but I still get annoying pop-ups while I’m using the internet.
I’ve been through every .dll file listed on this page to try and delete it using the method you described, but cmd says it can’t find any of them on my computer.
Any ideas?
Thanks again.
soodle

By teri on Apr 1, 2007 | Reply

Thanks so much for the help…after a day of searching and trying to get rid of that nasty thing it is gone. Such a relief =) You guys/girls are so smart!! =D Thanks so very much.

By Richard on Apr 1, 2007 | Reply

Asad,

I have followed your instructions but CANNOT get rid of the Spylocked icon in the taskbar!!
Getting this message
“Could not find C:\WINDOWS\System32\tahxqcj.dll”

Any chance we can speak – I’m in St Kilda, Melbourne.

By prasanna on Apr 1, 2007 | Reply

supper

By dave UK. on Apr 1, 2007 | Reply

many many thanks Asad,it took a while but i finally nailed the little fxxxer

By Erythorbic on Apr 2, 2007 | Reply

Had a hell of a time getting it to work,Mine was one of the new dll files… Heres a tip that helped me.. Do a search on all files on your computer enter .dll and it will list all the dll’s on your computer then look at them by date.. as long as you know the day you were infected you can pretty much find which one you have from the list with out having to go through them all.

By Rob on Apr 2, 2007 | Reply

I have found the file oyopu.dll in my System32 folder. However, when I do the steps you list out, my CMD promt says “Could Not Find C:\Windows\System32\oyopu.dll” But when I go to the System32 folder in Explorer, it’s there!

By Rachel on Apr 2, 2007 | Reply

ASAD,I think I love you. I was soo worried that I was going to have to take this damn thing to Best Buy. Thank you so so much.

By Richard on Apr 3, 2007 | Reply

YEAH BABY – it’s gone!!!!

Rob,

Same thing with me, BUT, tried it AGAIN using CMD prompt method as outlined by Asad, AFTER trying to delete it in explorer – for some reason it worked this time????

Ours is not to reason why….

By Richard on Apr 3, 2007 | Reply

Maybe somthing to do with the 4 beers I drank trying to work it out…..

By Susan on Apr 3, 2007 | Reply

I spent half day trying to remove Spylocked manually then ended up purchasing Spyhunter. It’s a breeze! Now the icon is gone.

By jason on Apr 4, 2007 | Reply

Thanks Asad

By jason on Apr 4, 2007 | Reply

Asad, you saved me a load of time, thanks for your fix.

This is first time i have been infected and I don’t know much about spyware, was the dll file opening explorer and working or was only the pop activated?

By Jeff on Apr 4, 2007 | Reply

ASAD,
I need help…

Okay here is what I did….

1) clicked RUN and then typed CMD.
2) I pasted this there…. cd C:\Windows\System32 and then it says Windows cannot find ‘cd’ . Make sure you typed the name correctly, and then try again. To search for a file, click the Start Button, and then Click Search.

—- Or —-

When I clicked RUN and typed CMD. and it popped up it says
C:\Documents and Settings\(user)> and then typed cd C:\Windows\System32

it said ‘_’ is not recognized as an internal or external command, operable program or batch file.

What do I do….??

But when I tried to search them:

spylocked.exe
xkrdk.dll
onwtj.dll
fyxkaah.dll
higehsg.dll
geplxss.dll
tvomnc.dll
tahxqcj.dll
qvjpt.dll
oyopu.dll (new)
yronl.dll (new)
isadd.dll (new)

on the Folder System32, I cannot find them.

Any help plz!

By Andrew on Apr 5, 2007 | Reply

Same here Jeff. Nothing appears to be in the System32 folder. I have followed all directions to a tee and no such luck. Although.. In my Program Files Folder on my C drive, I have a folder named Video Access ActiveX Object that contains the isadd.dll file, as well as a few other suspicious ones.. For example, iesplugin.dll and some .exe files listed as follows..
isamntr
iesuninst
isamini
isunst
pmmnt
pmunst

If someone can take this a step futher, Id really appreciate it. Thanks!!

By jon spear on Apr 5, 2007 | Reply

Thank you, Asad!!!

Here is my experience:

I have Spybot, which is a free program. I used it to clean my computer, which mostly worked, except for the icon in the lower right hand corner of the screen. I believe that it couldn’t erase the last file, because the file was in use when explorer was open.

So, I figured that I must use Asad’s method. I first followed Asad’s instructions as best as I could, and tried to delete the bad new files. I got the error message that the file(s) could not be found. So then I typed ‘dir/a/p’ in the cmd window, and eventually found that oyopu.dll was the bad file which I had. I tried deleting it, but it still said that the file couldn’t be found!

So then I typed ‘explorer.exe’, and used the mouse to point and click my way to the C:\WINDOWS\System32 folder. I could see the bad oyopu.dll file in there (an easy way to find the bad file is to use the ‘Details’ option in the drop down menu for ‘View,’ and then arrange by ‘date modified.’ It will likely be one of the newest files).

In that Windows mode, I renamed the bad file as ‘badfile.dll’ Then I went back to the cmd mode and was able to type ‘del.badfile.dll.’

I don’t know why, but changing the bad file name seemed to work. Hope this helps…

By jon spear on Apr 5, 2007 | Reply

In the above post, I meant to say that I was able to type
‘del badfile.dll’ Please excuse the typographical error. I apologize in advance for any confusion.

By jon spear on Apr 5, 2007 | Reply

In response to Jeff and his problems with using the cmd window:

It looks like you are not familiar with navigating through directories using the old DOS-like commands. Here are some useful hints:

When you first run the ‘cmd’ program, it puts you into a specific directory. In your case, that directory is indicated as
C:\Documents and Settings\(user)

To go up a directory, type ‘cd ..’

If you do that a couple of times, you will get to the root directory, where the prompt says:
C:\

Then type ‘cd windows\system32′ and you should be in the right directory.

By Phil A on Apr 5, 2007 | Reply

New file detected for Spylocked 3.3 = qzviz.dll

located in c:\windows\system32 and is stealthed. Not just hidden attrib, but stealth. using regsvr32 to attempt unregister reports it is there, but errors. After that you can clean it manually. SpyHunter with database version 04.04.2007 does NOT detect this.

Registry keys indicated with this variant:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
“{bd0fc212-0a36-4232-83cc-2063fb9282e0}”=”curdler”

[HKEY_CLASSES_ROOT\CLSID\{bd0fc212-0a36-4232-83cc-2063fb9282e0}\InProcServer32]
@=”C:\WINDOWS\system32\qzviz.dll”

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{bd0fc212-0a36-4232-83cc-2063fb9282e0}\InProcServer32]
@=”C:\WINDOWS\system32\qzviz.dll”

By Melinda Crepin on Apr 5, 2007 | Reply

I still have the stupid icon on my taskbar and I can not get it off. I am finding that all of the instructions are confusing. I could really use a step by step to remove it because my spysweep says that there is nothing else on my computer.

By Thomas (Missouri – USA) on Apr 6, 2007 | Reply

It looks like the Spylocked program is changed agout as fast as fixes are identified.

About 24 hours ago, I apparently got hit with it. “SpyBot Search and Destroy” got rid of the files in its current database but that was only about 90% of the bad files.

SpyBot missed tahxqcj.dll and qujpt.dll

It also missed,

iesplugin.dll

which appears to be a parallel problem (this may not be from from Spylocked). It puts icons in IE toolbar that link to http://www.secureguidance .com which seems to be a rogue site similar to Spylocked with false come ons.

In my case the task toolbar blinking icon must have been from a new file

qzviz.dll

that is not mentioned above. Since it was unlisted above, I renamed it. Then I rebooted the computer and the bliking icon was gone. Since everything else seems to be working properly, I then deleted the renamed file.

Hope this helps some.

The Missouri state motto is “United We Stand – Divided we Fall” Sharing the collective experiences above have sure helped with this problem.

Good luck to all.

By Danny on Apr 6, 2007 | Reply

thnks for the help i got rid of the dam icon just trying to get rid off the web site when i log on to the internet. i tell you what they have some nerv puting a virus on your pc then geting you to pay for them to take it off i feel giveing them a good beating

By sean on Apr 6, 2007 | Reply

thanks so much guys, i finally managed to get my computer safe and running again just wanna let you all know that the .dll file that was infecting me was named differently from everyone else’s..so like erythorbic said, its best to search for the .dll file that was modified on the day that your comp got infected and delete that one.

By Guneet on Apr 6, 2007 | Reply

i tried using spyware doctor bu still the pop sign keeps on coming1 so now i am going to try the above steps and hope that it gets removed from pc

By Phil A on Apr 6, 2007 | Reply

SEAN -

If you were infected with yet -another- DLL variant, please share with the group so we can all be smarter.

thanks!

By Jay on Apr 7, 2007 | Reply

New file found for SpyLocked pkgvyg.dll

By Jay on Apr 7, 2007 | Reply

The methods that finally worked for me: Search for all .dll files, and sort by date. Find the most recently created ones, and use Asad’s method for deleting them!

Thanks Asad!
–I’m from Montana, USA, btw.

By Arne on Apr 7, 2007 | Reply

Hi,
I’m pretty bad at computers and all that, but i kind of have a problem. I used to have the spylocked thing on there with the pop-ups. Then i used smitfraudfix (in save mode), and now the pop-ups are done and all that. However, when i scan the computer using Spyhunter, it still has about 90 hits including the zlob.trojan files… Does anyone have an idea what to do?:S

thanks

By Arne on Apr 7, 2007 | Reply

I think i’ve fixed it now… I used the spyhunter scan to find all the infected objects and manually deleted all of them using the register editor and simply by searching “my computer”… Upto now i don’t think i’ve wrecked the system for it seems to be working properly. Thanks people,

Arne

By Victor on Apr 7, 2007 | Reply

I just found qzviz.dll I tried deleting it through command prompt which didnt work then I tried renaming it and deleting it with command prompt still no luck, can anyone here help me, also what is this, it was typed earlier and when i used spyhunter it looked familiar:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
“{bd0fc212-0a36-4232-83cc-2063fb9282e0}”=”curdler”

[HKEY_CLASSES_ROOT\CLSID\{bd0fc212-0a36-4232-83cc-2063fb9282e0}\InProcServer32]
@=”C:\WINDOWS\system32\qzviz.dll”

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{bd0fc212-0a36-4232-83cc-2063fb9282e0}\InProcServer32]
@=”C:\WINDOWS\system32\qzviz.dll”

I’ve seen the HKEY on spyhunter but i can’t delete it without purchasing it and i know my parents are gonna get mad if they have to purchase something, help and thanks ahead of time

By M on Apr 8, 2007 | Reply

I ran the SpyNoMore software to locate the infected files, went through and manually deleted all of them, but then when I had to delete the actual Trojan, it was not letting me delete it, so I followed Asad’s instructions and was able to delete it through DOS commands. Now the icon is gone and all scans suggest it’s truly gone!

By Rick on Apr 9, 2007 | Reply

Thanks for all of your help

Beaumont Texas

By Sylvia on Apr 9, 2007 | Reply

Man, I need serious help here!

Erm how am I suppose to know which file to delete when I can’t find any of the mention ones above.

Anyone??

By Ryan on Apr 9, 2007 | Reply

I used Spyware Doctor and scanned my system. Everything was found except for the flashing icon in the tray @ the bottom right. I looked for all the listed .dll files and finally found “qzviz.dll” it had a modified date of April 7, 2007 which is when I was infected. Deleted it all clear.

I want to thank everyone for there expertise. For those of you still struggling, be patient and realize that you are not intended to fix this easily. All the information you need to fix the problem is listed on this site.

Ryan from Canada

By Ryan on Apr 9, 2007 | Reply

Viktor,

click start and hit search the *.dll files and look for the listed .dll files from above. you will find them in c:\windows\system32. once you find one rename it. if it is the correct one the icon will change immediately however until you reboot it will still be there. Restart and if it doesn’t show up go and delete the file that you renamed.

By Kaylyn on Apr 9, 2007 | Reply

Ryan, you my friend are a genius…THANK YOU! THANK YOU! THANK YOU! The flashing icon is gone, no pop-ups come up and i didn’t have to pay a red cent! thanks

However, everything seems great but how do i know for sure its gone, i mean my scanner didn’t pick it up in the first place?

By Brian on Apr 10, 2007 | Reply

New DLL for Spylocked removal instructions: pkgvyg.dll

By David on Apr 10, 2007 | Reply

I have Windows ME how do i get rid of spylocked?

By Kaylyn the Shizznit on Apr 10, 2007 | Reply

Btw, everyone pay attention to what Ryan says. I followed his instructions and was able to completely eliminate Spylocked from my computer. That little SOB is gone!!!

By Cole on Apr 10, 2007 | Reply

I recently got it, not sure how, but it is there. I am trying to get rid of it. Any suggestions that don’t involve buying anything?

By Cole on Apr 10, 2007 | Reply

Btw, I think Spy-Sub.exe is another process one. The name looked a tad suspicious.

By Cole on Apr 11, 2007 | Reply

I found a new unregister SpyLocked DLL file – qzviz.dll

It won’t let me remove it. It says it is in System32 folder and says accessed denied when I try and delete it. Don’t really understand why the access is denied because I am an admin (only account on this computer) so I am guessing SpyLocked protects itself like that.

By entalvis on Apr 11, 2007 | Reply

easiest way i found to manually remove:

use the “free” tool to scan, then manually remove the registry keys found and then RENAME the .dll file using windows explorer.(you cannot delete the file using windows explorer because it is in use. also, this will find whatever .dll file your version of the trojan decided to use) reboot and it will not load and you can then delete the previously renamed .dll file.

if you are afraid or really unsure about how to remove registry keys then pay for the software, as you can easily render you computer useless and end up reloading windows by playing in the registry.

also, i ran the tool while runnig in safe mode, i also ran spybot and adware to make sure i had no other spyware/adware infecting the system as well and also an antivirus program. i manually updated all of these using a flash drive.

By Toxic Avenger on Apr 11, 2007 | Reply

I’d like to ask the obvious question which no one has asked yet:

How do we get back at these @#% Spylocked @#%s for trashing our computers and wasting hours (in some cases, days) of our workdays?!!

I’ve started spamming their “contact us” form with all sorts of nasty comments carefully designed to ruin the day of anyone who reads them, or at the very least annoy them so bad they won’t have time to cause more internet mayhem. A friend of mine has suggested an auto-spammer to plug up their email (their “contact us” form doesn’t have a bot blocker).

These are all just cheap jabs, I admit. But I can’t exactly plan a drive-by shooting. From what I understand, they are located in Latvia.

So anyway, is anyone taking action against these @#$s?
Yours angrily,
The Toxic Avenger

By B on Apr 12, 2007 | Reply

Ok, well i now have this spylocked thing on my computer and its buggin me. So i downloaded the spyhunter and did the scan, so how do i get rid of spylocked with out buying spyhunter?

By Brian on Apr 12, 2007 | Reply

B,

The step-by-step removal instruction show how to remove Spylocked manually. This is always something you should try if you are good with the computer. And it costs you nothing.

However, if you aren’t sure what you are doing or don’t know much about computer, you can go for the safe route and pay for the removal software. It’s safe and easy but also costs you $30 to end your headache. Oh, don’t forget to ask your IT friends if you know anybody. “A friend in need is a friend indeed.”

Hope this helps. Good luck!

By Jenny on Apr 12, 2007 | Reply

hey guys.. Im at my wits end with this thing.. it infected my old compaq armada 7770dmt and now it wont even let me online Im seriously about to cry I tried looking for the .dll files but cant find any of them on there!! I know that the program is still on there because of the fact that the flashing icon keeps showing up I have no idea what else to do..

By AL on Apr 12, 2007 | Reply

i can’t remove after using Asad’s method and the smitfraudfix.exe method… what to do?

By Matt on Apr 13, 2007 | Reply

Found another dll to look for. Was infected yesterday and its Ygjun.dll. Thanks Ryan for the tip. I had everything cleaned out but that. As soon as you rename it, it changes the icon in the taskbar, and vanishes upon bootup.

By Christian on Apr 13, 2007 | Reply

Thank you for the instructions…ii actually fell for it…looking for serial #’s and such..asking my friends and yeaa…Until i looked at wikipedia[my daily source of everything] and learned its a rogue software…then ii saw these links..and its great..thank you.. =]..and i will NEVER download any weird stuff anymore..thx

By Brian on Apr 12, 2007 | Reply

Jenny,

There’s no need to cry.

Since you can’t get online with the Compaq, you can print out the SpyLocked removal instructions and follow it step-by-step. It’s fairly easy. Otherwise, you try the removal tool but it also costs you $30. Just download it from a working computer and then put it on a USB drive. As always, you can reload the whole system as a last resort.

Good luck!

By ken on Apr 14, 2007 | Reply

i can’t download the tool? a blank page just opens up.
anyway. i dont see the icon at the toolbar anymore, however, spydoctor still shows me the spyware linked to spylocked. what should i do?

By Brian on Apr 14, 2007 | Reply

Ken, thanks for pointing it out. It’s been corrected.

By RC on Apr 14, 2007 | Reply

Thanks to Asad for his instructions and Matt also… I had the Ygjun.dll and I got it on the 13th. Learned a lesson. But I am still not too sure that my computer is clean, and the SpyHunter Links seem to be dead. I haven’t found another Anti-spyware program that was able to detect so many spylocked files. Any suggestions? and should I change my passwords now?

By Dianne on Apr 15, 2007 | Reply

I have been trying to get rid of that D#$% icon since 4/13 also. Now 4/15, I want to say thank you for all your suggestions on removing spylocked. I am going to do it now!
I am all for shutting them down… count me in! We need to show them how it feels to get an adware like theirs, have them have to remove it… days later. Then they want to get paid to remove it.. yeah right! When H#$@ freezes over. Thank you!

By Dianne on Apr 15, 2007 | Reply

oh, I live in California, USA
Thanks!

By Miljan on Apr 15, 2007 | Reply

yeah..thanks u all.my computer got infected with spylocked and some zlob troyans..what i did is next: first i used cracked version of spyware doctor and i scanned my comp.found about 81 bad files..cleaned them all but anyway i had a flashing icon in taskbar..than i used spyhubter(couldnot find a crack)so after it found 55 zlob troyans all in registery files,i had to remove them manually.after that i restarted my computer and it was ok:) mcafee ad-aware spyhunter didnot find anything..oooh yeah i got infected by downloading some kind of active x control:( without signature of course..soo be carefull..big thanks to Asad and Jon from Bosnia

By Mickey on Apr 15, 2007 | Reply

good lord what a mess, I got this bug on the 13th, realized it immediatly and am finally rid of it ( I think) I used spyhunter and onecare.live .com to get rid of the basic mess, but that wretched Icon and warning still plagued me. Sure enough it was the ygjun.dll file. Got rid of it according to Ryans instructions and voila good riddance. My question is if there is anything else to look for. I see no .exe or.dll files related to spylocked, I am assuming that the registry files were taken care of by either onecarelive or spyhunter, and I have not seen any known processes running. Thanks RYAN and everyone else.

BTW I have had real good results with onecare.live. com… any one else have any comments on it??

By RC on Apr 15, 2007 | Reply

I got the .dll files off my computer, but SpyHunter says that I still have several Zlob registry files. How do I get rid of those? I searched the regedit program for all of the above registries.
Thank you all

By ally s on Apr 15, 2007 | Reply

clean and fresh… that is how my computer must be feeling. removed the spylock manually…. so thanks a lot to Brian, Assad and Ryan

by the way, I got the latest Ygjun.dll version and am from Mauritius

great work people… keep it up!

By Sina on Apr 17, 2007 | Reply

This is such a mess. Got it on the 15th, and still trying to get rid of it. I have basically tried everything here, and still the icon is there. All the files are gone, the .dll’s are gone, and the registery has been cleaned. BUT THE GODDAMNED ICON IS STILL BLINKING X(

Ok first of all, as you all have noticed, the scanners out there are worht. And secondly, I cannot download the file offered on this website. HELP.

By Sina on Apr 17, 2007 | Reply

Ok found the .dll file to be ygjun.dll, and it was created on 2003!!!!???? I got my computer a month ago for goodness sake!!!

By Feffe on Apr 17, 2007 | Reply

Allright, I’m still having some issues with this wretched virus.

I downloaded spyhunter, removed everything manually.
I got rid of one of the flashing icons. However, I had two!

This second icon isn’t flashing all the time. It shows up every now and then, flashes for a few minutes and then it’s gone. I have no idea how I’m supposed to find it, I searched for “.dll” and sorted by date but no .dlls in system32 were from the day I got the virus.

Oh, and just to add to the clarification: the first icon was caused by Ygjun.dll. Something tells me that there’s a new .dll now though.

Thanks to everyone so far and I hope someone can help me get rid of this completely.

By Pablo on Apr 17, 2007 | Reply

I got this problem on a Monday (yesterday). I did some basic things to try to remove it but I haven’t been able to remove it completely. SpyHunter is the first program to actually find all the registry values and files. Anyway, since I’ve had this, my laptop has been running incrediablly slow! My natural assumption is to assume that it is related to this problem. Is this correct? and will removing it fix it?

By Tim on Apr 17, 2007 | Reply

Feffe, try to see if you can find qch29sr.dll
It might be a new Spylocked dll.

By Ron on Apr 17, 2007 | Reply

Got the bastard!!! ygjun.dll was the culprit on mine. Was constantly running in memory and the normal removal programs wouldn’t delete it. Simply went to DOS and killed it from there. Thanks for all the help!

By Ken on Apr 18, 2007 | Reply

I don’t have any of the files and registry entries speicifed in the whole forum while I do have the flashing icon on my task bar.

ANY HELP?

By katy on Apr 18, 2007 | Reply

i have tried unregistering all the .dll files listed and it says none of them exist on my computer…im possitive im infected with spylocked…help pls!!

By Ron on Apr 18, 2007 | Reply

Hey Ken,

Try doing a search for *.dll and *.exe files. Sort them by last modified, and see if a file’s modified time matches the times when the virus started, particularly if it matches one of the files listed above.

I had the same problem where everything was clean except for that icon, which was always running in memory. Had to open the cmd prompt and end the explorer process before I could delete it with the dos command!

Worked

By Eric on Apr 18, 2007 | Reply

can anyone confirm czxtyx.dll ?

By Eric on Apr 18, 2007 | Reply

i think this is bad. this is what filemon showed on czxtyx.dll. i had renamed czxtyx.dll to czxtyx_bad.dll and this is what filemon showed when the “icon” tried to run i think:

22698 9:37:41 AM explorer.exe:2552 QUERY INFORMATION C:\WINDOWS\system32\czxtyx.dll NOT FOUND Attributes: Error
22699 9:37:41 AM explorer.exe:2552 QUERY INFORMATION C:\WINDOWS\system32\czxtyx.dll NOT FOUND Attributes: Error

By Feffe on Apr 18, 2007 | Reply

None of the suggested .dlls have been found. I have no idea how to get rid of this thing… the icon in systray is a red triangle with a white “!” on it. Maybe it’s a different virus? any ideas?

By Brian on Apr 18, 2007 | Reply

Hey Eric, i’ve been fighting with this spylocked for the last few days here and got it down to the blinking icon in the taskbar left. Your czxtyx.dll is your culprit. change its name and kill it to fix your problem. good luck

FYI: For anyone else if it helps. the culprit dll that it was for me was 8 KB. hopefully that narrows your searches and choices.

By hale on Apr 19, 2007 | Reply

I tried to REGEDIT at RUN, but during type in this REGEDIT, computer becomes blinded and rebooted. Computer doesn’t give me time to type in manually nor of automatic download. Please help.

By Tom on Apr 20, 2007 | Reply

Thanks, this was very helpful. Now my system is back to normal, except that aprotectservice.com is my homepage in internet explorer, even when i reset my homepage. How can i correct this please?

By Nick on Apr 21, 2007 | Reply

Hi,
I just got done being raped by spylock and thanks to the few responses on this forum I think Im safe. I dont know much about computers but here is what I did.

1)I first made sure the spyware program was deleted THEN all that was left was that damn blinking icon by my clock.

2)I did just what Eric and Brian said and that was do a search for *.dll

3)When the search is over I sorted the list by date and sure enough I found that file they mentioned: czxtyx.dll

4)I right clicked on the file and said rename and renamed it to czxtyx_f_off.dll and hit enter to save. At this point the icon stopped blinking BUT was still there.

5)I dragged the file onto my desktop BUT it wouldnt let me delete it. THEN I restarted my computer and when it was back in windows the icon was gone and I just deleted the file off my desktop.

6)FINAL note, Im no expert here but I wouldnt be surprised if the file name czxtyx.dll is changed to something else in a day or so by the hackers, so just be on the lookout for that and DONT go messing with files until you get a confirmation by others regarding the new file name to look for.

A final word I have to add:

Microsoft can burn in hell, they were no help
McAfee can burn in hell, they are even less help
Spyware fags can burn in hell
LAST, BUT …………………………………………

Thanks however to Eric and Brian, they solved the problem with the least trouble and as far as I can tell Im safe. That being said, after this disaster I know I cant trust anything, not even so called virus protection like McAfee.

By Ian on Apr 21, 2007 | Reply

I had the same problem as everyone above. None of the files listed were in my system32 folder, but I still had the flashing icon and the pop ups. I finally found the one bad file searching the dll files. Mine was czxtyx.dll. I renamed it and deleted it. No problems since. Pop ups gone.

Ian
Georgia, USA

By rhow4 on Apr 23, 2007 | Reply

Hi!

Another dll for spylocked…”rcohty.dll”; just renamed it and delete.

also guys thanks for the help.

FYI!

By tita on Apr 23, 2007 | Reply

Hey I got this virus today, gladly got rid of it manually. The file name was ilmpjy.dll.

Tita,
Brazil

By zeena on Apr 24, 2007 | Reply

Hey,
Got the virus two days back, got rid of it today, thanks to tita’s post. The name of the file is ilmpjy.dll

By Same Story on Apr 25, 2007 | Reply

hi zeena

got ilmpjy.dll today and successfuly delete it.
just out of curiosity, since we cant rely on the filename (it seems like an auto generate character) and date (different with every infection), maybe we can recognize it through the size?

btw, mine was 8 KB (8,192 bytes)

By vikki on Apr 25, 2007 | Reply

Hi ,

I followed the removal tips and deleted it, the icon has gone.How do i know i am safe to shop online again for sure!

By Ian Hector on Apr 26, 2007 | Reply

The evil little bugger in my computer was also ilmpjy.dll.
Spent the money on the automatic removal tool which deleted everything except the flashing icon! I would definatly advise the free scan …..

Cheers Asad, brilliant method!
Aberdeen, Scotland.

By Nate on Apr 26, 2007 | Reply

THANK YOU ASAD!!!! You rule!!!! I’ve been trying to get that out of my computer for 2 days with no luck until I tried your method. Just a heads up, the ‘bad file’ in my system was ‘ilmpjy.dll’ I renamed it ‘bad file’ and like the other guy said, it changed the icon immediately, so I knew it was it. I don’t know if it changed the date or what, but I infected my computer yesterday, the 25th, but the file was dated April 23rd, so look into a few days before you got infected in your .dll files if you can’t find it on the day you were infected. P.S.-these people should be banned from using the internet and their company shut down. Oh yea, and here is the domain info for them if anybody can do anything with it:

Registration Service Provided By: ERDOMAIN.COM
Contact: 49.1797458539
Website: erdomain.com

Domain Name: SPYLOCKED.COM

Registrant:
Privacyprotect.org
Domain Admin (contact@privacyprotect.org)
PO Box 83-000
Johnsonville
Wellington
null,6440
NZ
Tel. 45.36946676

Creation Date: 19-Feb-2007
Expiration Date: 19-Feb-2008

Domain servers in listed order:
ns1.wildgadgets.biz
ns2.wildgadgets.biz
ns3.wildgadgets.biz

Administrative Contact:
Privacyprotect.org
Domain Admin (contact@privacyprotect.org)
PO Box 83-000
Johnsonville
Wellington
null,6440
NZ
Tel. 45.36946676

Technical Contact:
Privacyprotect.org
Domain Admin (contact@privacyprotect.org)
PO Box 83-000
Johnsonville
Wellington
null,6440
NZ
Tel. 45.36946676

Billing Contact:
Privacyprotect.org
Domain Admin (contact@privacyprotect.org)
PO Box 83-000
Johnsonville
Wellington
null,6440
NZ
Tel. 45.36946676

Status:ACTIVE

By Spiros (gr) on Apr 27, 2007 | Reply

Dear fellows,

your observations was invaluable and I want to thank you all.
Now take into account my contribution on the method that it is being used to infect our systems:
a)Opening a malicious webpage, a program is executed in our system.
b)This program drops a malicious dll file in %windir%\system32 directory.
c)Gives the following attributes to this file: s,h,r.
d)Then it creates two entries in the registry:
One for the class of the malicious object and a second one, which is the command that loads the malicious object during OS startup. The registry key, that uses for the second entry is: .
In this key it adds a new parameter named by the class name of the malicious object and having as value a random name – so from this point, working reversely, you can find the name of the class and then the name of the dll.
As an IT consultant I have never dealt with this key, but it is at least as old as windows98.
Best regards to all!

By Tim on Apr 27, 2007 | Reply

If you still have the system alert popup try to see if you have bpvol.dll or splug.dll, if you do have it try to remove them, hope it solve your problem.

By Matt on Apr 26, 2007 | Reply

Hey! I’m knew to the thread, but wanted to thank everyone for all the helpful info. Also wanted to share my experience so it can help everyone else who happens along too.

At first I tried to play it safe and downloaded an automatic removal program. Tried Spyware Doctor first. It found and deleted over 100 infections. Then I tried Spyware Hunter second. It found and deleted another 50 or so. Still the flashing icon wouldn’t leave!!! So was it waste of $60? Yes and no. It saved time not having to delete 150 infections myself; I played it safe and didn’t screw up my computer more, and now I have two (seemingly) decent programs to protect my computer from here on out.

Then I found this discussion and tried look up all the new dll’s manually. I couldn’t find ANY of them on my comuter!!! Frustration abounded!

I ended up taking the advice of a few people here and sorted the system32 folder by date. Luckily I knew EXACTLY when I was infected and found two files that matched down to the minute. Both were called “tmp.” One was a text file, the other a registration entry. I deleted them and rebooted my computer and now the flashing icon is gone!!!

Hope that helps anyone who’s struggling with the stupid infection as much as I did!

Matt

By Jennifer on Apr 28, 2007 | Reply

I had the same problem with the blinking icon on my taskbar and found the file ilmpjy.dll searching through the .dll files, renamed it and the icon automatically changed to a blinking cloud with the ?, so I looked for other dll files installed on the day I was infected renamed them and deleted them because the first one could not be deleted then rebooted and the icon is gone. I don’t know if I’m completely free of this virus but I hven’t had no more problems ever since Thanks to this forum and its participants.

By David (UK) on Apr 28, 2007 | Reply

The dreaded blinking icon
I had it too, but reading through something like 150 of your comments, sggested fixes I was getting confused and very frustrated that I couldn’t find anyof dlls mentioned
So I cheated. I used Symantec’s premium service and for €47 a little man called Simil cleaned my machine by remote control from 5000 miles away
Thank-you Mr Norton

By Melody on Apr 28, 2007 | Reply

It took me almost 3 hrs to remove this, and now it’s back to normal! Thanks guys!

By kel on Apr 29, 2007 | Reply

after a few days i finally got rid of EVERYTHING.
i even went out and bought a new anti virus thinking at would get rid of it.
i ended up having the newer .dll

thanks for all the help people!

By David (UK) on Apr 29, 2007 | Reply

A History
I got infected by thinking I was downloading a video codec. Wrong ! The spyware was tagged to it
The first thing I saw was the 2 icons, the yellow & the bloody blinking one
Searhing the files, I found a program folder called Video AX Object. Tried to delete, access denied !
Having Norton Internet Security 2007 on board, ran a full systems scan, which found it, and with a lot of internet traffic from Symantec, most was removed, but not
the f**king blinking one
Next I came to this page, I am no slouch, I cut my teeth on Machine Code & DOS but finding these dll’s, no way !
I tried most of the suggeted fixes, but couldn’t find any
of the dll’s described by Microsoft, Assad & others
By now it is the “Wee Small Hours” and getting desperate
So, I got on to Symantec help line, a “chat room” (free)
and a lady there made a few simple suggestions to try,
which didn’t cure the problem, but it was like a medical
“triage”, she made me offer of handing me over to a specialist on their “premium service” for a fixed rate of
€47, so I filled in the credit card details
I was handed over to a guy named Simil, (Indian?) but he
was HOT; after a few extra questions, he asked for permission to take full remote control
For those who have never experienced remote control, it is weired; somebody, thousands of miles away, moving your cursor, clicking on files & folders, calling helper
programs so fast I didn’t always follow what he was doing
The end result was that he completely cleaned my machine
os all the “Spylocked” crap, but found a “legacy” of some
previous spyware I didn’t know I had

If all else fails, try them

By Joe on Apr 30, 2007 | Reply

Ok – So I’ve searched for ALL the .dll files listed above and even did the .dll “By Date” search and didn’t find anything related. The only .dll files that were added today (my infection date) were the ones for Symantec/Norton (which I purchased for this very reason…) I, too, still have that blinking icon with the pop-up warning. Did I miss something? HELP!! Thank you!

By Tim on May 1, 2007 | Reply

Here is another new dll from spylocked dxovx.dll, hope this will help.

By Joe on May 1, 2007 | Reply

Thank you Tim for that! I found it… strange enough, however, the date created/updated showed as being the day BEFORE I actually loaded the virus… so for some of you out there still struggling, please look for something possibly the day before…

Thank you Asad for you ingenious method to getting rid of that dratted blinking icon!

“This house is clean.”

Joe M.

By JJ on May 1, 2007 | Reply

would doing a system restore to the day before I got it and then deleting it from program files solve the problem? or vis versa?

By Tony on May 1, 2007 | Reply

New SpyLocked DLL:
bngwxqaw.dll
pmnlmlm.dll

By mia on May 2, 2007 | Reply

I agree with what Joe said. The .dll filename was created a day before my PC got infected… I found the dxovx.dll filename. I had to rename it before I followed Asad’s steps.

thanks a lot.

By Delmar L Graber on May 2, 2007 | Reply

well i need to get rid of virus please

By chris on May 2, 2007 | Reply

Thanks to all. This was all great food for thought.

I finally got rid of it all…I think!
I bought spyhunter which helped alot but it never did rid me of the Blinking icon. I decided to punch the icon and then rescan the registry with spyhunter.

Sure enough the Zlob stuff was back. Only this time I ran the regedit program (all Windows computers have this feature) and look into all of the Zlob stuff that spy hunter found. I kept the spyhunter window and the regedit window opened together.

One file spyhunter found was a dll file not listed above called ilmpjy.dll I suspect those evil creatures who create this stuff have some random file namer eh?

As UK David notes above, the other was in a folder Video AX Object and was an executable called “uninstall.exe”

I then had (or supposedly had) spyhunder delete the Zlob (et. al.) crap. Supposedly because it did not delete the ilmpjy.dll or the Video AX Object folder with the unistall.exe…

I wasn’t able to delete either of these under a normal boot-up so I went to safe mode (i.e., f8 on the re-boot) and deleted these remaining two things.

Eureka! I am now free from the blinking icon!

Not to pump but I’d say the $30 purchase was indeed worth it even if I had to do some labor of my own.

By Anna on May 3, 2007 | Reply

I’ve followed all these removal steps, but there was one thing that I found in search that I can’t delete, my computer won’t let me, it´s in hidden files or something. And that annoying bubble thing keeps popping up.

By David (UK) on May 3, 2007 | Reply

This damn thing is contantly mutating
Those who are searching by time be aware these
bastards are in Riga, at UTC 2
so be aware of your geographical location (Joe)
I did download the full version of Spyhunter,
which didn’t solve the problem, but has picked up
some spyware “cookies” since, so it can stay on
my machine
Norton can trap virus & worms but not always
these spyware/adware infections
If you are already a Norton customer se my
blog a history
David (UK)

By Beigeman on May 3, 2007 | Reply

..wow..that took long enough..but i finally got rid of it…
THANK YOU ASAD!

By dave on May 3, 2007 | Reply

i found ‘lcsrsrv.dll’ and can’t remove it from the folder, CMD, Search Files, or Ad-Aware….any suggestions? and i have no money.

By Beigeman on May 3, 2007 | Reply

[dave:...i suggest you use asad's thing...]

i messed about in the registry nad eventually it actually let me delete the files in my “Video AX Object” folder which was causing me problems. If anyone else has in this folder “bpmini” and “bpmon” they are very annoying, i woudl be careful trying to simply end them in task manager, because for some reason they sometimes jsut start multiplying like crazy, i had just task manager left by then end, and 450 odd “bpmini.exe” files all running at the same time.
also, when you just scan with spyhunter and remve manually like i did you may find that deleting “rare” and “user32.dll” doesnt really work because they come back.

you need to see which one of the files in your “video Ax object” folder is making them come back, and mess around until it lets you delete that, or move it and rename it.
The annoying thing is that this only happens if you catch the file on the exact moment it jumps around. because you may notice in your task manager that the processes jump around because they are constantly opening and closing.
Once all the files from the “Video AX” folder have been deleted or moved, thats when you can delete things from the registry without them coming back every time you look away or restart your computer.
Once you have gone through and gotten rid of alllll that, i had about 63 Zlob trojans come up, you can then focus on the blinking icon next tothe clock [assuming you've taken care of any backdoor or anything was attached to the virus]
then just use the list of .dll files at the top of this page and search windows, it is a tedious process, but in the end you probably will get a result. then you want to make sure you note the file location (probably in the “system32″ folder) then use Asad’s method, and all of the components ( that i know of so far) should be gone, and everything seems fine again.

** please note, only “mess around” in the registry if you are confident you wont mess up your computer. and also that i started out with an infection from a fake video codec and did not go on to install spylocked from the website.
I hope that this actually makes sense to someone, and i wish you all good luck in sorting it out… =] took me 6 hours and 43 minutes, i think theres better but i was just learning about everything as i went.
remeber, please dont risk damaging your computer further, if you are not comfortable messing about with your system like i did, then please dont, if you think its worth downloading a program to get rid of it, then do that instead.

also, (i swear this is the last bit) my freind had exactly the same thing on his computer and he donwloaded webroot-spysweeper and he said that that cleared it up for him, not that its £40 from the english website and $40 from the american site, with a £2 (ish) bank conversion charge, so if you live in england and want it, you can get the full anti-spyware and virus package for about £20 cheaper, although dont quote me on that..
=] good luck.

By Beigeman on May 3, 2007 | Reply

..oh and sorry about the bad spellinh and grammar, and not making sense….
you may need to use your imagination…hope it helps sum1…
1: “rare” and “user32.dll” come up when you scan the registry, they are not in the video AX folder, that may have been a bit confusing…
2: and urm..where im on about webroot, (i hope im spelling that right) i meant say say “note” as opposed to “not”

By Anna on May 3, 2007 | Reply

I’ve been going on since yesterday and finally I think that I’ve gotten rid of this shit. I finally found dxovx.dll located in the system32 folder, renamed it and deleted it…and no pops up, no extra toolbars on the explorer and no strange homepage. Just hope that it’s all gone.
Thank you so much for all your help everyone;)
Curious: how do you all think about PC-cillin, good product or what?

By PlumberB on May 3, 2007 | Reply

It looks like after 3 nights of work and three anti-spy programs, I am rid of it…for now. First I downloaded the SpyHunter free program and couldn’t make it run. I guess explorer.exe was rebooting every 5 seconds and confusing it. Next came No Adware…nope, it wouldn’t run either. Paid for Spy Doctor, was able to start it; it found 190 different items, supposedly fixed them but it was no help. Finally, I was able to run NoAdware somehow and it started finding the stuff. I paid for the registration, got rid of the crap, rebooted and, what do you know? Windows Defender found and got rid of some crap (but not the icon)!

I re ran Spy Hunter and it found dxovx.dll, I deleted it and finally dumped the icon. Spy Hunter says there is more in the registry files but I am to tired too look tonight!
What a nightmare! Three anti-spyware programs, windows, Norton, a hundred some cookies removed, a hundred or so more files, who knows how many registeries yet, and finally it seems to be dead or dying!

Thanks for everyone’s help. I don’t think I would have had to courage to dig into this thing without it!

By Jamin Quimby on May 3, 2007 | Reply

LAME-N Directions

FOR WINDOWS VISTA

open CONTROL PANEL
goto Administrative Tools
open EVENT VIEWER
on LEFT PANEL goto Applications
on TOP MIDDLE PANNEL look for a RED exlimation point
ERROR will look something as follows

Faulting application Explorer.exe, version 6.0.6000.16386, time stamp 0×4549b091, faulting module dxovx.dll_unloaded, version 0.0.0.0, time stamp 0×46334053, exception code 0xc0000005, fault offset 0×030f1950, process id 0xa8, application start time 0×01c78e039e4ce2ce.

THE FAULTY MODULE is dxovx.dll

open INTERNET EXPLORER
hold down CTRL-ALT-DELETE
select explorer.exe then END TASK
in the URL ADDRESS of internet explorer type c:\
Browse to c:\windows\system32

search for DLL files above and hit delete.
For me it was dxovx.dll

By Tim on May 4, 2007 | Reply

Here is another SpyLocked dll
rcohty.dll

By kitty on May 4, 2007 | Reply

i do not know how to do any of these. well i do, but i’m not sure and i don’t want to hurt my laptop. i tried to download the spyhunter but it won’t. and i did the “run” “cmd” but i don’t know how to change it to just C:/. help!

By dave on May 5, 2007 | Reply

ok, its been 2 days since my system is infected by this spylocked. and yes, i did download the spyhunter and it got 3 zlob thing… on the registry, and i did delete the entry, after that i tried all the dlls above until the end of this thread, but no thing seems to be found anywhere, and still i got this damn system alert pop-up on my tray, need some help here…

By Beigeman on May 5, 2007 | Reply

kitty,
okay…your default command prompt will have something like
“C:\documentsandsettings/ your username:”
to change that type in “cd c:\t”hen wherever you want to change the thing to look in
remember when youre changing it to c:\ that if you want to look in a folder, like the system 32 folder you will have to type
“cd C:\Windows/system32″
note how you have to use the other slash.
if you cant get spyhunter to work try to go to the “how to remove zlob” page and download the scanner bit of it, if you just have the detection utility. then select “scan” from the bar at the top, and select from one of the options, for some reason mine wouldnt let me scan everything. probably need to pay for that. but you can try it.
hope that helps.

dave,
you probably have a .dll that isnt on the list then yet, and they seem to have come past the point where they they let you see what date it was created, because mine was from “25th dec 2006″ and i was infected on the 3rd of april this year…you7 can always try looking for .dll’s that were made on the day you were infected. if the search isnt picking anything up,. go through your system 32 folder by hand (i know its tedious) and see if you can find it, then try to delete it, it probably wont let you, but then your system will probably be able to find it when it couldnt find it before, i dont know why that is, but thats what happnened to me, so give it a go. apart from that i have no idea,

im not really an expert, just trying to help people after i got it, from what experience i got. hope i help. =] good luck all

By Beigeman on May 5, 2007 | Reply

..above urm..not type “cd c:\t” but type “cd c:\”

By JohnB on May 5, 2007 | Reply

Thanks to the collected methods on this site I was able to get rid of this Junk.

Searched on suspected date in C:\WINDOWS\system32 and found ilmpjy !!!!!! and it was 7K in size as suggested by another post. I did get the message that ‘File cannot be found’ when I tried to delete it but this was because iexplore.exe had restarted again. Keep 2 windows up, first with the delete of offending file ready to hit ENTER and Task Manager ready to end iexplore.exe

I did not have to do ANYTHING else. So, this method is suitable for anybody ….. I think. No need to pay anybody except to say THANK YOU again to all positive contributors.

How does one legally go after these Bar stewards ?

By Beigeman on May 5, 2007 | Reply

to chnge cmd to just say c:\
type into it “cd C:\”

By Beigeman on May 5, 2007 | Reply

http://www. cybercrime.gov/
lets try searching around on here, see what can be done about this, all i can offer at the moment.

beigeman =]

By Beigeman on May 5, 2007 | Reply

hurm…there’s nothing in the computer crime bit about viruses…and i’m pretty sure that they’re illegal, does that mean they’re illegal but nothing can be done about them??

By Beigeman on May 5, 2007 | Reply

fine, lets email privacy protect then
who they are using to cover up thier domain details, as seen in one of the above posts, lets see what response i get from this:

“Hello there,
with regards to “www.spylocked.com”
this webiste is (it seems) using your service to restrict its details, to cover up criminal activities. They are offering a rogue antivirus, and infecting peoples cmputers with worms and trojan files, in an attempt to scam people into buying thier product. By withholding their details from the people who are trying to get rid of this harmful material from their machines, i do believe that constitutes as withholding information about criminal activities, which I’m pretty sure is illegal in as many countries as you would care to imagine. Considering this, it may be in your best intrests to remove this website and others that might be suspected of also being involved in criminal activities from your service.
Just a freindly heads up, in case you werent aware of this problem.
If this is some mistake and this website is not using your servie then i apologise, but i hope that you will look into it further to try and help out the people who are surfing the internet, as it says on your website: “Protect Yourself” – this part of your service is not being fulfilled if you allow splocked.com to continue to use your service.
Yours,
Richard.”

wish me luck people, lets try to get these people of the internet to stop this happening tomore people =]

By Beigeman on May 5, 2007 | Reply

okay..that didnt work, automated reply, worth a try,
it lets you contact their customers from their page,

“http://www.privacyprotect.org/”

thats the site, but i cant really do anything with that, i dont think these guys are going to really care if i send them a nice friendly emial asking them to stop somehow….
anyone can take it further than that and get rid of them, feel free.

By rachel on May 5, 2007 | Reply

hi guys. I managed to get rid of dpylocked from my computer, but it seems to have caused a lot of damage to it! my comp will not connect to my usb ports, saying that there’s little or no connectivity! what should I do? thanks a bunch.
rachel

By Becky on May 6, 2007 | Reply

If the icons and those flashing “warning” stuff are gone, is it safe to say that i got rid of spylock from my computer. Also, how can i check for damages it’s done the time it was on my computer? I would really appreciate your expertise and advice! thanks

By Tim on May 6, 2007 | Reply

Here are more dll from spylocked or zlob.trojan:
egzcqg.dll
xuoce.dll

By Mette on May 6, 2007 | Reply

Thank you all so very much. I’ve struggled trying to remove Spylocked all week and finally it worked.
Thanks to Ryan for his very helpful guide.

By haleks on May 6, 2007 | Reply

I was infected by the Video AX Object, I deleted the Video AX Object with Avenger, and afterward I did a System Restore, run RegCleaner, and now everything seems to be fine…

Do you think it deleted all the infected files?

I scanned once more with SpyHunter, and it didn’t find any parasite… does that mean the PC is clean or there chance i’m still affected?

By kook on May 8, 2007 | Reply

i just got this annoying spyware thing i removed all of it by just going through my registry and like the site says click search type spylock then i just deleted all the files that came up..job done

By Marissa on May 8, 2007 | Reply

i was infected so i did a system restore, and it got rid of it, but to make sure it was gone i ran spyhunter and it found two files left, so i went manually and found them and deleted them. Ran spyhunter once more and it said they were gone, but how can i be sure that they are really gone?

By Mark R on May 9, 2007 | Reply

It was the xuoce.dll in my case. All that was happening was the flashing icon in my Taskbar, with the Popup reminding me that my system was “infected” (kind of an irony when you think about it!) – more of an annoyance than anything else. But it’s SO nice to be rid of it! Thanks to all who’ve put forward their solutions…..

By gman on May 9, 2007 | Reply

It was xuoce.dll on my system as well

By Scott on May 9, 2007 | Reply

3 hours and a little bit of research. Found in problem in C:\Windows\System32 renamed xuoce.dll to 1xuoce.dll and the icon changed. Rebooted and the icon is gone. Deleted the renamed file. Searched the registry for xuoce.dll and deleted the registry key that was hosting the little bugger. Done. Updated virus and spyware defs and ran a full system scan. Cleaned.

By Phil on May 9, 2007 | Reply

Ummm… thanks guys for all the good tips. I deleted some reg entries that came up on the Spyhunter scan. Am I right that you just find those entries and delete them? and ummmmmm… if you delete one extra by mistake, is there any going back? bec now my version of IE doesnt seem to work so well…thanks
Phil

By s.murugesan on May 9, 2007 | Reply

please help the spylock more distrub my computer please remove

By Tim on May 10, 2007 | Reply

SpyLocked 3.7 is hitting the web now, with these two dll: kgkdbsk.dll and antzozc.dll

By Tanweer Shah on May 10, 2007 | Reply

SpyHunter is good . I think it will remove that icon from sys tray . I started the scan and it found many spywares i think the spyware i am looking is there in the list. I removes them by it.

By Domie on May 10, 2007 | Reply

Hey guys, its great that we have this lil community here, alright so yesterday I was stupid enough to download this fake codec. Anyways I got all these problems, and got tuts on how to remove it, well I downloaded SmitfraudFix. A program that helped remove this spyware, well it worked for the most part and I didn’t get that fake virus notice anymore. The only thing I am still having troubles with is my IE. It stills seems to affect my internet browser. I am still able to go to another webpage with no problems but then I am not comfortable with the fake Protection Toolbar on my IE. Other than that I see no other action from this virus. If you guys could spare some details on how to fix this problem it would deeply be appreciated. Thank you.

Btw, I have none of these dlls on my system.

By Kyle on May 10, 2007 | Reply

Hi everyone. I recently received this virus and followed just about every single step that you all have posted including unregistering and deleting some .dll codes and files. My solution was to use system restore, this turns out to be a pretty week virus and is easily removed with system restore. All you have to do (using vista) is go to start, and type in “system restore”, and set the date for before you received this virus. It works, but that might just be me, but it’s worth a shot I highly doubt it will slip through anyone’s system restore.

By jason on May 11, 2007 | Reply

ive also found an easy way to get rid of this annoying virus.
i have cyberscrub installed, all i did was,
start – search – all files and folders,
local hard drives-
first search for spylocked take each one and erase beyond recovery (the pc may restart)
use the spyhunter download to determine the “dll” file infecting your pc, then
do above again, put in the “dll” your looking for, in my case it was “kgkdbsk.dll”
once found erase beyond recovery again, restart pc,,, virus gone.

By Thomas on May 12, 2007 | Reply

I am getting the same results as kevin
Spylocked has been removed
but the flashing icon is still there
and my computer is drastically slower
i need serious help

By Debbie on May 13, 2007 | Reply

I never imagined I would be able to do this, but I followed the guides and got rid of some stuff. It was a different one on my computer though, there was the kgkdbsk.dll, and there was also spylocked3.1_ssfsig.dll, which I didn’t search for initially. However, I am still getting a pop up (not as often though) and a system performance monitor alert. Also, when I open the internet, it still goes to the spylocked website-but I can go to other websites. Any more ideas to get rid of those last couple things?
Thanks.

By Stu on May 14, 2007 | Reply

I moved the dll file (xuocc.dll) to the desktop, renamed it xuoccXX.dll, deleted all cookies then restarted my computer and all was good. There’s probably some mess still lurking around, but nothing pops up, my homepage is no longer highjacked and the annoying blue question mark has gone. Thanks for you help everyone.
Stu

By Tim on May 15, 2007 | Reply

uimcu.dll is another dll from spylocked.

By Brian on May 15, 2007 | Reply

DTJBY.DLL is a new dll for SpyLocked.

By Caolan on May 16, 2007 | Reply

i found the ‘uimcu.dll’ file and renamed it ‘badfile.dll’ but when i try to delete it in cmd, it says access denied, please help.

By Judas on May 17, 2007 | Reply

Gracias Por Todo.. Me Sirvio Mucho !

Tanks for all.!

By caolan on May 18, 2007 | Reply

its ok, i deleted it but now and again strange porn pop ups keep comin up and AVG keeps finding the zlob virus

By Caolan on May 18, 2007 | Reply

i found the zlob trojan which causes spylocked and pop ups within program files and proptly deleted ‘iesbpl.dll’ ‘iesmn.exe’ ‘iesbunst.exe’ ‘imsmain.exe’ and ‘imsunst.exe’ but the ‘imsmn.exe’ process is still runnin, should i delete this file too even though AVG cant find anything wrong with it?

By King on May 20, 2007 | Reply

I had uimcu.dll and followed instructions of opening cmd prompt and deleting above file from system32 folder and it worked ..relieved

By Brian on May 21, 2007 | Reply

SpyLocked 4.0 is the latest version. Make sure that you remove the latest offended files.

By Tim on May 23, 2007 | Reply

Here is another dll from Spylocked indwvm.dll.

By Tunde on May 23, 2007 | Reply

Tim,

You have done well by mentioning the indwvm.dll, It is actually the latest file. The best way to go about it is to use Asad method. i.e via cmd prompt and killing eplorer.exe temporarily then issue the del command. It works perfectly.
Note: You might still have issues like the file could not be found when you place the command, You may try rename the file and try it again. If it doesn’t listen. Delete it from windows. It should work well. Regards.

By Steven on May 23, 2007 | Reply

OK .. I’ve gone through all the post and tried all the ideas with no luck. ALl the files listed are not on the CPU. My flashing icon is an ! in a Yellow Triangle and the other Flash is an DirectX icon. I just need to get rid of this flashing ICON then I’ll be all set .. Ideas ???

thanks!

By Sean on May 23, 2007 | Reply

When i try to end the processes, it just comes back up. Can anyone help?

By zemo420 on May 25, 2007 | Reply

I deletd the infected file indwvm.dll which i found using AD-Aware se personal which by the way is free. the icon on the right hand corner is gone. I followed so many different leads that I don’t know who to thanks. thanks to everyone for all the input.

By Tim on May 25, 2007 | Reply

Another dll from SpyLocked viuaoq.dll

By Ben on May 26, 2007 | Reply

Quick question. I have been getting crazy pop ups, so I got spybot search and destroy and the only thing that it cannot fix is Smitfraud, any thoughts?

By Asad on May 27, 2007 | Reply

Hello everyone, after such a long time of being away!

This forum has grown about 60 times since i was here.

The person (who i can’t remmember) that found a way of getting rid of it using the rename and restart procedure, it is a good idea. So many thanks on pointing that out.

However if you don’t want to restart your computer, use my way of deleting which is to stop explorer.exe and delete it from CDM (using DOS commands) – For more details on this, go up and find my posts.

The dlls that i found long time ago, was from another website called:www.bleepingcomputer.com/forums/topic85376.html and go to the very bottom looking for the posts of a person called Grinler. But DO NOT use the instruction on that website as they are very complex and time wasting ideas. They also suggest using a program called smitfraudfix.exe which i think is a virus itself as when i did a virus scan with AVG Anti-Virus, it was in the dangerous category so i deleted it.
All i am trying to say is WATCH OUT!!!

I think we should all spam in anger the spylocked website and continuasly ask help from anyone with a legal status that controls the web to destroy the website!!!

PS.

I writing from Ballarat, VIC, Australia
and i am also 16 years old.

What about you guys?

By Larry on May 28, 2007 | Reply

After spending a day pulling my hair out, I finally got this bugger off my system thanks to the many numerous suggestions I found here. What worked for me was using Spy Hunter to scan (free), then without closing it down I did a regedit in run, working through the menus to remove everything but the cookies. I used ad aware to get rid of the cookies and now all is fine. Phew. Thanks again to all who posted with ideas.

By Larry on May 28, 2007 | Reply

I wanted to add something to my post. I am very impressed with Spy Hunter and am strongly considering purchasing it.

By ken variya on May 28, 2007 | Reply

GO TO SYSTEM 32 FOLDER

SORT ALL DLL BY SIZE(YES SIZE)

SPYLOCKED BASED DLL SIZE ABOUT 7 KB.( i had indwvn.dll)

LOOK DLL PROPERTY. IF IT IS UNKNOWN.(NOT MISCROSOFT CORP)

RENAME IT.( ICON WILL CHNAGED -DIFFERENT LOOK)

LOG OF

AND DELET IT.

REBOOT.

ICON WILL BE DISAPPEREAD.

TRY THIS.

PS. USE PC CILLIN INTERNET SECURITY.THIS ONE IS TOO GOOD.

By Spiros (gr) on May 29, 2007 | Reply

Dear fellows,

I completely agree with Asad to take action against them.
From my side, I have sent a message to Google asking them to stop advertise them, but in vain!! Google is blind.
Please send messages you too, perhaps they’ll wake up and remove them from their lists.

Best regards

By Stephen on May 29, 2007 | Reply

hey,
just wanted to say that i had the EXACT same problem as ken variya. so basically i think you’re the most amazing person in the world right now. the only difference was that my file was named indwvm.dll. so i recommend trying to fix it the same way as he did.

thanks ken man you ROCK!

By Asad on May 29, 2007 | Reply

Hello.

The people here that didn’t understand how to remove the spyware, i was trying to get the popup back to my computer and make a video of my screen removing it.

I went to their website and downloaded the program and installed it. The strange thing however is that the popup was not on my computer. It seems that the popup only goes to your computer if you install the fake video codec.
Spylocked i think will defend their case by saying they had no idea of an spyware as they dont have it on their explorer. But I say that they purposely put the spyware on the video codec so it wouldn’t seem their fault and at the same time get away with it.

Rather than all these 150 posts to read from, yes I am talking to you new people, Why doesn’t anybody that has an idea just make a video of them selves removing it using hypercam because it would be much easier to understand.

By Asad on May 29, 2007 | Reply

The post above, i meant to write “they had no idea of any spyware as they dont have it on their installer”

By Harry P on May 30, 2007 | Reply

Solved the icon problem with the help of many on this site thanks! What worked for me was Ken Variya’s tip on the file size. I cross checked all .dll files of 7 kb in the Windows/system32 with the date I encountered the problem. Found only one (in my haste to delete I forgot to record the filename but it was none of the ones previously mentioned, sorry). It was close to the date but not exact (file was 5/22 vs problem date 5/25).
I renamed the file to “.doc” from .dll and the icon changed to word doc. I dragged it onto my desktop and rebooted. Icon gone!!! I then deleted the file ignoring a warninmg that it is a system file and may cause problems. Relief!

By Dan on May 30, 2007 | Reply

Hi, my computer got infected with spylocked 4 and i’ve tried everthing mentionned on this forum and i still have problems. Since my computer havec infected by spylocked i can’t use windows update. It always said that i have install activeX…each time i installe it and it does’nt seem to stay installed at all cause i still get the activeX message…is anyone know something about this situation??

By Poket on May 30, 2007 | Reply

Thank to Ken Variya, I have solved my computer problem.

File was in Systems32. Sorted files by Size. Found .dll that was exactly 7kb. Renamed, restarted the computer, and deleted the file.

viuaoq.dll

Was my infected file. I used Spyhunter (free version) to find files and I went through myself to delete each individually. Time consuming, but effective. Thanks for everyones help and assistance.

Good luck to everyone

By Cordria on Jun 2, 2007 | Reply

After six hours of work… IT”S GONE!!!! With mine, I had no .exe processes in the task manager and no .dlls that I could find.

Here’s what I did…

First: I ran my OWN spyware killer (Spy Sweeper) to get rid of the trojan.

Next: Downloaded the free version of SpyHunter and ran it to find the registery names.

Third: Opened up the registery editor (Start Menu -> Run -> regedit) and manually deleted ALL the registry keys that SpyHunter had found.

Fourth: Re-ran SpyHunter and it came up clean. *sweet*

Fifth: Opened My Computer and searched for all .dlls modified in the last week. Only one came up that was a system32 file that was 7kb (it was pkjcoxq.dll if you care, but they seem to switch so fast it doesn’t matter…)

Sixth: Renamed it to pkjcoxq.doc (warning: system file! Ignore that.) and moved it to my desktop. (the icon should switch from a triangle-thing to a blue ?)

Seventh: restarted

Eight: deleted file from desktop and the STUPID BLINKING ICON IS GONE!!!!!

Ninth: I’m rescanning my computer, but it’s almost done and it’s looking good…

Cross your fingers that I got it all… and GOOD LUCK TO YOU!!!

-Debbie

By mladen on Jun 2, 2007 | Reply

another bad file: “eeuydc.dll”

Good luck.

By Chris on Jun 2, 2007 | Reply

I just got spylocked this morning, and it took me 8 hours to get off, but thanks to these replies i finally got if off… My problem is my computer is insanely slow and it won’t go anywhere, i had to go to safe mode to do anything, if i’m not in safe mode and click on internet or even the start button, it locks up for 15 minutes… Does anyone know what could be wrong? The blinking icon is gone and i find nothing else, but it’s been so slow ever since it got on my computer.. Please any help would be appreciated

By Rocio on Jun 4, 2007 | Reply

I’m very close to loosing it so please help!
I’ve been infected with Spylocked4.1 and have found ‘eeuydc.dll’ in the c:\windows\system32 directory I can only run DOS but does not let me rename or delete the file. I constantly get the following two popup window messages.

1. ‘Windows explores has stopped working’
followed by
2. ‘windows explorer is restarting’

These keep appearing one after the other whether I click on cancel or not and while they’re up I can not access anything on my computer so I can not rename the files through windows or install spyhunter or run any other program. Can not open control panel, my computer, search, nothing except for DOS and Task Manager.

I have read the entire site and tried several of the suggestions… But I still can not solve the problem.

If you have any suggestions I would be forever thankful!

Rocio,
California

By Andy on Jun 4, 2007 | Reply

Wow! I am new to the intricacies of computers
but thanks Asad. I followed your instructions (once I figured out how to open the task Manager!) and resolved the pop up problem!
Thanks again!

By Paul on Jun 4, 2007 | Reply

Ditto that. After going through the whole list of dll files with little hope I found one (eeudyc.dll) and followed Asad’s instructions and the flashing icon is finally gone. Also noticed that a spylocked process started again, though I thought I had removed it using (paid) version of spyhunter, possibly when I tried deleting the .dll file directly, or could the icon itself be the cause? I stopped the process then followed Asad’s instructions. Registry files are clean! Checking regular files. It’s so satisfying when you work long and hard and finally something works the way you were told it would!

By Sam on Jun 5, 2007 | Reply

RYAN DID IT!! NEW FILE NAME PKJCOXQ.dll was in system32 folder. had to rename it. icon DID change. restarted computer and deleted renamed file (changed it to .doc) We’ll see what happens next. I see a common thread: system32 folder, .dll file ext, and 7kb file. Also it was dated 12/21/2004. I got it 6/3/07.

By Sam on Jun 5, 2007 | Reply

IMPORTANT NOTE: When you right click on the .dll file, you won’t see a “version” tab. That’s how I knew it was a rogue .dll file

By lakagna on Jun 5, 2007 | Reply

Cordia, Thank you very much !!!

I followed your steps and that idiot stupid icon IS GONE !!!

Thanks God there is an Internet.

By dan on Jun 5, 2007 | Reply

cheers to all of you for the advice on this page, especially ASAD and CORDRIA

finally got rid of that annoying icon

the latest .dll seems to be *eeuydc.dll*

By Carl on Jun 5, 2007 | Reply

This site is great. Mine was eeuydc.dll as well. I already had Sypware Doctor and it fixed everything except the blinking icon in the system tray. I found the file by sorting my system 32 file by date modified and found it, though it was actually dated a week early. I just used the trick someone recommended and changed it to a word file and moved it to the desktop, rebooted and deleted it. Works great now. I recommend Spyware Doctor by the way, it has protected me from crap like this except when I get in a hurry and hit the wrong button.

By penny on Jun 6, 2007 | Reply

i got the spylocked files off of my comp, but when i run spyhunter, some zlob trojans (registry only) come up.
I can’t seem to figure out how to locate them so i can delete them. What do look up to find them?

Iv been at this a while, so im getting really frustrated any help at all would be helpful…

By dave redman on Jun 7, 2007 | Reply

thank you for your smarts on a cumputer im still new at this

By dave redman on Jun 7, 2007 | Reply

this is a fast system

By dave redman on Jun 7, 2007 | Reply

how do i do this

By Hans on Jun 8, 2007 | Reply

Hi,
yesterday I removed Spylock with this very good instructions. Thank you very much.
There are now 4 other, new processes to stop and files to delete:

iesmin.exe
imsmn.exe
iesmn.exe
imsmain.exe

By Enak on Jun 9, 2007 | Reply

l got Spylocked through a fake ActiveX download.
Its the most annoying thing l’ve ever seen..

By Anne on Jun 9, 2007 | Reply

I used Ken Variaya’s method and managed to delete the dirty little trojan that turned up earlier this evening.

I was using XP in Parallels on my Mac, so imagine my horror when this bug turned up. I was positive that I’d already disabled my internet connenction from XP, but I think clicking and dragging a “live” file between systems may have done it. Hopefully I’m now error free, as I’ve suffered no other ill effects on either system since.

The file I deleted was named, MSVCR71.dll

By Anne on Jun 9, 2007 | Reply

Actually thinking back, I was trying to download an ActiveX control when the bug appeared, like the user above my first post.

By Janet on Jun 10, 2007 | Reply

Help! I have read all of the posts and was able to get rid of the spyware, however I still have that ANNOYING icon (blue question mark with red x, with “system alert” blurb that pops up. I have searched all of the .dll files and could fine none for 6/8, which is when I got the virus from a fake Active X download. Any suggestions out there?

By Johny on Jun 10, 2007 | Reply

Hi,

what happedned with my last post? I am quite sure I’ve posted here quite a long reply with my experience with this ugly malware, but now it is gone…

If it was deleted by administrators could you please send me an e-mail why? Thank you.

Johny

By Johny on Jun 11, 2007 | Reply

Ok, so once again (much shorter version):

I was infected dwo days ago, solved the problem yesterday. Everything failed and flashing icon was still there. Finally I used a “sort by date” method and found a strange .dll from day before attack (yesgnhr.dll). Renamed it and icon started flashing; restarted PC and icon was gone. Then I deleted it and celebrated

Malware software was called SpyCrush, but I am writing my experience here, because it is still the same SW, only with different name, and this thread is far longer (and better indexed by search engines) than the similar one on this blog.

Thanks and good luck
Johny

By David on Jun 16, 2007 | Reply

You people here deserve medals for all the hard work and contributions you make to helping remove locked spyware. Since last night I had been attacked by something called SpyCrush. I read many many of the postings and especially Asad’s contribution of Mar 27th, 2007. With his new infector file called “tahxqcj.dll”.

Well now I have downloaded SpyHunter and feel well pleased with it. But back to the problem, despite my existing Spyware removal program dealing with many files and the Registry and I also deleted files appropriately, that flashing icon in the system tray remained.

I wrote to SpyHunter and asked for their help. Then suddenly after looking at Asad’s posting I remembered my infection began around 21:30 last night and I went to the Windows/System32 folder and there was a suspicious file. It was called “tczij.dll”. I took what I thought was a huge chance and followed Asad’s instructions to the letter that he had written for that other file.

Sure enough my computer came back on fine and that total annoyance (the flashing icon and rubbish message in the system tray) created by this company that has little regard for the irritations it causes in this respect. It just infects us and walks away, who do they think they are. I even wrote directly to them to ask how I could remove this monstrosity, maybe they will reply later, we will see. I have since switched my computer off and then on again and all is great.

Thought I would post this just in case at this very moment someone, somewhere is about to pull their hair out over this marauder into our system tray. I did also write to SpyHunter to let them know also, and told them that my discovery was really down to this website and ASAD’s contribution in particular.

So once again it is time to say “Thanks ASAD, you have done it again” keep up the good work – we all appreciate your efforts on our behalfs.
David

By David on Jun 16, 2007 | Reply

Slight correction (addition) to my last posting!

Where I wrote:
“Sure enough my computer came back on fine and that total annoyance (the flashing icon and rubbish message in the system tray) created by this company that has little regard for the irritations it causes in this respect.”

please add after the word “respect”….

“..had gone!!”

You see they wind me up so much I cannot even finish a sentence correctly….!
Thanks.

By William on Jun 20, 2007 | Reply

Download and run Ad-aware-Se from Lavasoft.com.It has a free version of their software in the Home section of their web page. It does a nice job removing Spylock and Zlob. Select the on reboot route after the scan,since you can’t delete files of running process. After the system reboots Ad-aware-Se runs before spylock. Choose the smart scan selection (for brevity) or do a full system scan. Then follow the instuctions.

By rawr! on Jun 24, 2007 | Reply

can this be fix by just rebooting your pc?

By rawr! on Jun 24, 2007 | Reply

ok, i tried the Asad method,i can’t seem to to find that dll files. i also searched .dll since i got infected today two things came up. iesplg.dll iesbpl.dll there, i tried to delete that too, the DOSE can’t seem to find it…

By James on Jun 25, 2007 | Reply

Thanks to Asad and everyone else for all of your help. I got a new pesky dll file that caused my pesky little icon in the systray entitled “DOOEP.dll” Thank god I am finally rid of all that $hit.

By Joe on Jun 25, 2007 | Reply

Here are two new dll from Spylocked: afkvvy.dll and dooep.dll

By Martha on Jun 25, 2007 | Reply

This is just to say thank you people for the help you provide to us helpless idiots (just referring to my own stupid self). I have SpybotS&D and the TeaTimer utility that TOLD ME it was not safe to install that piece of “sh*t” but I thought was not a harmful thing.

Well OK SpybotS&D removed most of the malicious stuff from my PC except that annoying blinking cr*p and I found Jollie’s suggestion of changing the name to dooep.doc AND IT WORKED !! It was the last in the list. “dooep.dll”

Congratulations, surf safely and many thanks !!!

P.S. I could not dwld SpyHunter as my “safety configuration prevents it” ha ha ha ha

By Gato on Jun 25, 2007 | Reply

Joe, I’ve been searching and searching for the previously mentioned .dll files…I found afkvvy.dll but wasn’t sure…now off to delete it.

By Fred on Jun 25, 2007 | Reply

what is CMD?

I also have this red icon with a flashing white x in my system tray.

how can i get rid of it?

By Brian on Jun 26, 2007 | Reply

Fred, CMD is the DOS command prompt where you can enter the commands manually. It’s part of all the Windows OS and it can be accessed via “Start”, then “Run”, and then type “CMD”. You can try the manual removal instructions to remove the flashing “X”. It’s been suggested previously, if you go through the comments, to sort the dll’s and find the infected files by date or size. Either way works just fine. This is by far the most efficient way to remove this for free. However, if you don’t like to go through all this hassle and don’t mind to pay, purchasing Spyhunter is another option. Hope this helps. Good luck!

By Enrique on Jun 27, 2007 | Reply

I am having trouble opening ‘CMD’, when i type ‘CMD’ the box opens but i cannot type anything. within 5-10 seconds the box closes itself, do you think this is something to do with spylocked?

I have spent the entire day trying to get rid of it, please help!

By Brian on Jun 27, 2007 | Reply

Enrique, it’s possible that the Spylocked processes are still running in the background. Make sure you end the corresponding processes first.

By Lawrence on Jun 27, 2007 | Reply

It took me 4 1/2 hours to do this and you folks helped me find the only 1 thing i couldn’t find. the dooep.dll file. that got rid of that annoying flashing shield.
old school man;
first do a search on your hard drive for the following and delete all,
spylock,
imsm*,
iesmin*,
iesunst*,
iesmn*,
use alt/cntrl/delete/ to activate task manager and end as many as these processes as possible before deleting them. 2 files will not delete as you can’t stop them from running. “imsmain.exe” and one other one{it’s slipped my mind right now}you’ll notice when you can’t stop the process with task manager. Write the file names down exactly where they are located.

then click your start button and select run. then type regedit and enter.

Click edit and search all the above and delete them from your registry as well.

you may as well delete the key for the” dooep.dll while your in your registry.

Reboot your computer and hit f10. Select safe mode with dos”

using dos go to the directory where the 2 files are located and delete them.

then go to c:/windows/system32 and delete the dooep.dll file.

Reboot your computer and go back to your registry and delete any remnants of those two files.

using control panel check your program files for anything that shouldn’t be there. remove it but if it asks you to reboot, click cancel. it shoud just disappear.

your computer should be running just as fast as ours is now!
This should all take about an hour and a half!

Enjoy online again!

Lawrence.

By Gay Lord on Jun 28, 2007 | Reply

Not sure how helpful this will be, but it may help somebody. Here’s what I did, as best I can remember.

After installing the spylocked garbage and realizing it was bad, I tried to remove it with Add/Remove program. After that, I checked in C: and saw the spylocked folder was left. I tried to delete the group of items in the folder but was denied. I then deleted them individually until only a half dozen were left (wouldn’t let me delete them as they were active).

Pulling up Task Manager I saw that they were active under processes. Their names were something like isms.exe, iss.exe, imss.exe, or something like that. Ending their processes didn’t help, as they re-appeared two seconds later, but ending the process tree did. Once they were no longer active, I was then able to delete the files, and indeed, the whole folder.

I thought I was done, but still had the annoying taskbar icon (red shield/blue question mark), which kept pulling me out of any program running (like games!) to desktop every few minutes.

Using the Spyhunter listed here, I did a scan. It listed the zlob trojans, but only one registry key. Going into regedit, I went to Find and then entered the key number. When it found it (listed as “canker”) I deleted it. With that one key gone, the taskbar icon was gone.

Note this didn’t remove any other traces of the trojan, and is not recommended to fully clean your system. I only mention it here as a lazy, just-do-enough approach. But it fixed my taskbar.

By Troy in Texas on Jun 28, 2007 | Reply

I scanned using SpyHunter and after 5 hours of trying to manually delete all those files, purchased the Full Version. Presto all the pop ups stopped but the Icon and annoying message was still there. I still had a ‘.dll’ file that was not detected and I could not erase it manually until I followed the instructions from Asad back in his April post. Asad thank you so much for these instructions;

“Start Command Prompt. You should write this in CMD(DOS): ‘cd C:\Windows\System32′ and ENTER. And then close explorer.exe (using task manager) and go back into CMD and type in ‘del (filename)’ and ENTER. Then go back to task manager, to file, new task and type in ‘explorer.exe’ and ENTER.”

Hint: Follow these instructions in order and do not close the task manager or CMD window during the above instructions. Also, the bad “.dll” file in my experience was the newest one on the bottom of the list.

Thanks Asad and Spyhunter

By Tim on Jun 28, 2007 | Reply

FYI, here is a new dll from Spylocked; pjgerka.dll

By Norbi on Jun 28, 2007 | Reply

I cannot start my spyhunter. It says that something doesn’t work correctly

By Leifur Sigurdsson on Jun 28, 2007 | Reply

Hi thanks, By using your site I got rid of the trouble, it was pjgerka.dll that was in my computer. I recomend Spyhunter to everyone

By Daniele Milano on Jun 29, 2007 | Reply

all -

after removing most of spylocked with Spybot I had same problem as many above with flashing icon in taskbar
I applied ASAD method and it worked (thank you so much)
Only difference the name of bad file that was not any of the ones listed above; new name is “pjgerka.dll”
I found it sorting files in system32 by date; googling it I found it associated with Spylocked in a site (languange was Russian or similar, but likage was obvious)
hope it helps

By Tim on Jun 29, 2007 | Reply

This is another dll from spylocked: rxqcpn.dll

By Theodore on Jun 29, 2007 | Reply

HOORAY ITS GONE!

Ok so what i did:1st removed all spyware with spyware removal program.Then i searched “.dll” and found the newest one (pjgerka.dll).I tried asads method but it sais that the dll couldnt be found so went manually to the system32 folder,renamed pjgerka.dll to EVIL.dll and then right-click and delete.GONE!!!

By Ivan on Jul 1, 2007 | Reply

WOW! SpyHunter is a great detection tool, and this forum is very, very helpful. I was able to remove the annoying spyware from the PC. I removed the registry entries and cookies and .exe files first, then restarted XP in safe mode with DOS prompt. Right here was I able to delete the .dll file.

By John on Jul 1, 2007 | Reply

Hey guys! I found a new library that infected my PC on 6/28/07 named rxqcpn.dll. I searched for the other dll’s listed in this forum and didn’t find anything. I manually the Spylocked executables and got rid of them but the SYSTEM ALERT message kept popping up. It stopped when I deleted this DLL from the WINDOWS\SYSTEM32 folder and the registry DB in a folder called INPROCSERVER32.

More to come if I discover something else!

By Ben Gaster on Jul 2, 2007 | Reply

Hi all,

I can’t find any of the processes listed above yet I’ve still got that flashing icon in my sys tray. What i have got is pjgerka.dll in system32. Does anyone know what process is linked to this?

Thanks

By Paul Boyce on Jul 3, 2007 | Reply

Hello All,

I spent 4 hours on the phone with Dell trying to get spylocked off my system they couldn’t do it, he wanted me to back up my computer and reinstall everything! I found free software that took it off in 5 minutes. it is called Counter Spy I could not believe it took it off because of the problem I was having but it worked!! and for a computer illiterate like myself it was great news.

Thanks,

Paul

By Jeff on Jul 6, 2007 | Reply

Hi, All:

I, too, was infected with Spylock. I got rid of the flashing icon, but now when I reboot, I’m getting an error message stating: “Error loading C:\WINDOWS\system32\eehofao.dll” and then below that, “The specified module could not be found”

Help please..

By Opethian on Jul 10, 2007 | Reply

Hi guys,

Ive just been infected with the Spylock crap and was able to delete it but found a new “.dll” file from spylocked its “myqlejy.dll”
Hope it helps.

By Patrick on Jul 21, 2007 | Reply

Helllo
Ben Gaster I had the same file as you “pjgerka.dll” I renamed the file to badfile.dll and deleted it and got rid of my flashing icon in my sys tray
Thanks though all of you because you got me in the right direction to salve my problem

By CWilliams on Jul 25, 2007 | Reply

I have MacAfee installed and (it says) working, but ‘VirusProtectPro’ still got on my (Vista) machine.

I think it was in an ActiveX browser plug-in, which, BTW, failed to install (Firefox browser). After failing, it then launched Internet Explorer to “look for the latest version” – is this yet another security hole in Internet Explorer?

And why didn’t MacAfee spot a problem with the ActiveX – or doesn’t it scan them?

By John on Jul 28, 2007 | Reply

AS far as removing the virusprotectpro blinking icon in the system tray. After removing all references to virusprotectpro by using the “Add/Remove Programs’ utility in Settings, I used BitDefender and Spybot to remove the viruses and or adware, but was still left with the blinking icon (alternating red/blue type shield). I finally found a file in c:\windows\system\cqsfk.dll it is probably in \system32 in windows versions 2000 and above, (I’m still using Windows 98SE), you have to go to safe mode to remove it. That was the file which contained the blinking icon and would redirect to the virusprotect site.

By liq on Aug 3, 2007 | Reply

i have a question. a while back in april i downloaded a fake video codec on accident and my ciomputer got infected. i got norton and it removed everything but spylocked. im sure i did that my self but ever since my computer everynow and then has a pop up from norton saying this security risk has been romoved or intrusion or something. i really want to know whether my computer is still infected so if yall could reply itd be helpful

By Justin on Aug 5, 2007 | Reply

I used SpyHunter to get rid of Virus Protect Pro & SpyLocked, this worked great except for the flashing icon. I had to use SpyHunter several times before it finally identified one file – ‘khtbpdl.dll’ in Windows\System32. I then tried to delete this at the cmd promt but access was denied. Then I opened windows explore and searched for ‘khtbpdl.dll’, when I found it I changed its name to’badboy.dll’ and this changed the flashing icon to a flashing ‘?’. I restarted my computer and then deleted ‘badboy.dll’. The icon is finally gone!

It took me 2 days of hard work to sort out this problem, it seems that the .dll file you need to delete keeps changing.

One other thing, I don’t know if it makes any difference but I disconnected from the internet while I found the file, changed its name & deleted it.

By a on Aug 14, 2007 | Reply

I used your offer but it did not delet the spy. Good gesture would have been to allow one time use.Otherwise you are no better than the rest.

By Tessa Joughin on Aug 22, 2007 | Reply

Hi, I’m a 61 year old photographer gran in South Africa living far from big cities with computer fundis in them to solve problems! I put “flashing red shield” into Google and it came up with a whole lot of sites that I went through but I am afraid of anything that says “go into CMD” or anything like that as I haven’t got a clue how to do it. I found a post from someone who said that the program “Counter Spy” removed it. I will have to pay for it after two weeks if I want to to get automatic updates but the flashing shield and the pop-ups have gone completely, thank goodness. For someone who is afraid of looking for dlls and deleting the wrong thing it is a real boon. But am I free of it or is it stealthily running underground?
It disabled my PC-cillen by making it re-start every few minuites so it never finished a scan.
Anyway for those who like me don’t know enough to be able to manually delete files this seems to be the answer.(Or am I living in a fool’s paradise?!)

By Ben on Aug 24, 2007 | Reply

I can not thank you guys/girls enough with some of the helpful tips that were posted here!
I got tricked into downloading zlog through an activeX, and after the initial removal from spybot S&D and symantec. about 3 hours of frustration later tyring to follow the directions at top and getting basically “it isnt there” the 2 most helpful tips i got were Erythorbic saying to search all .dll’s and looking for the date.
And of course asad’s method of deleting the files.
besides that, even though im to cheap to buy he program im keeping spynomore just because it catches more then S&D.

My point is dont make the mistake I did and try to remove stuff already removed.

By steve on Aug 29, 2007 | Reply

had a little bit of trouble with spylocked infecting my computer (running XP), could not remove the software at the normal add/remove programs, used JV16 powertools to remove the software, still had the popups, used “Spybot S&D” to remove some more crap, still had the last popup which takes you to the internet site, did a search for “spylocked” on google and downloaded and installed “SmitFraudFix” ran the search, ran the automated cleaner, said yes to the registry cleaner and it was all gone, YAY!

probably should have started with “SmitFraudFix” in the first place instead of frigging around trying to do it myself, the program worked really well and was simple to use, even for me.

Steve

By gilles rixen on Feb 5, 2008 | Reply

hey guys,

I just installed some kind of video programm to see vids but it turned out to be a spam. now if all these informations are correct then it would mean that I have about 5 of the virus I found.

first of all I had the spylocked… which I uninstalled but there are two icons flashing me and telling me how viruses are entering the computer: messages like= there might be a risk that blabla virus is in your computer click on this baloon to find a antipy programm

and the trajon.zlob which I already solved by changing my homepage.

and a third one which file I cannot delete because it is “used”. file name: online add-ons
the dll names are: isfmdl.dll and ictmdl.dll the last one I alreay renamed and put to the desktop but the first one protest because its used.

now I am wondering how patatic the live of a hacker is but can someone help me please?

gilles

By Jellowe on Jul 1, 2008 | Reply

I recently came across this on a client’s machine and no spyware application I had could detect or remove it. Ad-aware found the actual program AntiSpy.exe and removed it along with the registry entries, but it did not get rid of the flashing/alternating “red shield/blue question” icon and accompanying message. I searched and found this website. I used Asad’s method which was very helpful. The filename was “jhzpcn.dll” and the file size was 13Kb. I also have a helpful tip for finding the dll in question.

Open the Windows search utility and search for “*.dll” within C:\Windows\System32 directory (susbstitute for your actual windows folder if different).

When the search is complete, right-click anywhere on the header bar (where it says “Name”…”In Folder”…”Size”…etc.) and you get a popup menu. Select “More…” at the bottom. Scroll down to the bottom of the list and place a check in “Company”.

The search box will now list “Microsoft” on almost every dll file. Now click “Size” on the header bar to sort files by size.

Now scroll down the list for anything that has a blank “company” field (most will say microsoft or intel or something). You can take note of each filename and check them against the list compiled here. It may be random though so if it looks suspect, it might be causing the problem.

Then just follow Asad’s directions above.

Thanks to all!

By Robert K N Wong on Jul 23, 2008 | Reply

Dear Asad,

I have studied your removal instructions closely but would request your help and advise whether my Dell desktop with my classic Windows 98, Second Edition, can handle your Windows XP and VISTA format meaning my Windows 98, 2nd Edition, only provide from START, with RUN and closing Windows with MS-DOS to use to go to Windows\System32 Folder.Is there a Task Manager from MS-DOS to use for your other following instructions to complete the task ?
Please provide step by step instructions to eliminate SpyLocked virus icon from taskbar. In a way lucky,I only have irritating flashing icon at the right side of the tashbar but without pop-up at all! Many Thanks, Robert.

By Robert K N Wong on Jul 30, 2008 | Reply

Dear Asad,

I`ve posted my request for help some 7 days ago. Would you kindly give your reply as soon as possible?

Regards, Robert K N Wong.

By rach on Dec 18, 2008 | Reply

Wahhh,,,

help..i can’t get rid of that darn software counterfeit…i was so stupid to install that..it drives me crazy!!!!!!anyway,,i’ved learned my lesson….

By Faeed on Jan 8, 2009 | Reply

Problem Event Name: DynaCrash32
Application Name: iexplore.exe
Application Version: 7.0.6001.18000
Application Timestamp: 47918f11
Exception Offset: 000442eb
Report Id: 636488131
Additional Information 1: fd00
Report Id: 636488131
OS Version: 6.0.6001.2.1.0.768.3
Locale ID: 6153
Additional Information 1: fd00
Additional Information 2: ea6f5fe8924aaa756324d57f87834160
Additional Information 3: fd00
Additional Information 4: ea6f5fe8924aaa756324d57f87834160

Extra information about the problem
Bucket ID: 322159953

By Faeed on Jan 8, 2009 | Reply

please help me,
it realy makes me agitated,

By domain on May 28, 2009 | Reply

Nice site! thanks for the great post…%d%a%d%aPeople should read this.