VirusProtect 3.9 or VirusProtectPro Removal Instructions

Comments

1. Jason says:
   July 28, 2007 at 4:40 pm

   afzdbl.dll is another dll from Virus Protect Pro.
2. small bear says:
   July 28, 2007 at 9:34 pm

   I believe that I can kill it!
3. Tim says:
   July 29, 2007 at 1:49 pm

   bgwttyl.dll this is another dll from virusprotectpro.
4. Tim says:
   July 30, 2007 at 9:55 am

   ugofuq.dll and dyrwls.dll are the latest dll from VirusProtec Pro.
5. Jason says:
   July 31, 2007 at 9:51 am

   gtawclv.dll is another dll from VirusProtectPro.
6. Tony says:
   July 31, 2007 at 3:07 pm

   A friend got hit with VirusProtectPro and came to me for help. These instructions made it possible for me to help. Thank you much!
7. Zlog Trojan SUCKS! says:
   August 2, 2007 at 9:40 am

   vjxwnn.dll (renamed to .dll.bad, deleted in safemode)

   Hope it helps. Search C:\WINDOWS\system32 by date modified if you know the approx. date you got it. Rename it and safemode delete it.
8. Brian says:
   August 2, 2007 at 11:01 am

   Here’re the new infected dll files:
   vjxwnn.dll
   khtbpdl.dll
   cfqbw.dll
9. marshall says:
   August 3, 2007 at 10:21 am

   well there are many viruses now, do u guys know any programs i can trust to protect my PC
10. Andrew says:
    August 3, 2007 at 11:17 pm

    khtbpdl.dll has to be the cause of that persistent task-bar pop-up. I just deleted it and the pop-up is gone. Previously, Spybot got rid of all files with VirusProtectPro in their name and apparently all dll’s except khtbpdl.dll (which was the only survivor showing up in a Start-menu search of “files including dll, modified in the last week”) but the pop-up just kept coming till I did the rename /delete thing.
    Thx all who suggested that and the timed search for dll’s.
    Funnily enough the “Unregister dll files” process did not work for khtbpdl.dll (error message said “DllUnregister . . . was not found”) – persistent little item, eh? Built-in defences or what? I was SO relieved when it didn’t refuse to delete!
11. Ray says:
    August 4, 2007 at 1:10 pm

    Instead of going thru all the trouble of looking for certain files to delete, I just Restored my computer to an earlier date, before I got the VirusProtectpro. It was a whole lot easier.

    Ray in Florida.
12. Brian says:
    August 4, 2007 at 9:55 pm

    added new dll files:

    fdpzgi.dll
    gusur.dll
13. Rican says:
    August 6, 2007 at 7:30 am

    Thanx guys for the help..i dun have it no more!!!

    Its GONE
14. Brian says:
    August 7, 2007 at 6:31 pm

    Added new infected dll files for VirusProtectPro. Make sure you follow the removal instructions above to remove them.

    fshqaln.dll
    ktrxe.dll
15. jazze says:
    August 8, 2007 at 11:45 am

    Hi Ray,

    You mention about restoring your computer to an earlier date. Can you share with me how to do it??

    Sorry, I’m not good with computer programs. When my laptop got infected, I just tried to delete the whole “VirusProtectPro” folder under C:Program files without checking up on how to get rid of it properly. But the stupid icon still keeps popping up, and my laptop seems slower now and i get weird error messages abt some exe files not running and having to terminate.

    thanks!
16. jazze says:
    August 8, 2007 at 12:33 pm

    Help!

    1) I’ve deleted the Virusprotectpro folder under Program files.

    2) I’ve tried searching for all the .dll files listed but can’t find any.

    3) I’ve found the “System Restore” function that Ray mentioned but tried to restore to 2 different dates but was told restore incomplete as “No changes made to the computer”

    4) I tried to find any .dll files in System32 folder modified on the day that my laptop got infected and found nothing.

    What else can I do?? This pop-up icon is driving me nuts!!
17. Brian says:
    August 9, 2007 at 5:44 pm

    Added two infected dll’s for Virus Protect Pro 3.6: nexpegp.dll and eigbbb.dll
18. Mike says:
    August 10, 2007 at 9:26 pm

    Found another dll not seen in list – xtsyynm.dll

    Used the suggestion to look for dlls added today.

    all of the other files – programs, reg keys, etc. were gone, but that little dll seems to have been the problem

    gave it an extension of my initials to make it easy to find and restarted my PC – no more annoying popup.

    Thanks for all the hints and help.
19. B.H. says:
    August 12, 2007 at 4:31 am

    By the way, make sure that when you sort out the files that you look at the date which the file was last MODIFIED not CREATED. This was my mistake but then i used SpyHunter and it found the file for me which was the wzhtjqo.dll . I renamed it wzhjqo.doc and dragged it onto my desktop, and then i restarted my computer and deleted it. Now my computer is just fine. Thank you all very much!
20. Liam says:
    August 12, 2007 at 12:54 pm

    I discovered this early, and tried performing a system recovery to an earlier date. Surprisingly it worked perfectly, and it has worked for trojans I’ve had before. Is it really that easy? I was worried that maybe it just seemed to work and that perhaps the trojans are just hidden, so I reverted the system restore and removed it using the online advice.
    Just wondering, does a system restore really fix it?
21. casey says:
    August 12, 2007 at 6:40 pm

    does a system restore get rid of virusprotectpro? it did get rid of the flashing tool bar icon ,is that sufficent?
22. Brian says:
    August 14, 2007 at 5:25 pm

    added new dll: vpccw.dll
23. Andre says:
    August 14, 2007 at 5:26 pm

    Thanks! FINALLY, got rid of that bugger! That manual “attack” worked perfect. Especially the one where you sort .dll, identify, change name, reboot and volá:-)
    Lucky us, that there still are good guys out there….
24. Jason says:
    August 15, 2007 at 12:01 pm

    ryxrho.dll is the latest dll from VirusProtectPro.
25. kara says:
    August 16, 2007 at 11:57 pm

    hey. I have vista and it keeps giving me these pop-ups that reads “Windows Explorer has stopped working” and I’m unable to navigate the drives and documents once it appears. which happens about every 3 seconds. please help!
26. James Velten says:
    August 17, 2007 at 4:46 pm

    OK! I have XP so I don’t know if this will work for Vista PCs, but I installed the Spyhunter (freebee) and ran it. Then I ran regedit from “Run” and proceded to delete all the listings that Spyhunter was showing, but I still had the flashing icon in my tray. I did a search of each .dll file that is listed on this site (mine was the first one, thank god). I found it in the C:/windows/system32 folder and renamed the extension to .doc. At this point the icon was flashing but it looked different. After restarting the PC it was gone completely.

    Just be patient and start with the first .dll file and if that one doesn’t work search the next one and so on. Good luck and I hope I was some help.
27. Les says:
    August 18, 2007 at 11:17 am

    I just wanted to thank you for publishing this information … I couldn’t have managed without it. I got involved with this problem on an old Window 98 system — I never was much good with systemy stuff, even in the day, and have forgotten much of what I knew.

    This pc had only a low-grade infection, just the systray popup … I guess because it wasn’t able to install fully on Win98. What I had to get rid of was C:\WINDOWS\System\tmxxxh.dll … went into safe mode, renamed it tmxxxh.dll.bad, and everything seems fine now.

    You now have a place of honour in my bookmarks!!!
28. Loiro says:
    August 18, 2007 at 1:47 pm

    Latest DLL is tmxxxh.dll
29. JoeA says:
    August 19, 2007 at 8:31 pm

    I am stuck with aon old Windows 2000 machine that I need to clean.

    I found the malicious dll – fqdqs.dll, but I am not able to unregister it or even rename it. I get an error saying that Windows is using this file. I tried to bring up Task Manager but I am not seeing any of the VirusProtectPro processes or even other processes that wuld look suspicious.

    Yet, the annoying icon in the task bar is flashing and using IR or firefox is nearly impossible. Have downloaded Opera wich workswithout pops ups..

    I have run the SpyHunter Scan and I can see the offending bad files but Even in Safe Mode I am unable to rename or delete them.

    Any ideas, gurus?
30. William says:
    August 21, 2007 at 10:08 pm

    Thanks to all who posted here, help me remove VirusProtectPro. We a big pain in the butt.

    my process,

    1. Tried manual edits to registry, got some of them

    2. Deleted files in videoactivex, or similar name, directory (which was created upon infection

    3. Still had blinking shield.

    4. Purchaased SpyHunter, ran and caught remaining VirusProtectPro registry entries (that I had missed) (also found a bunch of other junk, cookies, and a reg entry)

    5. Still had blinking shield

    6. followed insructions here, found .dll by looking at date time created, not exact time of infection (off a few hours)

    7. Renamed xxx.dll to remove_xxx.dll

    8. Rebooted and worked.

    Thanks to all, apreciated.

    (PS, I have not unregistered the .dll, only renamed in the system32 directory. Am I ok, or do I still need to unregister?)
31. Alex says:
    August 23, 2007 at 3:19 pm

    okay this F***er has just got on my computer. could someone please explain to me what to do. i have very little experience with computers so could you explain it *as if to a child*
32. Tom says:
    August 24, 2007 at 9:39 pm

    if I download SPYHUNTER will it locate and remove this from my computer?
33. Ed says:
    August 25, 2007 at 10:24 pm

    People who write this virus should be put in jail! This is a devil to get out.

    For me, SPYBOT found and killed a lot of the stuff -but not all. I used SPYHUNTER to locate the registry entries. Then, I manually searched them out and deleted them by using REGEDIT. However, the annoying pop-up was still there. By searching all my .dll’s and checking the modified date, I found one for today in the SYSTEM32 directory. It was called Zdii.dll. I renamed it, moved it to the desktop, then deleted it – BINGO! No more pesky pop-up. And the computer starts fine.

    Lucky for me it was only 3-4 hours. I feel bad for the folks who are not computer experts.

    Good Luck
34. Jake says:
    August 31, 2007 at 12:07 am

    I’m having the same problem as Kara. I’m on Windows Vista Home Basic 32-bit, I caught the virus in an ActiveX installer, and now every 3 seconds a Windows Problem Report pops up saying “Windows Explorer has stopped working” and proceeds to restart windows explorer, closing all open windows explorer windows making it impossible to navigate any drives, control panels, or documents. Help anyone?
35. Charlie says:
    August 31, 2007 at 8:24 am

    I have removed all the above-mentioned files and have searched for all the .dll files, which none I can find so I assume they were removed by Spybot, Adware, SpywareBlaster and WinEnhance Clean Registry.

    Yet, the warning popup on the bottom right still appears. So, when I turn on the computer I right click the Task Bar, click “Customize” the Notification area and select Hide Always next to the warning icon which has “no title” (I have Windows XP).

    Does anyone have a permanent solution?

    There are no .dll files modified or created on the date of the infection in System32, but there are files modified at that time in the Viewpoint Media Player folder in the Program Files folder. I can’t delete that folder because AxMetaStream_0305000D.dll is being used. How do I get rid of this .dll and Viewpoint? Could this be causing my trouble with the popup warning icon on the Taskbar? And what is Viewpoint?
36. dracos says:
    September 1, 2007 at 11:23 pm

    i used spyhunter and it found 4 virusprotectpro instances in the registry which i removed but the icon was still there. i managed to track it back to c:\windows\system32\vvihh.dll (the only .dll file created in the last few days) i could not unregister the file and it was still in use while in safe mode. was able to delete in safe mode with command prompt. thankgod, that thing is annoying as hell
37. George says:
    September 2, 2007 at 3:08 pm

    PLEASE HELP!

    I’ve done everything that is suggested here and installed all the programs and deleted all the bad registry files and managed to contain the problem a bit but the VirusProtect icon is still in my task bar. I searched for all the .dll files written above and found nothing.
    But I found a file called “__c00EAAE8.dat” in the system32 folder which is from the exact date and time that VirusProtect attacked my computer but is not a .dll file.
    I’ve tried to rename it and delete it, even in safe mode, but it said the file is being used by another program (and the only active program in safe mode was that damn VirusProtect!).

    HijackThis writes about it -
    O20 – AppInit_DLLs: C:\WINDOWS\System32\__c00EAAE8.dat

    Is there a program or a way to rename an active file or somthing?
38. hem says:
    September 2, 2007 at 3:13 pm

    my window explorer has stopped working because of virusprotectpro how can i remove
39. TNT says:
    September 7, 2007 at 1:53 pm

    My task bar icon was driven by c:\windows\system32\iklqcx.dll, I sorted by date, renamed the file with a .doc extension, moved it to the desktop, restarted the computer, the icon disappeared, deleted the file, good to go. Also I did find a VirusProtectPro .exe file in folder named “Prefetch”, deleted that bugger also, so far no problems. I wonder how this thing is getting so imbedded in some systems and not others?
40. Adrian says:
    September 7, 2007 at 3:00 pm

    Try NoAdware v3.0 (older version, but good)

    TYPE Registry Key
    ACTION Deleted
    VALUE HKEY_CLASSES_ROOT\clsid\{d449eb58-55af-4695-b216-895d546aed89}

    TYPE Registry Key
    ACTION Deleted
    VALUE HKEY_CLASSES_ROOT\interface\{446761d5-3ac9-40cc-9dcd-cde23e2ce31a}

    TYPE Registry Key
    ACTION Deleted
    VALUE HKEY_CLASSES_ROOT\typelib\{b7db519e-7131-47b1-a9f5-da8d061c2611}

    TYPE Registry Key
    ACTION Deleted
    VALUE HKEY_CLASSES_ROOT\CLSID\{46f5a8b0-0b73-48c5-9e40-3c443a43c161}

    TYPE Registry Key
    ACTION Deleted
    VALUE HKEY_CLASSES_ROOT\CLSID\{46f5a8b0-0b73-48c5-9e40-3c443a43c161}\InProcServer32

    TYPE Registry Key
    ACTION Deleted
    VALUE HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{46f5a8b0-0b73-48c5-9e40-3c443a43c161}

    TYPE Registry Key
    ACTION Deleted
    VALUE HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{46f5a8b0-0b73-48c5-9e40-3c443a43c161}\InProcServer32

    TYPE Registry Value
    ACTION Deleted
    VALUE HKEY_CLASSES_ROOT\magnet\URL Protocol

    TYPE Registry Value
    ACTION Deleted
    VALUE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{46f5a8b0-0b73-48c5-9e40-3c443a43c161}

    TYPE File
    ACTION Marked for Deletion
    NAME muvdjo.dll
    PATH F:\WINDOWS\system32

    TYPE Cookie
    ACTION Deleted
    VALUE virusprotectpro

    Good Look!
41. bluberry says:
    October 8, 2007 at 5:53 pm

    For hem, Jake, Kara, and others with “Vista” that VirusProtectPro 3.7 has disabled Windows Explorer!
    The following worked for me..Start your computer in “Safe Mode” (Tap your “F8″ key before Windows starts loading, and use your up arrow key to select “Safe Mode” and press “Enter”}

    NOTE..The “Nag” that Explore.exe has been stopped will still pop up every few seconds, but you can keep closing the dialog box by clicking on the “X” in the upper right corner.

    You will have time to open “Internet Explorer” between the nags, and once you get Internet Explorer opened, you can actually still use it behind the nag screen. Type “C:\” (without the quotes) in the address bar and press “Enter” (It worked for me best when I kept closing the nag)

    Now you should see the contents of your “C” drive in explorer fashion…simply click on your “Windows” folder, and then your “System32″ folder. Now scroll down past the folders displayed here to find the FILE named “ddllup.dll” (Keep closing the “Explorer Nag as it pops up).

    Highlight the ddllup.dll file (Make sure it is the ONLY FILE HIGHLIGHTED) and press the “Delete” key on your keyboard…VIOLA…your nag has been killed, and you have your “Windows Explorer” function-ability restored. (ddllup.dll is responsible for “unregistering” your “explorer.exe”.

    Now you can access your computer, and follow the advice of the FINE people in these forums

    I personally downloaded the “Free-SpyHunter-Scanner” (Links supplied in these forums). My scan is not completed as I type this, but any and all further info for complete removal of this “GARBAGE” is to be found in these excellent forums…THANK YOU ALL FOR YOUR TIPS AND EXPERTISE!! bluberry
42. bluberry says:
    October 8, 2007 at 5:55 pm

    For hem, Jake, Kara, and others with “Vista” that VirusProtectPro 3.7 has disabled Windows Explorer!
    The following worked for me..Start your computer in “Safe Mode” (Tap your “F8″ key before Windows starts loading, and use your up arrow key to select “Safe Mode” and press “Enter”}

    NOTE..The “Nag” that Explore.exe has been stopped will still pop up every few seconds, but you can keep closing the dialog box by clicking on the “X” in the upper right corner.

    You will have time to open “Internet Explorer” between the nags, and once you get Internet Explorer opened, you can actually still use it behind the nag screen. Type “C:\” (without the quotes) in the address bar and press “Enter” (It worked for me best when I kept closing the nag)

    Now you should see the contents of your “C” drive in explorer fashion…simply click on your “Windows” folder, and then your “System32″ folder. Now scroll down past the folders displayed here to find the FILE named “ddllup.dll” (Keep closing the “Explorer Nag as it pops up).

    Highlight the ddllup.dll file (Make sure it is the ONLY FILE HIGHLIGHTED) and press the “Delete” key on your keyboard…VIOLA…your nag has been killed, and you have your “Windows Explorer” function-ability restored. (ddllup.dll is responsible for “unregistering” your “explorer.exe”.

    Now you can access your computer, and follow the advice of the FINE people in these forums

    I personally downloaded the “Free-SpyHunter-Scanner” (Links supplied in these forums). My scan is not completed as I type this, but any and all further info for complete removal of this “GARBAGE” is to be found in these excellent forums…THANK YOU ALL FOR YOUR TIPS AND EXPERTISE!! GOOD LUCK…bluberry

Speak Your Mind Cancel reply