Windows Shielding Utility

Posted: April 3, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	10,359
Threat Level:	2/10
Infected PCs:	2,956

First Seen:	April 3, 2012
Last Seen:	October 16, 2023
OS(es) Affected:	Windows

Windows Shielding Utility is a fresh off the presses re-cloning of older scamware products from the Win32/FakeVimes classification of PC threats. While Windows Shielding Utility's appearance is all about providing security features like system scans and memory process monitoring, Windows Shielding Utility's real functions are focused on displaying inaccurate warnings and misleading you about your computer's state of integrity. The criminal developers behind Windows Shielding Utility and the rest of the FakeVimes group of rogue anti-virus products hope to use this pretense of security to steal your money and financial information, but SpywareRemove.com malware researchers recommend a different course of action – deleting Windows Shielding Utility by way of a genuine anti-malware scanner. Until you get rid of Windows Shielding Utility, your PC will also suffer through browser redirect attacks and problems with accessing unrelated security programs that place the system at a high level of risk for other attacks.

Windows Shielding Utility – Software with Fake Warnings for More Attacks Than You'd Think Were Possible

Windows Shielding Utility may include an unlikely amount of general security features that you wouldn't see on any popular anti-virus product, but that's because all of Windows Shielding Utility's features are equally fraudulent and equally useful to Windows Shielding Utility as pretenses to display inaccurate system information. Due to its Registry-based startup mechanism, Windows Shielding Utility will launch alongside Windows and, from that point onward, can create error messages, system scans and other types of informational displays that try to lure you into assuming that your PC is under attack by hordes of PC threats.

Security information that's provided by Windows Shielding Utility should always be ignored, since following the advice of rogue anti-virus programs like Windows Shielding Utility can lead you to damaging your PC for no reason. SpywareRemove.com malware researchers also warn against any attempt to waste money on Windows Shielding Utility's registration, although using the free registration code '0W000-000B0-00T00-E0020' can be helpful while you're attempting to remove Windows Shielding Utility.

Why Disrupting Windows Shielding Utility's Fake Security Could Save Your PC

Windows Shielding Utility is a clone of such disreputable fake AV programs as Privacy Guard Pro, PrivacyGuard Pro 2.0, Extra Antivirus, Fast Antivirus 2009, Presto TuneUp, Windows Security Suite, Smart Virus Eliminator, Packed.Generic.245, Volcano Security Suite, Windows Enterprise Suite, Enterprise Suite, Additional Guard, Live PC Care, PC Live Guard, Live Enterprise Suite, Security Antivirus, My Security Wall, CleanUp Antivirus and Smart Security. This includes more than just fake security information, but also:

Browser redirects that can block PC security websites or redirect you to harmful sites like Windows Shielding Utility's homepage.
Program-blocking actions that keep you from using various types of security programs, including some brands of real anti-virus scanners and Windows Task Manager.
The creation of fake PC threat files that Windows Shielding Utility identifies as infections after placing them in sensitive locations (such as your Windows directory).

Stopping these attacks by disabling Windows Shielding Utility's startup routine is highly recommended by SpywareRemove.com malware experts as a preliminary step before you delete Windows Shielding Utility. Since Windows Shielding Utility will do its best to avoid normal software removal methods, you should be prepared to use the same anti-malware programs that Windows Shielding Utility would like to block to help delete all components of a Windows Shielding Utility infection.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%DesktopDir%\Windows Shielding Utility.lnk

File name: %DesktopDir%\Windows Shielding Utility.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

%CommonPrograms%\Windows Shielding Utility.lnk

File name: %CommonPrograms%\Windows Shielding Utility.lnk
File type: Shortcut
Mime Type: unknown/lnk
Group: Malware file

%AppData%\npswf32.dll

File name: %AppData%\npswf32.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file

%AppData%\Inspector-[RANDOM CHARACTERS].exe

File name: %AppData%\Inspector-[RANDOM CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Inspector"

Additional Information

The following URL's were detected:

dnsvibes.co

The following messages's were detected:

#	Message
1	Error Attempt to modify registry key entries detected. Registry entry analysis is recommended.
2	Warning Firewall has blocked a program from accessing the Internet C:\program files\internet explorer\iexplore.exe is suspected to have infected your PC. This type of virus intercepts entered data and transmits them to a remote server.
3	Warning! Identity theft attempt Detected Hidden connection IP: 58.82.12.124 Target: Your passwords for sites

One Comment

Jetson says:

November 21, 2012 at 9:32 am

At last! Soemthing clear I can understand. Thanks!