Windows Shielding Utility Description

[+] Click Image to Enlarge

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

If you have installed Windows Shielding Utility on your computer, of if an application by this name has suddenly appeared on your hard drive, you may have become the target of a malware attack. ESG security analysts have issued a warning against rogue security programs in a large family of malware known as FakeVimes. Rogue security programs are applications that mimic the look of anti-virus or anti-malware programs, but that are actually part of a well-known scam. Windows Shielding Utility has been identified as one of these fake security applications. Rogue security programs in the FakeVimes family have been around since 2009 and include such bogus security programs as Windows Warding System, Windows Activity Debugger andWindows Trouble Taker.

Do not be misled by the different names that these fake security tools use; criminals create dozens or even hundreds of versions of the same malware infection, so it can stay ahead of PC security researchers, significantly increase the difficulty of removal and detection, and to target a wider population of potential victims. There are several characteristics that are unique to the FakeVimes family of rogue security programs, such as the use of file names made up of a string of three random letters preceded with either “protector-” or “inspector-” (in the case of Windows Shielding Utility) and the use of similar interfaces and the same fake start-up screen. However, in most regards, Windows Shielding Utility is very similar to most known rogue security applications in the manner of infection and in the scam that Windows Shielding Utility tries to carry out.

Taking a Closer Look at the Windows Shielding Utility Scam

The Windows Shielding Utility scam is simple: criminals create fake security programs like Windows Shielding Utility that cause problems on a computer system instead of fixing it. Whenever the victim tries to fix these problems, Windows Shielding Utility will claim that the computer user must purchase a “full version” of Windows Shielding Utility. These supposed “full versions” tend to be on the expensive side. ESG security analysts strongly advise against paying for Windows Shielding Utility or any of its clones. It has been reported that Windows Shielding Utility has no actual anti-malware or anti-virus capabilities. This program is designed to do two basic things: (1) display misleading error messages and fake system scans, and (2) try to convince the victim to purchase Windows Shielding Utility by directing them to the Windows Shielding Utility website through various means.

Type: Rogue Anti-Virus Program

How Can You Detect Windows Shielding Utility?

‘How Windows Shielding Utility Infects Your Computer’ Video

Windows Shielding Utility Removal Details

Windows Shielding Utility has typically the following processes in memory:

• %AppData%\Inspector-[RANDOM CHARACTERS].exe
• %AppData%\npswf32.dll

Windows Shielding Utility creates the following files in the system:

• %CommonPrograms%\Windows Shielding Utility.lnk
• %DesktopDir%\Windows Shielding Utility.lnk

Windows Shielding Utility creates the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Inspector”

Important Article Disclaimer