Web Spy Shield

Updated: July 12, 2011 Rogue 0 Comment

Web Spy Shield is a rogue computer security software that allegedly scan the system for viruses and spyware. But in reality, WebSpyShield will only display fake scan results in order to mislead victims and force them to buy the registered version of the program. Web Spy Shield virus was primarily developed to scam users and utilized an unfair marketing techniques to promote, spread and sell itself.

Screen Shot Image:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Windows Vista

Technical Details and Additional Information:

What can Web Spy Shield do to infected computer?
- Display a warning about “Privacy violations detected.”
- This rogue application will constantly remind user to pay for the full version of the software.

Malicious Files Added by Web Spy Shield
%UserProfile%\Local Settings\Temp\[RANDOM NAME].tmp
%ProgramFiles%\WebSpyShield\
%ProgramFiles%\WebSpyShield\Uninstall.exe
%ProgramFiles%\WebSpyShield\WebSpyShield.dll
%ProgramFiles%\WebSpyShield\WebSpyShield.exe
%Windir%\system32\netsupp.dll

Associated Windows Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run\”WebSpyShield” = “%Program Files%\WebSpyShield\WebSpyShield.Web Spy Shield – Removal

Removing Web Spy Shield Manually:
1. If using Windows ME or XP, System Restore must be disabled to prevent the threat from restoring itself. [Windows XP System Restore]
2. Update the virus definitions.
3. Reboot Windows in Safe Mode.
4. Run a full system scan and clean/delete all infected files.
5. Delete/Modify any values added to the registry.
6. Exit registry editor and restart Windows.

Anti-virus Tools

In order to completely remove the threat from a system, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean PC and rename the executable file before executing on the infected machine.

Scan with Portable Antivirus:
Most of the time, Trojan associated with a rogue program will disable Windows functionalities and prevent execution of any application including antivirus program locally installed. If this happens, you can try using a McAfee Portable Antivirus called Stinger. You can download it for free.

Alternative Removal Method for Web Spy Shield

Option 1 : Use Windows System Restore to return Windows to previous state

If Web Spy Shield enters the computer, there is a big chance that Windows files, registry entries and other essential components are also infected. System Restore can reinstate clean system files by restoring the configuration to an earlier date. The method also replaces compromised files with a clean version. If you have a saved restore point before Web Spy Shield infiltrates the PC, we highly encourage you to execute this procedure if none of the above works. You may proceed with Windows System Restore, click here to see the full procedure.