[tinkerbell]

Originally Posted by Emrys88

Step 1 : Use Windows File Search Tool to Find SpyShredder Path

Go to Start > Search > All Files or Folders.
In the "All or part of the the file name" section, type in "SpyShredder" file name(s).

To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.

When Windows finishes your search, hover over the "In Folder" of "SpyShredder", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete SpyShredder in the following manual removal steps.

"SpyShredder" files can be found in the directory path(s)

ProgramFiles\SpyShredder

Step 2 : Use Windows Task Manager to Remove SpyShredder Processes

To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC.
Click on the "Image Name" button to search for "SpyShredder" process by name.
Select the "SpyShredder" process and click on the "End Process" button to kill it.
Remove the "SpyShredder" processes files:

SpyShredderSetup[1].exe
SpyShredder.exe


Step 3 : Use Registry Editor to Remove SpyShredder Registry Values

To open the Registry Editor, go to Start > Run > type regedit and then press the "OK" button.
Locate and delete the entry or entries whose data value (in the rightmost column) is the spyware file(s) detected earlier.
To delete "SpyShredder" value, right-click on it and select the "Delete" option.
Locate and delete "SpyShredder" registry entries:

SpyShredder

Step 4 : Detect and Delete Other SpyShredder Files
To open the Windows Command Prompt, go to Start > Run > type cmd and then press the "OK" button.
Type in "dir /A name_of_the_folder" (for example, C:\Spyware-folder), which will display the folder's content even the hidden files.
To change directory, type in "cd name_of_the_folder".
Once you have the file you're looking for type in "del name_of_the_file".
To delete a file in folder, type in "del name_of_the_file".
To delete the entire folder, type in "rmdir /S name_of_the_folder".
Select the "SpyShredder" process and click on the "End Process" button to kill it.
Remove the "SpyShredder" processes files:

SpyShredder.lnk
SpyShredderSetup[1].exe
SpyShredder.exe
SpyShredder

I am not an expert on computers at all so plz bear with me what do you mean save to clipboard i hope i can do this just by the nstructions you gave theres noone to hlep.

[tinkerbell]

I followed instructons and did the search and there were 9 files found.What do you mean when you say "into the path"?and which address bar the one that i type in for all websites?How do i save files path onto clipboard? Sorry to bombard you with questions its embarrassing enough that i dont know what i am doing.

[Emrys88]

Sorry, What i mean is copy the file location
E.g: c:\prgrams files\spyshredder

[evilfantasy]

PLEASE READ ALL OF THESE INSTRUCTIONS FIRST BEFORE DOING ANYTHING. Ask any questions that you may have before starting. You may want print out these instructions as you will not be able to see this page in safe mode.

Please reboot your computer in Safe Mode by tapping the F8 key just before Windows starts to load and selecting Safe Mode.
If you are having trouble starting the computer into Safe Mode: Starting your computer in Safe mode

Open the SmitfraudFix Folder on your Desktop, then double-click smitfraudfix.cmd file to start the tool.

Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

The tool will also check if wininet.dll is infected. If it is infected and a clean version is found, you will be prompted to replace the infected wininet.dll with the clean file. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. BUT Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed.

Now reboot into normal mode and attach this new rapport.txt log here.

WARNING Running this option on a non infected computer will remove the desktop background. So only run it once!

===============

Be sure to tell us how things are now.