Botched Spyware install prevents removal by spyware tools

May 4, 2009 4:34 PM

Zejesago! Everytime I open a new program, I get an error window that reads "app.exe - Bad Image" with a dialog text of "The application or DLL C:\WINDOWS\system32\zejesago.dll" is not a valid window image.

It started when I was on a streaming tv site combined with me forgetting that I temporarily disabled my firewall and my cpu load / disk drive monitors went crazy. I then canceled the weird processes that were running as the spyware was being installed, did spyware scans, and used startupcop to stop the programs from starting again. But one problem remains... every time I open a new program or a program opens a dll image for me, this dialog comes up. It's actually kind of neat, as I get to see what's doing what (i.e. GIMP is very dll happy). I think what happened is that I canceled the spyware from doing it's thing and prevented the zejesago.dll from being uploaded. Great, but it prevents the spyware tools from IDing the spyware.

Is it possible to get rid of this w/o reinstalling winXP? I hate doing that.

And yes, this is a case of knowing enough to be less than useless.

posted by sleslie to computers & internet (4 comments total)

I think a safe-mode boot is called for here.
posted by Chocolate Pickle at 4:58 PM on May 4

Also, using System Restore to retreat to a previous restore point could be helpful.
posted by Chocolate Pickle at 4:59 PM on May 4

A couple of things you might try if you're a little adventurous: delete C:\WINDOWS\system32\zejesago.dll, "app.exe" (search for it), and all references to zejesago.dll in the registry (run regedit to get to the registry editor). You might have to be in safe mode (as the Pickle says) to do these things.

As far as I know, editing the registry and removing files is all that the spyware-remover programs do.
posted by philomathoholic at 12:57 AM on May 5

regedit did it...

avgrsstx.dll ivaccq.dll,C:\WINDOWS\system32\zejesago.dll in the registry entry AppInit_DLLs

avg seems to be an antivirus program, ivaccq I can't find anything on the internet about, so it's gone, and our wonderful zejesago.

I most likely have an infected machine, but who doesn't these days?
posted by sleslie at 9:46 AM on May 5