How to Remove Winstall.exe / SpySheriff

Winstall.exe is part of a program called SpySheriff which is a fake anti-spyware program that is designed to fool users into paying for a full version of the program in order to remove a supposed infection which the ‘free version’ put there in the first place. Here are the removal instructions for SpySherrif / Winstall.exe.

This infection displays a message that is designed to look like it is part of the inbuilt Windows XP Security Center. Up the top it has the Internet Explorer security warning bar which says “Warning: possible Spyware or Adware infection! Click here to scan your computer for Spyware and Adware…”

View Full Size

• First you will need to print out these instructions as you will be required to close all windows in order to do the fix.
• Now, download SmitFraudFix.zip and save it to your desktop. Once it has downloaded, double click on it which will extract it. Do not run the actual program yet as it must be done in safe mode.
• Load into Windows Safe mode by restarting the computer and just before the Windows XP screen comes up, press F8 and choose safemode.

Once in Safemode:

• Close all open windows and open the SmitFraudFix folder which is on your desktop and double click the SmitFraudFix.cmd file which will start the removal process. This whole cleanup process can take a few hours depending on your computer so please be patient.
• You will see a blue screen with white text with a series of options, Press number 2 on your keyboard and press Enter key which will choose the “Clean (Safe mode recommended)” Option.
• The program will go though a series of processes to clean your computer including the disappearance of your desktop icons for a split second. One it is finished it will open up the Disk Cleanup program. This will clean up all Temporary Internet Files, Temp folders and other files which may have been left over by the infection. When it is finished it should close automatically.
• When Disk Cleanup is complete you will be given the option “Do you want to clean the registry? Y or N”. Press the Y button on your keyboard and press the Enter Key
• When the registry cleanup is finished you will get a red screen which will say “Computer will reboot now, Close all Applications”. Press Spacebar and let it restart the computer. Once rebooted you will be shown a log file with a list of all the files that were removed. Close this.
• You should now have succesfully removed the Winstall.exe / SpySheriff Infection
• Be sure to visit the Windows Update site at http://windowsupdate.microsoft.com and get all critical updates to minimise your chances of getting this again.