Spyware removal - ivejzcmf.dll

[geezerone]

Hi

Managed to get some spyware installed "ivejzcmf.dll" is one file and managed to delete using Linux as the file was being used by IEXPLORE.EXE and couldn't remove in Windows even in Safe Mode. After reboot the files are back.

Anyone had any experience with this file and if so what removal technique did you employ.

I have tried Spyware Doctor and Spyware Terminator which got rid of most but a few remain.

I suspect a disk drive format is the only real way to do this but a real pain as it takes hours to install everything back

TIA

[godsdog]

I suspect a disk drive format is the only real way to do this but a real pain as it takes hours to install everything back

Maybe - Probably - Maybe not

It wouldn't kill you to run a fully updated Spybot in safe mode as well. Stick a HijackThis log file down if you haven't already fixed it / reinstalled, see if there's anything glaringly obvious that sticks out.

[directhex]

the big problem is when there's a chain of issues

your dll file is randomly named, and created by something else more insidious

you'll be looking for DAYS to track down the real problem, and might never find it

[iranu]

Normally you have to disable system restore (win xp) before a reboot into safe mode before trying to get rid of a virus/trojan. As directhex says it's a random file name.

Spybot S&D, Hijackthis and adaware 2007 are the first things to run. Hijackthis logfile can be uploaded here for automatic analysis.

[godsdog]

Those HJT auto analysis readers have got a lot better, It's still worth a look at the log file, he might drop lucky with a relatively benign infection that can be nailed in a couple of moves. It's a poor man's crapshoot though and getting progressively worse.

[Max Tractor]

download A Squared/2 system restore off/safe mode, either try a full scan or your windows/system 32 folder

[geezerone]

Thanks for the replies.

I unregistered the parent dll to allow the anti-spyware program to remove it and then ran a full scan to remove the remaining files created. Will try a 'Hijack this' soon.

Thanks again.