SpyCrush Removal Instructions

By Ed on Jun 10, 2007 | Reply

Great instructions. But I tweaked it a little bit to remove this malicious Spycrush from my wife’s laptop. I downloaded and install Spyhunter from this website. I did not purchase it, instead, I use it to scan the laptop thoroughly. In this case, both C and D drives. After it’s done, I follow the instructions and delete the infected dll and registry keys. Make sure you stop Spycrush process. Reboot! Now it’s gone!

By Carlo on Jun 10, 2007 | Reply

After four hours searching and trying to remove this damn Spycrush popup window, finally it is not poping up anymore after i remove one of the file above (yesgnhr.dll). The system alert popup from Spycrush was really really really anoying, and spend four hours to of my time just not see that anoying popup it is worth it. Thanks for the instructions and file, Carlo.

By Billy J. on Jun 10, 2007 | Reply

Ed, you are god!! It works like a champ! Thanks a lot!!

By Anoop Kumar on Jun 11, 2007 | Reply

Hi

I have uninstalled spycrush software from my windows XP pc & manualy deleted from program files & registry.But still it is showing a spyware alert message in taskbar.
when I click on this icon , it is going to spycrush site but i dont want to install this one. How can i remove this alert icon from taskbar?
thanks in advance if u help me.

Regards
Anoop Kumar

By Brian on Jun 11, 2007 | Reply

Anoop,

There’s a good instruction that posted by Johny in another thread. He called it “’sort by date’ methord” which I think very astute. Here I copied and posted here:

———————————————————–
Johny Says

Ok, so once again (much shorter version):

I was infected dwo days ago, solved the problem yesterday. Everything failed and flashing icon was still there. Finally I used a “sort by date” method and found a strange .dll from day before attack (yesgnhr.dll). Renamed it and icon started flashing; restarted PC and icon was gone. Then I deleted it and celebrated

Malware software was called SpyCrush, but I am writing my experience here, because it is still the same SW, only with different name, and this thread is far longer (and better indexed by search engines) than the similar one on this blog.

Thanks and good luck
Johny

Jun 11th, 2007 at 7:36 am
———————————————————

By Jessica on Jun 11, 2007 | Reply

Thanks Brian. This is exactly what I’ve been looking for.

By jamie on Jun 11, 2007 | Reply

Thank you guys by reading through the forum and a few other sites I have successfully removed the crap. I am still confussed how it actually got into my system. I am using e-trust internet security. It’s suppose to not let anything fatal be install onto your computer.
That’s a lie.
anyway thanks people

By Tim on Jun 11, 2007 | Reply

Here is a new dll from SpyCrush: iauoi.dll

By PeterZ on Jun 11, 2007 | Reply

what did you guys have? I think I got spycrush 3.3 in my computer. can i use this instruction without knowing Windows XP or should I bring my PC to BestBuy? i am dead in the water. help plz!

By Mike Musgrave on Jun 12, 2007 | Reply

Forty years of dealing with complex specifications and insurances for civil work, structural work, electrical, communications and I cannot follow your instructions for the life of me.

PLEASE, HOW DO I REMOVE SPYCRUSH ON WINDOWS XP?

Step by step, click by little click please.

Mike

By Brian on Jun 12, 2007 | Reply

Mike,

Actually, it’s pretty straight-forward. You just need to find the infected files as listed above, then deleted them accordingly. As the instructions mentioned, you might need a thorough understanding of Windows registry or dll’s before you make any modification. Otherwise, you might run into the risk of killing your system. I would also suggest, as I always do, to do a full backup of the system before you pull the trigger. Good luck!

By Chris on Jun 13, 2007 | Reply

I just used spyhunter to scan my computer and remove parasites, and spycrush is still there–popping up in my toolbar as to further humiliate me! Anything else I can do? I tried looking for files to delete, but I couldn’t find any.

Chris

By Tim on Jun 13, 2007 | Reply

Here is another new dll from SpyCrush: gbjkog.dll

By mary mendez on Jun 13, 2007 | Reply

i still can remove yesgnhr.dll from my laptop. what can i do?

By Brad on Jun 13, 2007 | Reply

Still there Nothing works

By kyle on Jun 13, 2007 | Reply

hey guys those instructions really helped me alot it got rid of everything to get rid of that flashing icon you have to open search from the start menu and type in yesgnhr.dll when it finds it rename it whatever you want and send it to your desk top then reboot your computer and it will be gone thanks again you saved my computer

By Travis on Jun 13, 2007 | Reply

Well i cant find any of the .dll files and i cant delete ckimzeb.dll and i cant find yesgnhr.dll at all. This is making me frustrated. anyways please respond back. Thanks

By Brian on Jun 13, 2007 | Reply

Travis,

It’s not necessary that you have all the files. It can be various from machine to machine, and you just need to delete the ones that you have. As many people have said, you can RENAME it to another name then get rid of it. For instance, in your case, you can rename ckimzeb.dll to ckimzed.doc then delete it. Hope this helps.

By cat on Jun 14, 2007 | Reply

what is the sort by date method?

By Lara on Jun 14, 2007 | Reply

I did a previous manual cleanup but the spycrush icon keeps popping up. I also went through the steps for manual deletion indicated above, but I didn’t find any of the registries, files or processes listed. However, I did found cdwvhbf.dll and the date for this file corresponds with the date of infection. It is located in c:\windows\system32

Could this be a file for removal?

By coldfire on Jun 14, 2007 | Reply

I just had to deal with this spycrush bs. After reading through this site and the responces that others left. I used the free scan from spy hunter to locate all of the files and removed them one by one. I like the idea of renaming the dll file then restarting computer then del it. That worked perfect. Thanks for having this site up.

By Joe on Jun 14, 2007 | Reply

Here is another dll from spycrush: cdwvhbf.dll

By Lara on Jun 15, 2007 | Reply

Joe,

Are you sure the cdwvhbf.dll is a SpyCrush file? How can you tell?

I’m afraid to delete it and harming my computer.

By Kay on Jun 15, 2007 | Reply

Kyle (13.06.07)

Many thanks, after 2 days hunting everything to do with spycrush and removing it from my PC, there was just one file left.

Thanks to all these notes and advise from others too, I found the little swine (gbjkog.dll) renamed it BUG, rebooted PC and its gone!!!!!!!

I do get a bit miffed that all these ‘free’ scanners are free but they are not when it comes to removing the stuff, thank goodness for help from fellow sufferers!!

K

By Lara on Jun 15, 2007 | Reply

I became anxious and went ahead erasing the cdwvhbf.dll file from my computer. It worked! Thanks,

By Takie on Jun 16, 2007 | Reply

I also Have the spycrush BS on my computer and it’s driving me up the wall, I never had anything like this on my PC so I just don’t understand how to remove it, I used a Scanner called Xoftspyse and that helped me detect the crap but It wants me to pay $40.00 to clean spycrush out of the Pc, I don’t want to manually do anything because everything I read says your at risk of damaging you PC beyond repair when you do this, so can someone please help me with this issue

By Dawit on Jun 16, 2007 | Reply

I follwed the removal instruction step by step and was very accurate. It was a great help!
I would like to add one more thing though….when I was attempting to delete the tczij.dll file I kept getting ‘cannot delete make sure disk is not write protected ..’ probably becsue that stupid false adware pop up was still running. I had to restar my PC and go into command prompt safe mode and manualy delete by using typing the command “del tczij.dll”. And sure enough that annoying pop up was gone to hell. Yay!!Hope this helps someone else out there. cheers!

By Dawit on Jun 16, 2007 | Reply

to Takie,
I understand your concern. I feeling pretty nervous myself too. But I backed up my edit(registry) before i did anything. so you can probably do the same or even back up your hard drive itself prior.
To avoid mistyping try to coping and pasting the values during the Removing SpyCrush Registry Values step.

By Andrew Heubner on Jun 17, 2007 | Reply

I recently was infected with spycrush on my laptop using windows vista. The only problem with removing it is that as soon as I log in a window pops up and says “windows explorer has stopped working” and it freezes everthing on the scree. Then the computer tries to reset windows explorer and when it does the message
‘windows explorer has stopped working.’ Is the best way to remove spycrush to delete it using command prompt?
Thanks

By Dawit on Jun 17, 2007 | Reply

to Adrew,
I wouldn’t say command prompt is the easiest way to remove spycrush just becasue there will be a lot of typeing involved. But in your case you may have no choice since your PC freezes when loggin in. My advice would be first to try and run windows in safe mode and try to follow the removal instructions.
If this doesn’t work ..like I said you might have to go into command prompt safemode and Unregister SpyCrush DLL Files, and Find and Delete SpyCrush Files. Hopfully this will solve the freezing up during the logging process. If successfuly logged in you can then Remove SpyCrush Registry Values through regedit. Good luck!:)

By Wes on Jun 17, 2007 | Reply

I had the flashing icon on the bottom right on the taskbar, and after all the things above didn’t get rid of it, I stopped trying. Today, two days later, I saw the two new .dll files xikor.dll and tczij.dll. When I searched, xikor didn’t come up, but tczij did! I did what Kay did because I couldn’t delete it: I renamed it “Bug” and restarted the computer. The icon on the bottom right was gone, and when I searched for Bug and found it, it let me delete it! It’s gone. Thanks, Kay!

By BT on Jun 17, 2007 | Reply

THANK YOU ALL FOR THE HELP – THOUGHT THERE WAS NO WAY WE COULD GET RID OF THE THE FLASHING LINK TO SPYCRUSH EVEN WITH EVERY SPYWARE SCAN WE OWN!

HAD TO USE EVERY NAME LISTED TO FINALLY FIND THE DRIVER ON OUR SYSTEM. AT LAST 1 CAME UP – DID THE RENAME & MOVE, THEN RESTART & DELETE. IT’S GONE!

IS THERE ANYWAY TO REPORT THESE JERKS? DOESN’T SEEM THAT THIS SHOULD BE LEGAL!

By Baarb on Jun 17, 2007 | Reply

Thank you, thank you! I am a fairy savy computer person but never would have thought a .dll file. My daughter was online and Norton stopped and quarantined three trojan horse files but apparently something slipped through. I know enough to edit the register but thngs are so deep I don’t knw if I would have found them all. Have shut down completely about three times and did a restart once and so far no annoying – mine was the tczij.dll. I spent hours and should have read this first.

By Mike on Jun 18, 2007 | Reply

Guys & Gals, Thank you! Thank you! Thank you! I’ve had the annoying pop-up icon for only a few days and it’s been driving me round the bend – and this was after I bought Spyware Doctor to remove the offending Spycrush!My problem was the tczij.dll file as well, but I’ve renamed it bug and just rebooted and, hey presto, no annoying pop-up. Thanks a million. Wish I’d come here first!

By Griffin on Jun 19, 2007 | Reply

Okay, this is very frustrating. I downloaded the free SpyHunter v 2.9. I scanned and found a few viruses related to the HKEY location. I can’t find that area. I did a search on .dll files, found a lot, i didn’t want to go through. I haven’t the slightest clue what to do, can someone help me out?

By Terry on Jun 19, 2007 | Reply

Thanks to all of you for your input and experiences with this spycrush plague. Ive been stugling with it for several days and finally kicked its butt with the file renaming trick..now I’d like to do thae same to the scum responsible for this thing..Any suggestions…Thanks to all

By base on Jun 20, 2007 | Reply

Just adding my 2 cents- I got hit with this earlier and it was very annoying. I cleaned everything up so far except that freaking taskbar icon that flashes the x and ?. I did the search by method and found one file I forgot to write down the name but it was started with like igb—–.dll but it was tricky as it showed the modifyed date as 8/1/2006 but it was at the top of the modified date list. Anyways I tried to delete it and it was of course access denied. So I changed the name like it was posted earlier to do and the icon changed like they said it would. Reboot and delete now my system security icon is back

Just look out for funny looking files at near the time of infection like people said I wasted 2 hours following some other removal walkthru and this got rid of it in like 5 mins.

By Joe on Jun 20, 2007 | Reply

Here is another dll from spycrush igpfced.dll

By patr- on Jun 20, 2007 | Reply

Got hit by Spycrush 3.3 yesterday – Followed the manual removal instructions and deleted the suspicious .exe files. I then searched (and listed by date), all files that were modified on 6/19/07 which turned up several of the questionable .dll files.

After restarting, I thought the problem was solved. No more flashing alert message on the task bar.

However, when I went online, the message returned, and had mutated from an alternating shield/question mark to a blue question mark identical to the Windows “help” icon!

I then decided to update Spy Sweeper (disabled it six months ago) and scanned my drive.

The scan turned up a threat called “Trojan-Downloader.Zlob” After deleting Zlob the taskbar alert message disappeared.

I would suggest updating your Spyware/Anti-virus software definitions and check for any variation of Zlob.

By Peter on Jun 20, 2007 | Reply

I’ve tried everyting mentioned on this site but nothing seems to work.I can’t delete or rename then delete this crap(igpfced.dll spycrush v3.3).I run PC Tools Spy Doctor with Anti-Virus and this doesn’t do anything to help.Spycrush wont even let me do a system restore.Any help would be greatly appreciated!

By Brian Quinn on Jun 21, 2007 | Reply

Greetings All-

Great i nformation here, but I’m still getting a migraine from this silly spyware.

At first I used SpySweeper, with current definitions. It found the Trojan-Downloader.Zlob and deleted it.

I rebooted, but still had the silly flashing popup in the toolbar. So I ran spysweeper again and it found nothing.

Then I followed the instructions here to manually remove everything.

I found no strange.dll files, but i did find about 6 or so rregistry keys and deleted them.

I rebooted and the stupid popup/flashing tray icon was miraculously gone.

Then I power the pc down and went to bed. BAM! today the silly tray popup/flashing icon is back. I ran spy hunter to check for the location of possibly reintroduced registry keys, but it found nothing.

PLEASE HELP!!!!!!!!

Why is this damn thing back and why can’t i find it this time?

UGH

By Billy on Jun 21, 2007 | Reply

I got Spycrush 3.3. I downloaded Spyhunter and removed the entries that shown in Spyhunter. Yes, it works! No money spent! Here’s my question. What is the possibility of getting Spycrush 3.4 or even 3.5 in the future? Do I need to purchase this software as protection to my system? What are the odds of having other spyware in my machine?

By Ka on Jun 21, 2007 | Reply

I just spent two hours and Spycrush is now gone! Thank you for these instructions!

By blair on Jun 22, 2007 | Reply

does anybody have a soloution for vista. after downloading an infected codec. my desktop disappears and then reappers and i cant actually get into anything. so this means that i cant get on the internet at all to download this software. It says that windows explorer has encountered a problem and must be restarted. this happens every minute. so when you click restart this program the desktop disapears. it then reappers and you have about 15 seconds to try and do something b4 the message pops up again. as soon as the message pops up the computer locks.
aaaaaaaaaaaargh!!! what to do what to do?? can somebody please help??

By Larry on Jun 22, 2007 | Reply

My vista is doing the exact same thing(desktop disappears/reappears) ,can’t get online to get tech help, windows explorer box pops up saying exploer is going to shut down. Anybody have an answer?

By Edgardo on Jun 22, 2007 | Reply

please delete SpyWare from my computer and all it’s componentes and other hardware.

By Tim on Jun 22, 2007 | Reply

Two new dll’s were added: iwwvh.dll and xedasn.dll

By Brian on Jun 22, 2007 | Reply

Brian Quinn, have you tried System Restore in Safe Mode? Windows Vista handles this fairly well.

By nik on Jun 22, 2007 | Reply

Hi,
I’m so computer illiterate, how exactly are you suppose to find these files? Do you go to search and type in the names to find the file? can someone give me a example step by step how to? would be greatly appreciated!!
thanks!

By patr- on Jun 23, 2007 | Reply

nik-
I’m not very knowledgable myself. This has been a learning process for me. Oddly enough, I’ve enjoyed it!

It well be helpful if you can determine the date and time you first encountered the problem with Spycrush.

Click the START button and go to SEARCH.

Select “All files and folders”.

Type “spycrush” in the top box where it says “all or part of the file name”

Go down further and select “More advanced options” and check the boxes for “system files”, “Hidden files”, and “subfolders or files”.

Now click “Search”.

There should be a least one file in the results window that looks something like this:

SPYCRUSH 3.X EXE-3959C232

Look under the “Date modified” column and you will know the exact date and time your computer was infected.

Now you can repeat the process and do another search for the .dll files.

Type *.dll in the file name box.

Go down to “When was it modified?” use “specify date” and type in the date from your first search in the “from and “to” boxes.

The results from this search should yield all the .dll files that were modified on the date you were infected. You are only interested in the files that match EXACTLY the date and time that SPYCRUSH.EXE appeared on your computer.

Compare these .dll file names with the ones that are listed here by other posters.

Deleting the wrong .dll files and registry keys can mess up your computer big time.I would advise against deleting them yourself until you have throughly studied the info here.

By Brian Quinn on Jun 23, 2007 | Reply

Brian-

You suggested using System Restore thru Windows Vista.

I am using Windows XP, do you think this would help?

I know it’s a stupid question and I’ve used restore before, but didn’t realize it would help with something like this.

In the meanwhile awaiting your response I’ll give it a try and let you know the result…….

By merlin on Jun 23, 2007 | Reply

Hi Folks!

I have been messing with spycrush for two days now and this blog is wonderful. Spycrush has many different .dll files that are usually placed in the windows/system32 directory(XP). Spycrush allowed me to believe that I had unistalled the program, but it left the igpfced.dll file behind. I ran spybot search and destroy which removed the X ? icon, but 24 hours later it was back. This programs mutates in some way which I am looking into now. Great blog, I am telling all i know to watch this place bc there are some good folks here!

By karl breuer on Jun 24, 2007 | Reply

The file ckimzeb.dll stays active and is difficult to remove even in safe mode. I booted into safe mode (f8)and it was still loading the notifications. I then rebooted in safe mode command prompt and went to windows/system32 and deleted the file in dos.

By Lance on Jun 24, 2007 | Reply

Thank you everybody for the great tips to get rid of Spycrush. Spysweeper got rid of the virus (Norton IS USELESS), the programs, and the trojans but I was still left with the flashing X/? icon that went to spycrush’s webpage. That icon is one of the .dll listed above. The way I removed it was going to the search option in the startup menu. Search all files and folders for .dll. Sort alphabetically NOT by time/date because I found the date changes and is not the time it was downloaded. Try all the .dlls listed above, it will be one or more of them. It may not let you delete it so you will have to rename it (I did this in safe mode). Once I did that I still couldn’t delete it but the icon changed, restarted in normal mode and the icon was gone. Then I was able to delete the renamed .dll icon.

By Peter on Jun 24, 2007 | Reply

I finally got rid of the crap spy crush file(igpfced.dll) from my pc.Click start then search,go to all files and folders.Type in igpfced.dll(or whatever .dll you want to remove) and click search.When file is found click the “move to” icon.Create new folder then delete it.Make sure to delete it from recycle bin as well.Hope this helps someone!

By Driger on Jun 25, 2007 | Reply

PPL!!! This is not normal I don’t have any process of spycrush or files that they tell and I still have stupid pop-up baloon of SpyCrush!!!! WHat to do?

By ppwok on Jun 28, 2007 | Reply

and this one too…
jrwdvvl.dll

I can’t seem to shake this one – remove it from registry, but it just comes back! something else is powering this damn thing – but I’m gonna find it and kill it slowly and painfully by chopping it in pieces in notepad!!!

By ppwok on Jun 28, 2007 | Reply

Ahhh!!! do a seach for files modified on the date of your virus attack – i.e. the date on the .dll file you find… then sort by date – hmm – you reckon all these files with the same date and time are your virus’s mates?

I do! – and look – one of them is an “exclude” file for spybot S&D – which is probably why your popular anti-spyware problem can’t seem to find it.

Suspicious files: a.exe, vm5_killer.exe ??

By MZMGRAND on Jul 14, 2007 | Reply

I’ve been reading some of these posts and them very helpful. I have worked for 26 days off and on to clean up our system and the only thing I had left was the red circle/blue question mark on the task bar. I installed Windows Defender {free} and it took care of it. I then started on my son’s laptop with the same problems. Installed Windows Defender and it cleaned right up. Had to delete a couple of files in programs and that was it. Highly recommend you guys try Windows Defender, it really works. Mark

By mike on Jul 26, 2007 | Reply

go to start menu….
click help and support….
click Undo changes to your computer with System Restore
click restore my computer to an earlier time
pick a date you know you never had the virus and let it run…
worked a treat for me..
oh yes i beat it!!!!