WiniShield

8 August 2009 Rogue 0 Comment

WiniShield is a bogus computer security program that displays misleading alerts to scare computer users. On first stage of infection, when user visited a fake online virus scanner web site, it will initiate a virus scan and identify several threats. Next, the web site encourages visitor to download the trial version of WiniShield suggesting that it can remove threats once installed. When the software is loaded on to the PC, instead of removing viruses, it commences another scan and more security risks are again spotted. At this point, WiniShield assures that it can clean the system and eliminate all Trojans and viruses if the program is upgraded to full version.

During the time that this rogue program resides on computer, it continuously pop-up warnings and alert messages about potential unsecured activity. Some of which states that the computer is severely infected or under virus attack. All of these revelations aims to deceive user and tries to convince that a purchase of WiniShield is necessary to eliminate every single Trojans, viruses and spyware. In reality, WiniShield has zero capability to carry out security inspection.

You must realize that WiniShield is a threat itself. In the first place, it manages to get inside your computer without consent. The program is so harmful that it will sneak into the computer and manipulate systems operation for its own deceptive method.

 

Screen Shot Images:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Characteristics (Analysis)
This rogue program will add the following registry entry so that it runs every time Windows starts.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “WiniShield”

Malware Behavior

• This potentially unwanted application do not reproduce.
• It has no tendency to infect other files once it gets inside the system. However it may connect to a distant host to download additional threats.
• WiniShield do not spread on a network-connected computer.

Added Registry Entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "WiniShield" 
HKEY_CURRENT_USER\Software\WiniShield
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiniShield
HKEY_LOCAL_MACHINE\SOFTWARE\WiniShield
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WiniShieldSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WiniShieldSvc

Associated Files and Folders:

C:\Program Files\WiniShield Software
C:\Program Files\WiniShield Software\WiniShield
C:\Program Files\WiniShield Software\WiniShield\data.bin
C:\Program Files\WiniShield Software\WiniShield\license.txt
C:\Program Files\WiniShield Software\WiniShield\uninstall.exe
C:\Program Files\WiniShield Software\WiniShield\WiniShield.exe
C:\Program Files\WiniShield Software\WiniShield\WiniShieldSvc.exe 
C:\Documents and Settings\All Users\Desktop\WiniShield.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\WiniShield
C:\Documents and Settings\All Users\Start Menu\Programs\WiniShield\1 WiniShield.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\WiniShield\2 Homepage.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\WiniShield\3 Uninstall.lnk

1. Kill any running process that belongs to WiniShield.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for the following files and click End Task.
WiniShieldSvc.exe, WiniShield.exe

2. Delete all registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit. This will open registry editor.
- Find and delete the following:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "WiniShield"
- Close registry editor. Changes made will be save automatically.

3. Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please Update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.

4. Delete all files dropped by WiniShield.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Associated Files and Folders.'

Automatic Removal of WiniShield

In order to completely remove the threat, click here to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.