Web Spy Shield
Web Spy Shield is a rogue computer security software that allegedly scan the system for viruses and spyware. But in reality, WebSpyShield will only display fake scan results in order to mislead victims and force them to buy the registered version of the program. Web Spy Shield virus was primarily developed to scam users and utilized an unfair marketing techniques to promote, spread and sell itself.
Screen Shot Image:
Damage Level: Medium
Systems Affected: Windows 9x, 2000, XP, Windows Vista
Technical Details and Additional Information:
What can Web Spy Shield do to infected computer?
- Display a warning about “Privacy violations detected.”
- This rogue application will constantly remind user to pay for the full version of the software.
Malicious Files Added by Web Spy Shield
%UserProfile%\Local Settings\Temp\[RANDOM NAME].tmp
%ProgramFiles%\WebSpyShield\
%ProgramFiles%\WebSpyShield\Uninstall.exe
%ProgramFiles%\WebSpyShield\WebSpyShield.dll
%ProgramFiles%\WebSpyShield\WebSpyShield.exe
%Windir%\system32\netsupp.dll
Associated Windows Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run\”WebSpyShield” = “%Program Files%\WebSpyShield\WebSpyShield.Web Spy Shield – Removal
Removing Web Spy Shield Manually:
1. If using Windows ME or XP, System Restore must be disabled to prevent the threat from restoring itself. [Windows XP System Restore]
2. Update the virus definitions.
3. Reboot Windows in SafeMode [how to]
4. Run a full system scan and clean/delete all infected file(s)
5. Delete/Modify any values added to the registry. [how to edit registry]
6. Exit registry editor and restart Windows.
Anti-virus Tools
In order to completely remove the threat from a system, it is best to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean PC and rename the executable file before executing on the infected machine.
Scan with Portable Antivirus:
Most of the time, Trojan associated with a rogue program will disable Windows functionalities and prevent execution of any application including antivirus program locally installed. If this happens, you can try using a McAfee Portable Antivirus called Stinger. It can be downloaded for free.