Home Malware Programs Rogue Anti-Virus Programs Windows Shield Protector

Windows Shield Protector

Posted: February 4, 2011

Are you the sort of person who feels safe on the Internet because you don't download illegal files? If that describes you, then rogue software like Windows Shield Protector will make you want to step up your paranoia a notch! This piece of false security software can wiggle its way into your hard drive in any number of ways. Once inside your computer, Windows Shield Protector may take over your browser, interfere with legitimate programs, and constantly try to scam you out of your hard-earned money. Try not to get this infection in the first place, but if you do become a victim, be sure to uninstall Windows Shield Protector no matter what it takes.

From Whence Did Windows Shield Protector Come?

Windows Shield Protector began life in the hands of malicious hackers and their extensive malware development environment. From there, this foul rogue spread itself across the web in many different ways. Like many kinds of malware, it spreads through generic trojan-carried infection methods, but that's just its more direct entrance method. It also deceives users into thinking it's a genuine codec update, albeit one from an unofficial source. Windows Shield Protector even uses straight-out ads to cajole the user to download and install it willingly!

Although Windows Shield Protector only first appeared in 2011, it's already gathered a few minor name variations to continue faking legitimacy under. It's also known as Windows-Shield-Protector and WindowsShieldProtector, so don't think it's safe just because the spelling is a little tweaked.

How Windows Shield Protector Makes Itself Known

Although Windows Shield Protector's behavior isn't as totally destructive or crippling as it could be, it's still pretty unpleasant. It has a multitude of behaviors, all of them negative, and all of them focused on getting you to give the hackers who spawned it your credit card number. Avoid this at all costs, as Windows Shield Protector, like all rogues, can only offer problems rather than solutions. Windows Shield Protector has been known to:

• Hijack web browsers to redirect users to its own site.

• Create realistic looking pop-up windows.

• Create false alerts about nonexistent infections. Alerts are often high in urgency, implying that infections have stolen credit card information or modified crucial system files.

• Significantly delay and/or crash legitimate processes deliberately, to create a problem that Windows Shield Protector will then blame on the aforementioned fake infections.

All these disruptions are intent on leeching money from the user. Towards this end, even the error messages will contain notifications such as 'Click here to remove immediately with Windows Shield Protector' and similar minor variations. Because it interferes with the running of so many programs, you'll want to get rid of Windows Shield Protector as soon as you possibly can.

Scrubbing Your Hard Drive Clean of Windows Shield Protector

Removing Windows Shield Protector is a task that uses very standard methodology, once you're ready to do it. Don't be intimidated by its aggressive tactics in shutting down so many processes and redirecting your browser! All these attacks can be overcome with relative ease, since its grotesque workings are so similar to that of its relatives in the malware swarm.

To regain control of your browser, head over to 'Internet Options' in your 'Control Panel'. From 'Connections, ' click on 'LAN Settings' near the bottom of the window. Then simply uncheck the 'use proxy server' box, and once again you have control over which sites you go to. This is only a quick fix to a symptom, however, and not the solution to Windows Shield Protector itself.

To delete Windows Shield Protector properly, you should first reboot. While your computer is still booting up, tap F8 periodically until you see the Windows Advanced Options Menu. This will allow you to boot in Safe Mode, which will usually prevent Windows Shield Protector from running automatically. Your Internet connection will typically be unavailable during Safe Mode unless you choose the Networking variation of Safe Mode.

Once Windows is safely loaded, this is where your path forks. You can take the easy path, and use genuine anti-malware software to destroy the Windows Shield Protector. The riskier method, but sometimes the only one available, is to destroy all the diverse components of Windows Shield Protector yourself, without any help. This entails using Windows Search to track down each file and folder, and using the Registry Editor to get rid of each Registry entry. Fortunately, this isn't as difficult as it could be, since Windows Shield Protector reportedly creates relatively few files and Registry entries. Before performing either solution, however, check your running processes to be absolutely certain that Windows Shield Protector isn't running. If it is, it's unlikely that it will let you fully delete it. Done right, either branch in this path of solutions will boot Windows Shield Protector out of your computer for good.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = '%UserProfile%\Application Data\.exe'
    2 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
    3 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
    4 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'
    5 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
    6 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}%UserProfile%\Application Data\[random].exe

Related Posts

Loading...