This is done by rebooting Windows and pressing F8 at boot/Windows startup, usually right after the beep. Find and delete this file: C:\Open the Smitfraud Fix folder again. Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.
The report can also be found at the root of the system drive, usually at C:\Warning : running option #2 on a non infected computer will remove your Desktop background. When rebooting (manually) into normal mode, Spybot warns about 5 registry changes as summarizied below:1-value deletedentry: windows FYold data: c:\WP.exenew data: grayed out2.-value deletedentry: Local Pageold data: C:\WINDOWS\system32\blank.htmnew data: C:\windows\system32\blank.htm3.-value changedentry: Start Pageold data: prd=4.-value changedentry: Start Pageold data: %systemroot%\system32\blank.htmnew data: C:\windows\system32\blank.htm5.-value changedentry: Start Pageold data: prd=Not knowing how to handle these reported registry changes, but assuming made these (valid) changes, I selected "allow" changes in Spybot for each one.Reboot a second time- hopefully you should not see these changes again. Thanks, Charles Hi Charles, Well it looks as though Windows FY is history.And after a Spybot reinstall, Spybot no longer detects (false? It also seems like I had a bad "Hosts" file wouldn't you say? The one replaced by "Hosts Xpert" has no sites listed to avoid.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon] "System"="" Registry Cleaning Registry Cleaning done. Attention, following keys are not inevitably infected!!! Ri Search Shared Task Scheduler's End ", followed by OK at the prompt. Can you also try uninstalling Spybot and then re-installing it again for me.Then reboot your PC, if it asks about the changes, please allow them.Please also remember to enable Spybot's "Immunize" and "Tea Timer" features.