System Alert Popup Removal Instructions for Windows XP or Vista
March 8th, 2007 | by Brian |Are you one of those who got the annoying and blinking system alert popup on the taskbar? If you are, then you are in the right place. We are going to tell you what they are and how to get rid of them safely.
The rapidly-developing Internet has posted a lot of threats to our daily online activities and securities. To name a few, spyware, adware, Trojans and viruses…etc. They can potentially steal your data or even bring down your computer. Fake or false system alert popup, one of many syndromes of the potential threats you might see, is usually installed via a Trojan called Zlob (Trojan.Zlob). Most people get the Zlob Trojan by installing a video codec from one of those social networking sites such as MySpace. The Zlob Trojans then generates fake system popup alert to trick you into buying of their products, for examples, AntiVirGear, VirusProtect, SpyLocked, AntiVermeans, Spydawn…etc. To remove them completely, it takes time and some basic computer skills. Here’s how you do it:
Download SpyHunter* Spyware Detection Utility
Manual Removal Instructions: (for Windows 2000/XP/Vista)
Stop the following running Processes if Exists:
(Learn how to stop a process)
spydawn.exe
pesttrap.exe
antivermins.exe
AntiVerminsPro.exe
spywarequake.exe
dfrgsrv.exe
mscornet.exe
mssearchnet.exe
nvctrl.exe
spyfalcon.exe
ismon.exe
isnotify.exe
issearch.exe
pmmon.exe
pmsngr.exe
pmsnrr.exe
regperf.exe
nvctrl.exe
ishost.exe
spylocked.exe
SpywareLocked.exe
Spy-Locked.exe
SpywareLock.exe
SpywareLocked 3.5.exe
SpyLocked 3.6.exe
(Learn how to unregister a dll file)
| msvcp71.dll higehsg.dll xkrdk.dll cthkpcv.dll axlet.dll heur003.dll heur002.dll heur001.dll heur000.dll dxmpp.dll Ygjun.dll yuspej.dll czxtyx.dll bpvol.dll splug.dll dxovx.dll lcsrsrv.dll Ygjun.dll yuspej.dll czxtyx.dll bpvol.dll splug.dll dxovx.dll lcsrsrv.dll iesplg.dll uimcu.dll |
ginuerep.dll higjxe.dll bolnyz.dll wfkduei.dll winrge32.dll ywbicim.dll wfkduei.dll hvnwm.dll imfdfcj.dll yhbdupd.dll tahxqcj.dll qvjpt.dll oyopu.dll yronl.dll isadd.dll pkgvyg.dll qzviz.dll tahxqcj.dll qvjpt.dll oyopu.dll yronl.dll isadd.dll pkgvyg.dll qzviz.dll iesbpl.dll |
(Learn how to delete a registry value)
HKEY HKEY_LOCAL_MACHINE\SOFTWARE\SpyDawn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion \App Paths\SpyDawn.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion \Uninstall\SpyDawn
HKEY_CLASSES_ROOT\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{661173EE-FA31-4769-97
HKEY_LOCAL_MACHINE\software\antivermins
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\antivermins.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run antivermins
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\antivermins
HKEY_CURRENT_USER\Software\SNO2 HKEY_CURRENT_USER\Software\PestTrap
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpywareQuake
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D
HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake\refid:”1″
HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake\Language:”1033″
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpyQuake2.com
| msvcp71.dll higehsg.dll xkrdk.dll geplxss.dll tvomnc.dll hjpprpu.dll cvnzie.dll kuhmk.dll msvcr71.dll msvcp71.dll rosdzop.dll vwfps.dll kcaofg.dll cthkpcv.dll axlet.dll heur003.dll heur002.dll heur001.dll heur000.dll dxmpp.dll ismon.exe isnotify.exe issearch.exe pmmon.exe pmsngr.exe pmsnrr.exe regperf.exe nvctrl.exe nvctrl.exe ishost.exe |
ginuerep.dll oqipt.dll iqzv.dll htey.dll ulztc.dll oerucu.dll sbnudh.dll fyhhxw.dll appmagr.dll reglogs.dll twain32.dll higjxe.dll bolnyz.dll wfkduei.dll winrge32.dll ywbicim.dll wfkduei.dll hvnwm.dll imfdfcj.dll yhbdupd.dll spydawn.exe pesttrap.exe antivermins.exe AntiVerminsPro.exe spywarequake.exe dfrgsrv.exe mscornet.exe mssearchnet.exe spyfalcon.exe spywarequakeinstaller.exe |
That’s it! In order to avoid the malicious spyware and adware in the future, educating yourself and be careful with ActiveX and JavaScript plugins. Having a good surfing habbit essentially save you money and keep you out of troubles!
Good luck!
19 Responses to “System Alert Popup Removal Instructions for Windows XP or Vista”
By jj2smiles on Mar 8, 2007 | Reply
thank u for the instructions. it took me a couple of hours but i did successfully remove the pop-up.
By Brian on Mar 10, 2007 | Reply
We are glad it works!
By Jeremy Shotts on Mar 19, 2007 | Reply
I have removed all vestiges of the ZLOB infection, except for the irritating pop-up, which I suspect is connected with the installed program “System Alert Popup” which cannot be removed via the Control Panel. Have searched registry for the DLLs you list and deregistered the only one I found, msvcp71.dll. Have since found 3 copies of the dll file itself, including one under the Symantec program directory and one under Adope Photoshop. However I am now concerned about deleting any of these because, the files are dated prior to the infection, and a search on the web shows that this dll is a legitimate part of Microsoft’s C runtime library, and that it’s removal is likely to be harmful. Could you explain how this can be safely handled?
thanks
Jeremy
By SvendK on Apr 2, 2007 | Reply
Hi, I found quite a lot of the msvcp71.dll file:
%programdir%\Autodesk\Autodesk DWF Viewer
%programdir%\Autodesk\Autodesk DWF Viewer\Ecomposite
%programdir%\Autodesk\Autodesk DWF Viewer\emap
%programdir%\Diskeeper Corporation\Diskeeper
%programdir%\Common files\Autodesk Shared\dwf common
%programdir%\Games\Battlefield 2
%windir%\system32
Should I really remove all these files?
I’d be happy, if you would mail me the answer to “sager underscore svend at hotmail dot com”
Kindest regards
SvendK
By Rogelio on Apr 8, 2007 | Reply
Can somebody post the process of how to remove the pop-up?
By Felico on Apr 9, 2007 | Reply
Thank you for bringing such an informative website with steps on removing the spywares.
Unfortunately as it so happens. They are improving their ways.
there is a different system alert spyware. & it is in the form of a Help question & a No cross Sign..
If you can show me how to remove this it would be much appreciated. All the DLL & spylocked files in registry are nowhere to be found. thank you
By chinmay on Apr 10, 2007 | Reply
I have XP installed.I by mistake installed some Video activeX control.Then even if i removed it i can still see the processes running i.e isadd.dll,isamini.exe,isamntr.exe,pmmnt.exe,pmsnrr etc.If i try to terminate the process it terminates but again appears in 1-2 seconds.I get system alerts saying that some trojan exists.Let me know what to do.
By Bo L on Apr 18, 2007 | Reply
very informative…
i searched through my files to look for any of the .dll files and I came across the hjpprpu.dll…things is, it says “access denied – make sure disk is not full or write-protected and currently not running”…why is that? and thanks
By Brian on Apr 18, 2007 | Reply
Bo L,
As many have said, you can boot your PC into Safe Mode, then rename your dll (hjpprpu.dll) into something like hjpprpu.bad, then reboot your PC again. Then you can delete them safely. Hope this helps.. good luck!
By Ned on Apr 28, 2007 | Reply
This process works it just taked a while.
By mahesh on Jun 9, 2007 | Reply
thanks a ton dude !!!! i’ve downloaded spyhunter and it is doin its job, i think this should solve the problem……. fingers crossed. still don’t know how long i have to w8.
By shen on Aug 16, 2007 | Reply
and read this..
[quote="jack_p from here"]
I was attacked by this spyware a day back. Googled and tried every possible solution. Let me tell you, they all are extremely painstaking & time-consuming viz. installing, configuring & following those steps. But what frustrates is none worked. I personally tried this simple alternative and wow !!
-> Go to Folder Options and check “Show Hidden/System Files”
-> Go to C:/windows/system32.
-> Change the view to “Details” and sort by Modified Date.
-> Locate any DLL files with the modified date as to when the problem started occuring, it was khtbpdl.dll in my case. But its known to have different variations of DLLs.
-> Copy it to a different location for backup sake.
-> Reboot to safe mode and delete the DLL file from C:/windows/system32. Restart to normal mode.
Job Done !
[/quote]
By hanz on Aug 20, 2007 | Reply
hi am getting this pop up message saying that my system is infected and their is a lot of spyware running etc i did get it from a video codec which i download the files is iesbpl.dll and iesplg.dll….can anyone help please many thanks
By RK on Sep 26, 2007 | Reply
Hi,
After trying about 4 other anti-virus programs, I paid the 29 bucks and loaded the spyHunter…..and It got rid of that flashing piece of crap that wormed its way onto my lower right hand corner of my desk top! So I would say its worth the price!
By Gabriel on Feb 14, 2008 | Reply
the pop-up is still here can you tell me which specific file i need to delete to get rid of it?
By mac on Mar 10, 2008 | Reply
hi
By Raja on Apr 26, 2008 | Reply
I tried all the mentioned things but of no avail. I tried to do in a different way. I installed FileMon in my machine to see which is the file which is accessed the most and specially just before the blip spound for the alert. The file name I found is C:\Windows\system32\zfaiqwr.dll. I could not delete the file as it was being by some process. So i opened a command prompt window and navigated to c:\windows\system32. Stopped explorer.exe from taskmanager. Now deleted the file zfaiqwr.dll from the mentioned location and started explorer.exe again. The fake alert is gone.
It is highly probable that the dll file is different for different systems. I use a Windows XP machine.
Thanks,
-Raja
By matthew r uhlean on Oct 15, 2008 | Reply
DO NOT WANT PLEASE STOP.THANK YOU
By Shahooter the Owl (KPZSR1) on Jul 16, 2009 | Reply
This….IS…WAR *cocks Shotgun and shoots System Security*