Security Shield 2011

I tried to close it and then delete it but it would not let me. I tried going to another useder’s account and that did not work ether. Last night I tried using safe mod (before I found this sight) but again no luck. It refuses to delete but I also don’t have it as a green shield (it is a green recycleing bin. I am using Windows 7. I use MBam for free. Please try and help! In order to come here I have to use my brothers computer.

I seem to have got rid of the virus because its letting me open up stuff now but I have no money to buy Stopzilla or Spyware Doctor but im currently using the free scan from Spyware Doctor. Will it be okay to leave it after the scan or will I have to do something about it?

Really good tutorial. I found the virus as rzzdqig.exe on my windows 7 box.

Thank you very much, it worked well for me. But the file’s icon was not a green shield, it was a kind of red “D” on a dark grey background.
But it was last modified today, it was under AppData/Local and it had a weird name like eernaaakdj, so I renamed it, I rebooted my computer, I deleted it worked! Thanks a lot.

Thank you very much, it worked well for me. But the file’s icon was not a green shield, it was a kind of red “D” on a dark grey background.
But it was last modified today, it was under AppData/Local and it had a weird name like eernaaakdj, so I renamed it, I rebooted my computer, I deleted it worked! Thanks a lot.

thank you so much, you guys are lifesavers

Help I can’t find the file

As the bottom of the guide states. Please enter more information so we can help.

thanx man i found that son of a bitch on my computer u guys are lifesavers for real

Take this crap off on my computer,I didn’t ask for it and it is jaming up my computer! This must be illegal and I will file a complaint to the proper authority if you don’t!

RemoveVirus.org is a Virus Removal website. We have several volunteers who donate hours of their time each week to help people remove virus infections. We do not create or distribute viruses. Read the virus removal guide to learn how you can remove this virus from your computer. I even spent hours tracking down this virus and create a video showing you how to remove this threat. Please read the guide before flaming.

RemoveVirus.org is a Virus Removal website. We have several volunteers who donate hours of their time each week to help people remove virus infections. We do not create or distribute viruses. Read the virus removal guide to learn how you can remove this virus from your computer. I even spent hours tracking down this virus and create a video showing you how to remove this threat. Please read the guide before flaming.

My task manager does not show a description only image name?

So what is your question? If you are asking should a description be there the answer is, It does not matter.

I can not find the file..where the video says the description is the same as the image name in the task manager.

I have XP and am having trouble finding it…Thanks

I looked at the video you have posted about Security Shield on Youtube. You explained it very concisely, and I congratulate you on that. However, when I opened my Task Manager, there was no 6-10 digit number. I searched on every possible option on the Task Manager, and it wasn’t there. I set the option for showing the hidden files and what was running on every account, and still, likewise happened. So, I did the other option that was for XP users. I do have a Vista, but I had no other option. After doing the steps the video showed, I found a file that had been recently used the day this all happened. Apparently, the same file name was running on the Task Manager. I terminated it, and the Security Shield went away. I afterwards deleted it. What happened to me was similar to what happened to Em. However, I have a question: did I do the right thing? After all, what I deleted did not have the Security Shield Logo, and there was no such thing on the App Data folder with the logo. Did I do it correctly?

Did you terminate it first?

Sounds like you did the right thing

Also good to terminate first if you can.

Why thank you.

Language please.

About the illegal thing, why isn’t Security Shield illegal? Does it really take out viruses if you buy it?

Excellent guide. Easy to follow, easy to delete.

i have the security shield virus on my other laptop and ive watched the help video and i cant find security shield when i search for it in the start menu and it wont let me use the task manager what should i do?

What have you done already in the guide? Did you check the folder paths?

i have already deleted it now but i didnt have an antivirus before i got the virus and now i cant connect to the internet

Did you already reset your proxy like the guide says? Easy way to do this is just reset IE.

does windows defender work to remove this

Thanks, this really helped!! Sidenote: my shield wasn’t green it was black in the appdata file

I tried to follow the guide (using W7) but when I went to go AppData file, it isn’t there. I also searched for Security Shield in my programs but it’s not there either. Help?

Have not tested Windows Defender against it.

Doing a search for Security Shield is pointless as it will not be named that. Also AppData is not a file, it’s a folder. To see the folder you should un-hide hidden files and folders to be able to browse to it. Or just manually type in the folder folder to the AppData. Will look like C:UsersJacobAppData except with your user name.

Yes, it works!!! I will be buying one of the recommended virus scans

Security shield wouldn’t let me start the task manager, so I tried searching the file in my computer and no matches were found! I tried multiple times and checked the spelling I don’t know what to do! please help

@ Rebecca – The same thing happened to me. Restart your computer and when it pulls up hit ctrl, shift, esc at the same time and the task manager should stay up.

I am curious on why the video shows that a commission is earned with Stopzilla but all I see advertised on the site now is Spyware Doctor?? I guess I’ll lean to Spyware Doctor.

thank you so much! but when I look at the processes and find matching or similar image name and description it doesn’t have the same location (I know it’s t not security shield). Is there a specific image name it has, or is it all random?

Thank you. You purchase of any of the recommended products helps to keep the virus removal guides coming.

What are you searching? The virus name mutates and changes for every user. Best thing to do is browse to the file paths shown in the guide. C:UsersJacobAppDataLocal or C:UsersJacobAppData . from there you can sort the files by date. You should only see a few files from around the date you were infected. Chances are one of them is named similar to jh34jh53jh45.exe . Basically just giberish. Re-name that file and re-boot.

It’s because Stopzilla pissed me off. Plain and simple don’t want to recommend them out. SDA I feel is a better client anyways so that is what I’m sticking with recommending.

All Random. However a better way to do this is to browse to the folder it’s most likely in and sort the files by date. From there you should be able to identify what the threat is. See one of my replies just a few seconds ago for more details.

Thank you for removing one of the sources of frustration in my now slightly less miserable existence!

I have XP operating system and i cant find a way to locate the virus in the first step do you have any suggestions?

Did you already look in the folder that is shown in the guide? IF so please copy the path in here so I can take a look at it to ensure you are looking in the right direction.

I have a security threat and tried to remove it but i can’t open the security sheild menu. I type in my “Start” for search but can’t find it.

Hi, I am trying to locate the folder to rename it and I do not see it anywhere. I have already selected the option to view hidden folders. I’m at the step where I go to my C: doc & settings , user folder, local settings, and app data there are a couple of other folders and a couple of icons but I do not see Security Shield. Help please!

Oh! I’ve found two black shields ! Didn’t know that was it slipped my mind ^.^

The YouTube video worked wonderfully!! Removed the virus in NO time!! Thumbs up!

Awesome. Done. Thanks for giving me my evening back…

I cannot find the shield icon/file in “local” or “roaming”. Where could it be. Is it definitely a shield icon? Or could it be a DAT file or a Configuration settings? I am stuck right now…

I have windows XP and I found the files by searching for all *.exe files created at the same date as the malware was installed. I found the files in the directory c:Documents and settingsusernameLocal SettingsApplication Data Trying to find the files by filename is not possible, since they seem to have different names each time.

What do you mean “box”? I cannot find the virus and need help to locate the file that most other people seem to be able to find quite easily.

Windows 7, booted into safe mode and I was able to use COMBOfix to remove this with no problem.

on mine it’s rfihn in appdata local- the icon is not a shield, it’s some little brightly colored square.

I was surprised to become infected with this just now. On Windows 7 it installed to C:Users[Username]AppDataLocalisxfy.exe
I also found a registry entry at:
HKEY_USERSS-1-5-21-1214436747-3549784325-1303464509-1000SoftwareClassesLocal SettingsSoftwareMicrosoftWindowsShellMuiCache
The key was named the same as the actual path of the file, “C:Users[Username]AppDataLocalisxfy.exe”

I hope this helps, I was lucky to discover the name of the executable easily by right clicking on it in the task bar. When I tried it a second time it hid the menu that would normally appear.

I found it with name: “byytdmd” from AppData/Local folder

FYI: Combofix should be used more as a last result. In 3% of cases it can cause your os / files to become corrupt.

Love it. Thanks for the tip. This is a great idea people. Use it!

The virus changes and mutates all the time. Think of the guide more as a master guide for removing this threat then an exact guide.

what is your OS

Have you looked at
XP: c:Documents and settingsusernameLocal SettingsApplication Data
Win 7 / Vista: C:Users[Username]AppDataLocal

Glad we were able to help sort your issue. If you have not already please like the page so others know the guide can be trusted.

I found the videos really help people. I get hate mail about them as well but for the most part they have many fans.

It will not be named security shield. Sort the files by date and you should vastly narrow down the file that it could be as you should know roughly the day you got infected. From there it’s normally easy to pick out the correct file and delete / rename it.

Rock on Rocky!

Don’t know what you mean by Security Shield menu. You do not need to go into that program to remove it. Doing a search is more or less useless as the name always changes. You can do a search for all .exe files and sort by date. From there you can see which .exe files match the day you were infected and remove / rename it from there. Other wise your best bet is to just follow the guide and browse to the correct folder and remove it from there.

In my case, files were xzingiah.exe and jguifo.exe.
Notice, that files were hiden, so you have to go to edit folder options, to see all files.
Use start-up safe mode to operate.

it wont let me do anything i think i have a new version i cant even open up task manager help please

Correct. Sound advise. Take note others, the file names will be different for you. Every install has a different name

As the guide states you most likely will not be able to open the task manager. Read through the guide, watch the video. If you get stuck let me know EXACTLY what you have done in the guide and were you are stuck at. Also need to know your OS. I can only help those who help themselves

figured it out thanks for the vid keep up the good work

On Win 7, if you start the task manager as soon as your computer loads, it will open. Security shield will still open but you can now stop it with your opened task manager.

IF YOU CAN’T OPEN TASK MANAGER on WINDOWS 7: Go to your start menu, select “Shut Down” or “Reboot” WITHOUT closing your programs. Security Shield will be the first program to close, and then you will be given the “Close programs?” warning message before the shut down/reboot completes. When you are offered this option, Cancel the shutdown. You should then regain full control of all your programs. Search your AppData for all .exe files, and sort files by date. This will make it easy to find any executables that appeared in the AppData within the range of time you were infected with the malware.

IF YOU CAN’T OPEN TASK MANAGER on WINDOWS 7: Go to your start menu, select “Shut Down” or “Reboot” WITHOUT closing your programs. Security Shield will be the first program to close, and then you will be given the “Close programs?” warning message before the shut down/reboot completes. When you are offered this option, Cancel the shutdown. You should then regain full control of all your programs. Search your AppData for all .exe files, and sort files by date. This will make it easy to find any executables that appeared in the AppData within the range of time you were infected with the malware.

Okay I’m on XP and Security Shield got onto my computer but it hasn’t gone active yet (I saw the message saying it was installed but it isn’t actually doing anything yet. I can’t find any of the files mentioned here. Any way to catch it while it’s napping?

Have you looked in the folders shown in the guide for XP? That is were you need to go. Sort the files by date and you should be able to narrow down what the .exe program is and delete it. As it’s not running I would recommend you go ahead and download and install an AV client like Spyware Doctor with Antivirus and run a full scan. This should also tell you exactly were the file is located and if you are infected with anything else.

I didn’t even use your latest 2011 video and there were some differences, but the principles of your instructions on the 2010 video allowed me to get rid of this disabling malware. I am most appreciative. Thanks Jacob.

Thanks so much. This nasty little bugger had my laptop tied up. But tooling through some of your options helped me find it and give it the boot. BIG Thumbs up!!!

I did it. Their icon changed though

The file was not easy to find. Even following these links and videos. I found a weird looking file in the Local folder. It’s icon was the recycle bin, it was a string of letters, “fmpfnkwz.exe”. I loaded up in safe mode, via msconfig.exe boot options.
Once in safe mode, I deleted this file, as nothing else looked as suspect as this. When I rebooted (after turning off safe mode boot in msconfig), the pc loaded normally. I downloaded antispyware, and avg free antivirus.
Antispyware detected 2 trojans, and bam cleaned that $%^& up quick smart.
Thanks for the info!

I am running Windows 7, but not finding any strange files in my AppData/Local folder. I have also looked in the Roaming folder and didn’t see any strange files. Should I be looking in the various folers in Local? Only the Temp folder has been created recently.

C:Users[Username]AppDataLocal is were this threat tends to be. It may be in a sub folder under local. Once you are in this directory sort the files/folders by date. From there you should be able to pick out the giberish file and remove it. You can also boot into safe mode with networking and install/update Spyware Doctor with Antivirus and run a full scan. This will show you were the file it located and you can manually delete it that way as well.

Lastly you can hit the Windows start button and type without the quotes “msconfig” Now go to the startup tab and look through your startup files. You should see a file in there that makes no sense and that has no Manufacturer. You can vied the location of the file under the command column.

Really great help, guys thanks!

FYI my file was called cbigo.exe and was 324 KB.

Thanks. I am in Safe Mode and running Spyware Doctor now.

After running msconfig, I didn’t see any suspicious files in the list of Startup files.

Glad we could help. Keep in mind others that the above file name will not be you file name. It should be used as an example. Great tip on the 324 KB. Should help some people out

Another tip is to search your whole computer for .exe and once done sort by date. If you know the day or around the day you were infected that should narrow down the .exe file to just a small handful of options.

Looks like this things keeps modifying itself…
*could not bring up task manger [blocked]
*not found when searching for “security shield” with windows search function
*In my Win 7 OS, do not see any .exe files in “C:Users[Username]AppData” folder (or Local or Temp subfolders)
*but do see the following in “AppData”:

“sdoqvgfbmc” (it reads as an application file, no explicit .exe extension)

*it is not a green shield icon, an icon that is mostly a blue square with a bit of green (looks like windows start menu icon)
*size 315 KB
*only one with date in last 2 days since infection showed up
->This must be the infected file in question, so I changed it, rebooted, and then deleted as instructed

Then after full scan (by AVG free), these 3 files were also removed:
-C:Users[Username]AppDataLocalTempLowaev.dll
-C:Users[Username]AppDataLocalTempLowaev.exe
-C:Users[Username]AppDataLocalMicrosoftWindowsTemporary Internet FilesLowContent.IE5KZE4FDNB7cca2[1].pdf

Of course other filenames and paths will undoubtedly continue to differ, but just to give others and idea of where it’s at in my case in Feb 2012.
Thanks very much for the help. Very useful.

Good to know. Thanks for taking the time to document and post your findings. It should help others. Just an FYI. As with most free clients, the free AVG Antivirus will not really protect your computer. Most people who end up on this site are using free based clients and that is why they keep coming back.

Was able to remove this by booting into Safe Mode with Networking and running Malwarebytes. Result:

Files Detected: 2
C:Users*****AppDataLocalsktqcuz.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:Users*****AppDataLocalLowSunJavaDeploymentcache6.035642a63-69b94953 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Been running fine since.

You guys totally saved me. Thanks a bunch

That is what we are here for. Glad removevirus.org was able to get you back on your way. If you can take a quick second and like the the site or make a post somewere about it. Every little link will help others find us when they need us.

in the video, the name in the task manager, i didnt have the same name that it had on the video. Help!

AS the guide says you are not going to. It is unique to every computer. View the steps in the manual guide and let me know if you get stuck. Be as specific as possible. The first step is to browse to the file paths shown in the guide according to your operating system.

The “how to” video really helped, however I have a couple of questions.
The guy on the video said to do a full virus scan and use Stopzilla or whatever
it’s called. I have McAfee, will that work? Also, for the disk cleanup part,
the temporary junk files that need to be taken care of, are those the ones
that are automatically checked in the box? How do I “clean” them?

Stopzilla is no longer recommended by removevirus.org for most threats. Spyware Doctor with Antivirus does a far better job. The newest version really rocks. Out of all the paid clients out there Mcafee is my least favorite. In many cases it misses a lot of these fake AV clients. I would at least run a scan with the free trail version of SDA to ensure you don’t have any other threats.

In most cases the temp files are removed when you run disk cleanup. Not all of them but the ones were the viruses hide out at are generally purged.

Please help with this. I don’t know if I still have Security Shield inhabiting my computer.

At first, I thought I had the virus. It had the icon, the browser and everything, it also kept throwing stupid warning messages at me.
After a failed attempt to open Task Manager, I opened my Anti-virus, setting it to Full Scan then proceeded to stare at it for roughly an hour. After it was done, It showed that there were no viruses or trojans. At which point, it came to my realisation that I had not received a warning message or anything like that for the past half hour, which was strange. Then, I found I could open task manager again, this time, not being able to find the process with the weird name in both description and name. I also went to all the locations in an attempt to find the program, using the date modified tab to find anything that had been changed in the past week and seeing if it resembled anything like Security Shield. unfortunately, all 3 locations for the Windows 7, were empty, by that I mean of anything resembling.

I then restarted my computer, wondering if Security Shield had just somehow disappeared, or if it just stopped itself.

It is now my third time restarting my computer, and for some reason, I have yet to find any indication what so ever, of ever possessing the spyware on my computer.

Is there any advice anyone could offer me on this matter?

Also, I would like to mention that I’m currently using ‘Rising’ Anti-virus.
I have attempted to do all the steps in the guide, but having been stopped at opening the Task manager, I was unable to find the main exe.

I have have also looked in these 3 places for the spyware as I’m currently using Windows 7
C:Users/Username/Appdata/Local
C:Users/Username/Appdata/Local/Temp
And
C:Users/Username/Appdata
For any general resemblance to Security Shield

Please and Thank you.

I do not think you are no longer infected. Not sure what “Rising Antivirus” is. Download and install Spyware Doctor with Antivirus and run a full scan. That is the best way I know of to ensure you have no virus threats left.

I had the same issue as the above person states (different names of course). The icon that showed up for my files was a recycle bin icon in the hidden locations. After renaming and deleting I have access to everything but the Internet. Any suggestions on other places to look? I ran a full scan(with
Avira) and deleted one more item [ ].exe but still no access. Running a full scan with Malwarebytes now as well…

i need help

i have windows xp. i am in safe mode. I cannot locate the virus. i do not know what the name if it should be.

Thanks for the quick, easy and clear instructions. For someone who’s not tech saavy, they were very helpful

Help. I can’t have access to my browser to download a removal tool and my task manager doesn’t right click to properties so I can NOT find the exe file to delete it. I ran a scan from trend micro in safe mode but it didn’t find it.

You have to give me more then that! Read the guide and then if you need help let me know exactly what step it is you are stuck on and what you are trying to do. Your operating system is also needed for me to ensure you are looking in the right place

name will be random. As you have XP you should browse to the paths shown in the guide and then sort those files by date. Keep in mind you may need to show “hidden files and folders” in order to browse to the directory.

You are very welcome. Glad we could help you out.

Manually browse to the directories shown in the guide and then sort the file by date. From there you should be able to pin point the name of the threat and delete it or rename it. I would also re-set your browser. That should restore internet access for you.

Im pretty sure I located the .exe file…it was in appdata/local…by the way I’m on Vista…I renamed in “gay as Fuck” I then tried to delete it andthe window that will POP up when something is being recylced and the little green bar moves left to right…well mine is a fully red bar and it claims to he recycling but it says “recycling 1 item (329 kb) from LOCAL (C:usersownerappdatalocal) discovered 0 items (0 bytes)” then when I try and click the “x” it sings at me and won’t close…Idk wtf is goin on…and the application I believe is the virus was created today (15th) the same day this started to occur….any ideas?

You can not delete a file while it is in use. After you re-named it you need to re-boot your computer, then delete it.

Thank you for creating this site. I managed to get security shiel 2012 off of my new laptop without my parents knowing. Thank You so much!

Thank You SO much. Using your guide I was able to clean up my Mom’s computer. You’re a good man. I’ve already liked you on facebook and posted up a link to your site on my wall. I’ll repeat every week or so. You rule.

Thanks Jacob for all the help you provide here for people dealing with viruses. As an IM I’m very impressed the the value you share here. Because at the end of the day thats what business is all about….providing value to customers.

Thanks again,

Ron

Thanks for the kinds words Ron. Glad we could help get you sorted

Right on!. Glad we could help you remove your virus and very happy you are helping to spread the word.

You are very welcome. Nothing better then being virus free and having your PC working again!

After a couple or trial and errors made on my behalf! I can now say that I successfully got rid of a computer virus! Thankyou SO much for giving this information to us all on the world wide web!

For Windows XP users, my computer would never enter safe mode. When I tried the msconfig thing it would be blocked by SS2011, so what I recommend you do is to open the Task Manager using Ctrl+Alt+Del. After, track to process because mine didn’t appear in random numbers; just letters. You wanna find the location of it in a folder (the folder is gonna be hidden so go to My Computer and un-hide those folders), change the name of it to whatever you want, then end the process of it and then delete the icon once found. Download something like Spyware Doctor to track anything else SS2011 could have left behind. Luckily it did not. It was only on my PC for about 24 hours; more or less. I did re-install Norton and had updated and upgraded it to a newer version. I have Norton 360 and I can’t believe Norton did not block SS2011 after I went to a website that I normally visit (which is now temproarily infected)! Good luck to everyone! If you need any help email me at: HomicidalWhales@yahoo[dot]com.

Jacob I really appreciate what you guys are doing here.

I am running XP and cannot find the virus. I have looked in C:Documents and SettingsAll UsersApplication Data and in C:Documents and Settings[User name]Application Data and there are no recently modified execution files in either location.

I am running in safe mode and I am displaying hidden files.

I was able to access the task manager before starting in safe mode but there is no description column nor is there any option to display the description column so I could not identify the virus using that method either.

Any suggestions? Thanks.

Hi. I have xp and was getting nowhere. I then opened up the task manager as soon as I logged on (as you suggested) and saw security shield in the task menu. I deleted (or end tasked it) it and nothing has popped in the past couple of hours and I can run pretty much everything. However this just seemed to easy and I feel its lurking there somwhere but I cannot find it at all before or after I closed it down through task manager. Any advice??

When I go to task manager and click on processes, I can’t seem to locate the file. I’ve had Security Shield for a few days now. Does that have anything to do with how I cant find the file? Also, I searched the file ‘AppData’ and I couldn’t find a file that was different in any way. Help??

copy in the link to the location you looked at on your computer so I can verify you are looking in the correct location.