Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account

SpyCrush Removal Instructions (version 3)

- - - - -

  • Please log in to reply
2 replies to this topic



    Founder Geek

  • Administrator
  • 24,548 posts
Want to remove SpyCrush?


How-to remove SpyCrush from your system. SpyCrush version 3.1 and 3.2 are updates from an earlier rougue spyware application of the same name from February. Also the same application as as SpyDawn, SpyHeal, SpywareQuake, VirusBurst, & VirusBursters.

SpyCrush is often installed without consent through a trojan. Spycrush displays exaggerated or false reports of system errors and infections, then prompts the user to purchase a registered version to remove the purported threats. DO NOT purchase SpyCrush, remove it!

Luckily, S!Ri has made a tool that makes removing SpyCrush an easy, automated task. Simply follow the instructions below:

Download SmitfraudFix:

Use this URL to download the latest version (the file contains both English and French versions):

  • Search:
    • Double-click SmitfraudFix.exe
    • Select 1 and hit Enter to create a report of the infected files. The report can be found at the root of the system drive, usually at C:\rapport.txt
    Posted Image

  • Clean:
    • Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually)
    • Double-click SmitfraudFix.exe
    • Select 2 and hit Enter to delete infect files.
    • You will be prompted: Do you want to clean the registry ? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection.
    • The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer Y (yes) and hit Enter to restore a clean file.
    • A reboot may be needed to finish the cleaning process. The report can be found at the root of the system drive, usually at C:\rapport.txt
    Posted Image

  • Optional:
    • To restore Trusted and Restricted site zone, select 3 and hit Enter.
    • You will be prompted: Restore Trusted Zone ? answer Y (yes) and hit Enter to delete trusted zone.
process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Posted Image Has SmitFraudFix helped you? A tool like this takes a lot of time to keep updated. Please consider a donation to S!Ri so he can continue his hard work. :whistling:

Are you still having problems with SpyCrush, or other malware on your system? Please start a new topic in our Malware Removal Forum, after following these instructions.

Other references:
SpyCrush @ Sunbelt Software | SpyCrush @ Symantec | SmitFraudFix | spycrush.com (don't visit!)
  • 0




    Founder Geek

  • Administrator
  • 24,548 posts
This topic has been left open to allow specific questions and comments related ONLY to this guide. It's NOT for posting HJT logs, links to your logs, or any other general malware help. Replies not following these rules will be deleted. Thanks for your cooperation.
  • 0



    New Member

  • Member
  • Pip
  • 9 posts
This is probably going to make you laugh, but what happens if you buy "VirusBurst" or one of the other fake programs? I barely managed to talk a friend of mine out of purchasing that particular program, so I was curious as to what the outcome would have been.
  • 0

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.