My Anti Spyware

How to fix shell.exe, spoolvs.exe problem

Symptoms:

• Start > Settings -> Control panel is missing
• Task bar icons informing you of an infection and taking you to legit looking security panel
• System pop ups and IE pop ups
• When you start PC, you can get a message: “Windows cannot find ‘C:\Windows\shell.exe’ Make sure you typed the file name correctly….”

Download HijackThis and save the file to your desktop. Double click on the file for install.
Download CCleaner. Double click on the file for install.
Download SmitfraudFix (by S!Ri) Extract the content (a folder named SmitfraudFix) to your desktop.
Download VundoFix and save the file to your desktop.
Download SDFix and save the file to your desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix)

Boot your PC in Safe Mode.

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the first option, to run Windows in Safe Mode

Open the SDFix folder and double-click RunThis.bat.

• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt (Report.txt will also be copied to Clipboard).

Double-click VundoFix.exe to run it.

• When VundoFix opens, click the Scan for Vundo button.
• Once it’s done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
  Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.

Reboot in SafeMode again.
Open the SmitfraudFix folder and double-click smitfraudfix.cmd.

• Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).
• You will be prompted : “Registry cleaning - Do you want to clean the registry ?“; answer “Yes” by typing Y and press “Enter” in order to remove the Desktop background and clean registry keys associated with the infection.
• The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer “Yes” by typing Y and press “Enter”.
• The tool may need to restart your computer to finish the cleaning process; if it doesn’t, please restart it into Normal Windows.

Backup Your Registry with ERUNT

After that you should post your logs:

• hijackthis log
• smitfraudfix log (can be found at the root of the system drive, usually at C:\rapport.txt)
• sdfix log (usually at C:\sdfix\logReport.txt)
• vundofix log (usualy at C:\vundofix.txt )

to spyware help forum and wait answer (before you should create a free forum account).