My Security Shield Rogue Anti-Spyware - removal guide

My Security Shield

Created: 2010-08-10 06:51:52 Author: Gaby C.

Information about My Security Shield

My Security Shield is a rogue anti-spyware which is presented to be dedicated for cleaning PCs from viruses. However, in reality MySecurityShield has pretty much nothing connected to computers’ security and protection and seeks only to rip users off. At the beginning of its dirty activity, malware claims that there has been numerous viruses detected and then offers its victims to install commercial version for fixing everything. My Security Shield even redirects computer users to its official websites where they can make a purchase. However, only more viruses will be let inside after purchasing so called “full” version of My Security Shield.

The way how malicious software called My Security Shield is guided into the targeted PC is quite simple. Program is propagated via Trojans that succeed in finding security vulnerabilities. Once there, trialware configures itself to start upon each system start, so it could be capable to display these annoying pop-up ads telling about viruses, for example:

Warning! Virus detected
Threat Detected: Trojan-PSW.VBS.Half
Description: This is a VBScript-virus. It steals user's passwords.

Memory access problem
WindowsErrorForm has encountered a problem at address 0x1FC408.
We are sorry for the inconvenience.
If you see this error again, operational information can be irrevocably lost.

On getting people alarmed, My Security Shield will start scanning the system for viruses and then will promote its ‘licensed’ version. If you will only ignore such alerts and My Security Shield, eventually you will start getting more fake alerts and notifications from this cyber threat. So, don’t waste your time and remove My Security Shield as soon as you get the first notification from it.

My Security Shield Facts

For automatic My Security Shield removal, please download Spyware Doctor:

Spyware Doctor

My Security Shield pretends to increase security of your PC
My Security Shield free version will show popups, alerts and fake results to convince you to pay
My Security Shield creators will not deliver license keys upon paying or the full version will not be functional
My Security Shield might be used to download and advertise other malicious software
My Security Shield might disable some of your PCs or its programs functions

Manual My Security Shield removal instructions

Note: Manual removal of parasite My Security Shield is tedious and dangerous task if done incorectly. Stoping and deleting incorrect executables and DLLs, deleting registry entries might harm your PC. Thus we recommend using Spyware Doctor of PCTools for automatical scan and removal of computer parasites, or another reputable spyware remover.

1

Kill malicious Processes:

How to kill malicious processes

MS345d_2129.exe
DBOLE.exe
kernel32.exe

2

Unregister malicious Dlls:

How to unregister malicious DLLs

mozcrt19.dll
sqlite3.dll
fan.dll
PE.dll
std.dll

3

Remove malicious Registery entries:

How to remove malicious registry entries

HKEY_CURRENT_USER\Software\3
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\MS345d_2129.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=2129&q={searchTerms}"
HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=2129&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PRS" = "http://127.0.0.1:27777/?inj=%ORIGINAL%"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "control/7.02129"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "My Security Shield"
HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=2129&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = "no"

4

Remove harmful Files:

How to remove harmful files

c:\Documents and Settings\All Users\Application Data\345d567\
c:\Documents and Settings\All Users\Application Data\345d567\4475.mof
c:\Documents and Settings\All Users\Application Data\345d567\mozcrt19.dll
c:\Documents and Settings\All Users\Application Data\345d567\MS345d_2129.exe
c:\Documents and Settings\All Users\Application Data\345d567\MSS.ico
c:\Documents and Settings\All Users\Application Data\345d567\sqlite3.dll
c:\Documents and Settings\All Users\Application Data\345d567\BackUp\
c:\Documents and Settings\All Users\Application Data\345d567\MSSSys\
c:\Documents and Settings\All Users\Application Data\345d567\MSSSys\vd952342.bd
c:\Documents and Settings\All Users\Application Data\345d567\Quarantine Item\
c:\Documents and Settings\All Users\Application Data\MSHBXRCOBWS\
c:\Documents and Settings\All Users\Application Data\MSHBXRCOBWS\MSJYQMS.cfg
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\My Security Shield.lnk
%UserProfile%\Application Data\My Security Shield\
%UserProfile%\Application Data\My Security Shield\cookies.sqlite
%UserProfile%\Application Data\My Security Shield\Instructions.ini
%UserProfile%\Desktop\My Security Shield.lnk
%UserProfile%\Recent\cid.drv
%UserProfile%\Recent\CLSV.tmp
%UserProfile%\Recent\DBOLE.exe
%UserProfile%\Recent\delfile.sys
%UserProfile%\Recent\fan.dll
%UserProfile%\Recent\grid.sys
%UserProfile%\Recent\kernel32.exe
%UserProfile%\Recent\kernel32.sys
%UserProfile%\Recent\PE.dll
%UserProfile%\Recent\PE.tmp
%UserProfile%\Recent\runddlkey.drv
%UserProfile%\Recent\SICKBOY.drv
%UserProfile%\Recent\std.dll
%UserProfile%\Recent\tempdoc.tmp
%UserProfile%\Recent\tjd.sys
%UserProfile%\Start Menu\My Security Shield.lnk
%UserProfile%\Start Menu\Programs\My Security Shield.lnk

5

Scan your System:

Scan your System with free scanners for remaining computer parasites

*Name
*E-mail

Security Shield

Created: 2012-01-25 03:15:54 Author:Renata Mykolaityte

Security Shield is a rogue antivirus program that was designed by computer hackers in order to steal money from random computer users. The program imitates actions of security tool but in fact it has nothing to offer for the computer users and it only wants to get your money. The program is downloaded and installed to your system with the help of Trojan viruses. The application is configured to start automatically with each system reboot. Security Shield imitates looking for infections on...

Posted in: Rogue Anti-Spyware

No comments yet

The Shield Deluxe 2010

Created: 2010-08-31 05:57:29 Author:Gaby C.

The Shield Deluxe 2010 (also can be called TheShieldDeluxe2010) is a malicious digital impostor which later starts to mislead unaware PC users that they need to purchase it. It seems like hackers who developed this scam didn’t have to work hard because The Shield Deluxe 2010 applies the same distribution and commercial techniques just like any other rogue from its forerunners. This malware can get inside your computer without any permission asked with a help of trojan virus through...

Posted in: Rogue Anti-Spyware

No comments yet

Green Shield Antivirus

Created: 2010-09-03 08:27:43 Author:Gaby C.

Green Shield Antivirus is a typical rogue anti-spyware which must have been designed for the commercial reasons only. It applies all the malwares’ capabilities, so it can also be called deceptive, misleading and potentially harmful for your computer. Indeed, Green ShieldAntivirus gets on board unnoticeably for its victims because it uses Trojans that get on board undetected. Later on the infected machine, malware starts posing to check the system for viruses and runs a trustworthy...

Posted in: Rogue Anti-Spyware

No comments yet