Remove SpyCrush. Description and removal instructions

 
Title: SpyCrush

Type: Trojans
Severity scale:SpyCrush severity is 60  (60 / 100)
 
SpyCrush is a trojan that displays an icon in the system tray. This icon shows a message saying that the compromised computer is infected with dangerous viruses and asks the user to download and install a removal program, which actually is SpyCrush, the same named corrupt illegally distributed spyware remover. Once the user clicks on that message, the trojan opens a web site distributing SpyCrush. It may also attempt to download the application without asking for user permission. The trojan is able to change the Internet Explorer default home page, redirect the web browser to malicious web sites, download and install other parasites. SpyCrush automatically runs on every Windows startup.


Related files: spycrush.exe, syycum.dll, spycrush 3.1.exe, ckimzeb.dll, gbjkog.dll, gsrnxgh.dll, iauoi.dll, yesgnhr.dll, spycrush 3.2.exe

SpyCrush properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Automatic SpyCrush removal:

remover for SpyCrush

SpyCrush manual removal:

Kill processes:
spycrush.exe, spycrush 3.1.exe, spycrush 3.2.exe
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpyCrush
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpyCrush 3.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{5BF53D50-B1EC-47B6-A00A-0BD32BAEB7EF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{6F396A67-F473-48C9-9950-636CE17E584E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{C704547B-26C0-4222-A034-81653C07B494}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\{6076D2B1-634C-4685-843B-F826045EA5DC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\spycrush.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\spycrush 3.1.exe
HKEY_CLASSES_ROOT\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5BF53D50-B1EC-47B6-A00A-0BD32BAEB7EF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F396A67-F473-48C9-9950-636CE17E584E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C704547B-26C0-4222-A034-81653C07B494}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{14D6736F-9918-46D2-A96B-75713158DC9C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{33220D50-BB09-4F83-ABC2-E94011D088B5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{35A2B3DD-3B38-4E9E-A547-6E459A6E91AA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{472B58B5-B00C-4DC5-83ED-FE8185FFBCBE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4CB98812-6071-4D01-BC87-7E2CECB9C248}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DBE72DB-B023-47C2-AB01-D2323AADFA5A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{60F366A1-5D3B-4D3E-ACE3-CB8C25474FF6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{754E70B2-E0DF-45CE-9429-CCFE0DD7AEA5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7583195C-5F83-4AD6-82D1-3C2F553F93E2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77CAC444-50CC-4E1C-955C-55E325360864}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7DF4D9FC-1B6F-4093-8BC7-6A0F750B59D8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91EF3AD8-9373-4B3F-AAF5-2984E3E34385}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAD385C7-7B45-43FC-BF4E-EABB990337FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EC2A49C8-5970-4DA5-B784-32CD8617B6B8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F3FAE2B3-0961-40A7-94C7-67A28967BE58}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FB65F713-07A1-404D-889A-5789E383AB02}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3C4CCBFA-2ADA-43F3-9A40-F729DD31EC5A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{661173EE-FA31-4769-97D4-B556B5D09BDA}
HKEY_LOCAL_MACHINE\SOFTWARE\SpyCrush
HKEY_LOCAL_MACHINE\SOFTWARE\SpyCrush 3.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyCrush
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyCrush 3.1
Unregister DLLs:
ckimzeb.dll, gbjkog.dll, gsrnxgh.dll, iauoi.dll, syycum.dll, yesgnhr.dll, cdwvhbf.dll, tczij.dll, xikor.dll, igpfced.dll, iwwvh.dll, xedasn.dll

Delete files:
spycrush.exe, spycrush 3.1.exe, spycrush 3.2.exe, ckimzeb.dll, gbjkog.dll, gsrnxgh.dll, iauoi.dll, syycum.dll, yesgnhr.dll
Delete directories:
C:\Program Files\SpyCrush
C:\Program Files\SpyCrush 3.1
C:\Program Files\SpyCrush 3.2
Misc:
Exact file location:
spycrush.exe - C:\Program Files\SpyCrush
spycrush 3.1.exe - C:\Program Files\SpyCrush 3.1
spycrush 3.2.exe - C:\Program Files\SpyCrush 3.2
ckimzeb.dll, gbjkog.dll, gsrnxgh.dll, iauoi.dll, syycum.dll, yesgnhr.dll - C:\WINDOWS\System, C:\WINDOWS\System32 or C:\WINNT\System32


Domain Name: SPYCRUSH.COM (195.225.177.53)
Registrant:
ODS ltd
Robyn Turner (turnrobyn@gmail.com)
Level 11 Toowong Tower
9 Sherwood Road
Toowong
null,Qld 4006
AU
Tel. +61.38761200

AVOID THIS DOMAIN AND THIS IP! Better block them in your Hosts file.
SpyCrush Removal Guide

Other programs to remove SpyCrush:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 10/02/07
Information updated: 24/06/07

Additional resources related to SpyCrush:

Attention: If you know or you have a website or page about SpyCrush removal, feel free to add a link to this list: add url




more resources

Post Comment:

Attention: Use this form only if you have additional information about SpyCrush parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.



Enter security code:

Related news:
Similar parasites:
Related discussions: