System Alert Popup Removal Instructions for Windows XP or Vista

Are you one of those who got the annoying and blinking system alert popup on the taskbar? If you are, then you are in the right place. We are going to tell you what they are and how to get rid of them safely.

The rapidly-developing Internet has posted a lot of threats to our daily online activities and securities. To name a few, spyware, adware, Trojans and viruses…etc. They can potentially steal your data or even bring down your computer. Fake or false system alert popup, one of many syndromes of the potential threats you might see, is usually installed via a Trojan called Zlob (Trojan.Zlob). Most people get the Zlob Trojan by installing a video codec from one of those social networking sites such as MySpace. The Zlob Trojans then generates fake system popup alert to trick you into buying of their products, for examples, AntiVirGear, VirusProtect, SpyLocked, AntiVermeans, Spydawn…etc. To remove them completely, it takes time and some basic computer skills. Here’s how you do it:
Download SpyHunter* Spyware Detection Utility

Manual Removal Instructions: (for Windows 2000/XP/Vista)

Stop the following running Processes if Exists:
(Learn how to stop a process)
spydawn.exe
pesttrap.exe
antivermins.exe
AntiVerminsPro.exe
spywarequake.exe
dfrgsrv.exe
mscornet.exe
mssearchnet.exe
nvctrl.exe
spyfalcon.exe
ismon.exe
isnotify.exe
issearch.exe
pmmon.exe
pmsngr.exe
pmsnrr.exe
regperf.exe
nvctrl.exe
ishost.exe
spylocked.exe
SpywareLocked.exe
Spy-Locked.exe
SpywareLock.exe
SpywareLocked 3.5.exe
SpyLocked 3.6.exe

  • Unregister the following DLL Files if exists:
    (Learn how to unregister a dll file)     

    msvcp71.dll
    higehsg.dll
    xkrdk.dll
    cthkpcv.dll
    axlet.dll
    heur003.dll
    heur002.dll
    heur001.dll
    heur000.dll
    dxmpp.dll
    Ygjun.dll
    yuspej.dll
    czxtyx.dll
    bpvol.dll
    splug.dll
    dxovx.dll
    lcsrsrv.dll
    Ygjun.dll
    yuspej.dll
    czxtyx.dll
    bpvol.dll
    splug.dll
    dxovx.dll
    lcsrsrv.dll
    iesplg.dll
    uimcu.dll
    ginuerep.dll
    higjxe.dll
    bolnyz.dll
    wfkduei.dll
    winrge32.dll
    ywbicim.dll
    wfkduei.dll
    hvnwm.dll
    imfdfcj.dll
    yhbdupd.dll
    tahxqcj.dll
    qvjpt.dll
    oyopu.dll
    yronl.dll
    isadd.dll
    pkgvyg.dll
    qzviz.dll
    tahxqcj.dll
    qvjpt.dll
    oyopu.dll
    yronl.dll
    isadd.dll
    pkgvyg.dll
    qzviz.dll
    iesbpl.dll
  •  

  • Remove the following Registry Values if Exists:
    (Learn how to delete a registry value)
    HKEY HKEY_LOCAL_MACHINE\SOFTWARE\SpyDawn
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion \App Paths\SpyDawn.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion \Uninstall\SpyDawn
    HKEY_CLASSES_ROOT\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{661173EE-FA31-4769-97
    HKEY_LOCAL_MACHINE\software\antivermins
    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\antivermins.exe
    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run antivermins
    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\antivermins
    HKEY_CURRENT_USER\Software\SNO2 HKEY_CURRENT_USER\Software\PestTrap
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpywareQuake
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D
    HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake\refid:”1″
    HKEY_LOCAL_MACHINE\SOFTWARE\SpywareQuake\Language:”1033″
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpyQuake2.com
  •  

  • Find and Delete the following Files if Exists:
    msvcp71.dll
    higehsg.dll
    xkrdk.dll
    geplxss.dll
    tvomnc.dll
    hjpprpu.dll
    cvnzie.dll
    kuhmk.dll
    msvcr71.dll
    msvcp71.dll
    rosdzop.dll
    vwfps.dll
    kcaofg.dll
    cthkpcv.dll
    axlet.dll
    heur003.dll
    heur002.dll
    heur001.dll
    heur000.dll
    dxmpp.dll
    ismon.exe
    isnotify.exe
    issearch.exe
    pmmon.exe
    pmsngr.exe
    pmsnrr.exe
    regperf.exe
    nvctrl.exe
    nvctrl.exe
    ishost.exe
    ginuerep.dll
    oqipt.dll
    iqzv.dll
    htey.dll
    ulztc.dll
    oerucu.dll
    sbnudh.dll
    fyhhxw.dll
    appmagr.dll
    reglogs.dll
    twain32.dll
    higjxe.dll
    bolnyz.dll
    wfkduei.dll
    winrge32.dll
    ywbicim.dll
    wfkduei.dll
    hvnwm.dll
    imfdfcj.dll
    yhbdupd.dll
    spydawn.exe
    pesttrap.exe
    antivermins.exe
    AntiVerminsPro.exe
    spywarequake.exe
    dfrgsrv.exe
    mscornet.exe
    mssearchnet.exe
    spyfalcon.exe
    spywarequakeinstaller.exe
  •  

    That’s it! In order to avoid the malicious spyware and adware in the future, educating yourself and be careful with ActiveX and JavaScript plugins. Having a good surfing habbit essentially save you money and keep you out of troubles!  

    Good luck!

     

    By

    Comments

    1. jj2smiles says:

      thank u for the instructions. it took me a couple of hours but i did successfully remove the pop-up.

    2. Brian says:

      We are glad it works! 🙂

    3. Jeremy Shotts says:

      I have removed all vestiges of the ZLOB infection, except for the irritating pop-up, which I suspect is connected with the installed program “System Alert Popup” which cannot be removed via the Control Panel. Have searched registry for the DLLs you list and deregistered the only one I found, msvcp71.dll. Have since found 3 copies of the dll file itself, including one under the Symantec program directory and one under Adope Photoshop. However I am now concerned about deleting any of these because, the files are dated prior to the infection, and a search on the web shows that this dll is a legitimate part of Microsoft’s C runtime library, and that it’s removal is likely to be harmful. Could you explain how this can be safely handled?

      thanks

      Jeremy

    4. SvendK says:

      Hi, I found quite a lot of the msvcp71.dll file:
      %programdir%\Autodesk\Autodesk DWF Viewer
      %programdir%\Autodesk\Autodesk DWF Viewer\Ecomposite
      %programdir%\Autodesk\Autodesk DWF Viewer\emap
      %programdir%\Diskeeper Corporation\Diskeeper
      %programdir%\Common files\Autodesk Shared\dwf common
      %programdir%\Games\Battlefield 2
      %windir%\system32

      Should I really remove all these files?

      I’d be happy, if you would mail me the answer to “sager underscore svend at hotmail dot com”

      Kindest regards
      SvendK

    5. Rogelio says:

      Can somebody post the process of how to remove the pop-up?

    6. Felico says:

      Thank you for bringing such an informative website with steps on removing the spywares.

      Unfortunately as it so happens. They are improving their ways.

      there is a different system alert spyware. & it is in the form of a Help question & a No cross Sign..

      If you can show me how to remove this it would be much appreciated. All the DLL & spylocked files in registry are nowhere to be found. thank you

    7. chinmay says:

      I have XP installed.I by mistake installed some Video activeX control.Then even if i removed it i can still see the processes running i.e isadd.dll,isamini.exe,isamntr.exe,pmmnt.exe,pmsnrr etc.If i try to terminate the process it terminates but again appears in 1-2 seconds.I get system alerts saying that some trojan exists.Let me know what to do.

    8. Bo L says:

      very informative…
      i searched through my files to look for any of the .dll files and I came across the hjpprpu.dll…things is, it says “access denied – make sure disk is not full or write-protected and currently not running”…why is that? and thanks

    9. Brian says:

      Bo L,

      As many have said, you can boot your PC into Safe Mode, then rename your dll (hjpprpu.dll) into something like hjpprpu.bad, then reboot your PC again. Then you can delete them safely. Hope this helps.. good luck!

    10. Ned says:

      This process works it just taked a while.

    11. mahesh says:

      thanks a ton dude !!!! i’ve downloaded spyhunter and it is doin its job, i think this should solve the problem……. fingers crossed. still don’t know how long i have to w8.

    12. shen says:

      and read this..

      [quote=”jack_p from here“]
      I was attacked by this spyware a day back. Googled and tried every possible solution. Let me tell you, they all are extremely painstaking & time-consuming viz. installing, configuring & following those steps. But what frustrates is none worked. I personally tried this simple alternative and wow !!

      -> Go to Folder Options and check “Show Hidden/System Files”
      -> Go to C:/windows/system32.
      -> Change the view to “Details” and sort by Modified Date.
      -> Locate any DLL files with the modified date as to when the problem started occuring, it was khtbpdl.dll in my case. But its known to have different variations of DLLs.
      -> Copy it to a different location for backup sake.
      -> Reboot to safe mode and delete the DLL file from C:/windows/system32. Restart to normal mode.

      Job Done !
      [/quote]

    13. hanz says:

      hi am getting this pop up message saying that my system is infected and their is a lot of spyware running etc i did get it from a video codec which i download the files is iesbpl.dll and iesplg.dll….can anyone help please many thanks

    14. RK says:

      Hi,
      After trying about 4 other anti-virus programs, I paid the 29 bucks and loaded the spyHunter…..and It got rid of that flashing piece of crap that wormed its way onto my lower right hand corner of my desk top! So I would say its worth the price!

    15. Gabriel says:

      the pop-up is still here can you tell me which specific file i need to delete to get rid of it?

    16. mac says:

      hi

    17. Raja says:

      I tried all the mentioned things but of no avail. I tried to do in a different way. I installed FileMon in my machine to see which is the file which is accessed the most and specially just before the blip spound for the alert. The file name I found is C:\Windows\system32\zfaiqwr.dll. I could not delete the file as it was being by some process. So i opened a command prompt window and navigated to c:\windows\system32. Stopped explorer.exe from taskmanager. Now deleted the file zfaiqwr.dll from the mentioned location and started explorer.exe again. The fake alert is gone.

      It is highly probable that the dll file is different for different systems. I use a Windows XP machine.

      Thanks,
      -Raja

    18. matthew r uhlean says:

      DO NOT WANT PLEASE STOP.THANK YOU

    19. Shahooter the Owl (KPZSR1) says:

      This….IS…WAR *cocks Shotgun and shoots System Security*

    20. peeyush says:

      very informative…
      i searched through my files to look for any of the .dll files and I came across the hjpprpu.dll…things is, it says “access denied – make sure disk is not full or write-protected and currently not running”…why is that? and thanks

    Speak Your Mind

    *