Threat Database Rogue Anti-Spyware Program Windows Shield Protector

Windows Shield Protector

Windows Shield Protector is a fake anti-virus program which sneaks into PCs using a fake Microsoft Security Essentials (MSE) alert to fool unwary computer users to believe it is real. This is a misleading alert mimics the real MSE and is actually part of much larger online fraud activities designed to swindle money from innocent victims. The malware Windows Shield Protector uses will offer a system scan and prompt users to install Windows Shield Protector to be able to detect and remove the so-called viruses it finds on the system. This is all a blatant lie and should not be given any attention except to remove Windows Shield Protector as soon as possible.

Once a copy of Windows Shield Protector is installed, the same process will take place, but this time since Windows Shield Protector is already on the computer, it will advise users to purchase, via online payment, the registration key in order to make Windows Shield Protector functional. Windows Shield Protector cannot get rid of viruses it is a fake program designed to steal your money. The real and only solution is to remove Windows Shield Protector itself by using a genuine malware remover to run a full scan of the system and remove all the related malware associated with the rogue anti-malware application.

File System Details

Windows Shield Protector may create the following file(s):
# File Name Detections
1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe "Debugger" = 'svchost.exe'
2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger" = 'svchost.exe'
3. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe "Debugger" = 'svchost.exe'
4. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe "Debugger" = 'svchost.exe'
5. HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = '%UserProfile%\Application Data\.exe'
6. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe "Debugger" = 'svchost.exe'

Registry Details

Windows Shield Protector may create the following registry entry or registry entries:
%UserProfile%\Application Data\[random].exe

Related Posts

Trending

Most Viewed

Loading...