Your computer is infected with malicious software? Do you have popups on your PC?
If so, search this blog for removal instructions or find computer threats by category.

Monday, July 4, 2011

How to Remove Personal Shield Pro (Uninstall Guide)

Tell your friends:
Personal Shield Pro is a malicious application claiming to be an antivirus program. Most of the time computers are infected when users are presented with a fake security warning that seems to indicate that the computer is suddenly infected with viruses, spyware or other malicious software and they are asked to install free malware removal tool to remove viruses. Cyber criminals use other sophisticated methods to attempt to trick users into installing Personal Shield Pro — including spam emails and drive-by downloads when simply visiting an infected website is enough to become infected by this fake security program and other malware. Once installed, Personal Shield Pro pretends to scan your computer for viruses and displays fake security alerts to make you think that your computer is infected. Generally, false positives and fake security alerts are the primary method used to convince the user of the compromised computer to purchase the rogue product. What is more, this form of malware can significantly slow your computer's performance, change your background image and download additional malware onto your computer. If your computer does become infected, please follow the steps in the removal guide below to remove Personal Shield Pro malware from your computer.



When Personal Shield Pro is running, it blocks certain application on your computer, usually Task Manager, Registry editor, other system utilities and of course legitimate anti-malware software. It displays fake notification saying that the program is infected:

Application taskmgr.exe cannot be activated. Reason: suspected in virus activitiy and moved to quarantine. Please, activate your antivirus software to clean application.
Personal Shield Pro displays other fake security alerts like every on or two minutes. Thankfully, this fake AV can be removed rather easily. If you are good with computers, you can remove this fake security program manually. But if you are not that good with computers then I suggest using free anti-malware tools listed below.

Personal Shield Pro video (old graphical user interface):


OPTIONAL: In case you can't boot your PC in Safe Mode with Networking or you can't delete the malicious files manually, you can use this code 8945315-6548431 to register the rogue application in order to stop the fake security alerts. Once this is done, you are free to install anti-malware software and remove the rogue anti-virus program from your computer properly. If you need help in removing Personal Shield Pro from your computer, please leave a comment below.

Last, but not least, if you have already purchased this fake security application, please contact your credit card company and dispute the charges. Please note that you may become a victim of credit card scam or even identity theft. Additional information about this malware and comments are welcome. Good luck and be safe online!


Personal Shield Pro removal instructions (in Safe Mode with Networking):

1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm


NOTE: Login as the same user you were previously logged in with in the normal Windows mode.

2. Download recommended anti-malware software (direct download) and run a full system scan to remove this virus from your computer.

3. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.


Alertane Personal Shield Pro removal instructions:

Make sure that you can see hidden and operating system protected files in Windows. For more in formation, please read Show Hidden Files and Folders in Windows.

Under the Hidden files and folders section, click Show hidden files and folders, and remove the checkmarks from the checkboxes labeled:
  • Hide extensions for know file types
  • Hide protected operating system files
Click OK to save the changes.


1. Find Personal Shield Pro file(s).

On computers running Windows XP, malware hides in:
C:\Documents and Settings\All Users\Application Data\

On computers running Windows Vista/7, malware hides in:
C:\ProgramData\

2. Look for suspect ".exe" or ".pspro" files in the given directories depending on the Windows version you have.

Example Windows XP:
C:\Documents and Settings\All Users\Application Data\aYHmMJuqrr2.pspro

Example Windows Vista/7:
C:\ProgramData\aYHmMJuqrr2.pspro

Basically, there will be a malicious ".pspro" file named with a series of numbers or letters.



Rename aYHmMJuqrr2.pspro to aYHmMJuqrr2.vir For example:



It should be: C:\Documents and Settings\All Users\Application Data\aYHmMJuqrr2.vir

Instead of: C:\Documents and Settings\All Users\Application Data\aYHmMJuqrr2.pspro

3. Restart your computer. The malware should be inactive after the restart.

4. Open Internet Explorer. Download exe_fix.reg and run it. Click "Yes" to safe the changes.

5. Download recommended anti-malware software (direct download) and run a full system scan to remove this virus from your computer.


Personal Shield Pro associated files and registry values:

Files:

Windows XP:
  • C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS].exe
  • C:\Documents and Settings\All Users\Application Data\[SET OF RANDOM CHARACTERS].pspro
Windows Vista/7:
  • C:\ProgramData\[SET OF RANDOM CHARACTERS].exe
  • C:\ProgramData\[SET OF RANDOM CHARACTERS].pspro
Registry values:
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS].exe"
  • HKEY_CLASSES_ROOT\.pspro
  • HKEY_CLASSES_ROOT\PSP
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS].pspro"
  • HKEY_CLASSES_ROOT\.exe "Default" = 'PSP'
Share this information with other people:

61 comments:

Anonymous said...

thank you i think it works

Anonymous said...

Thanx a lot!
Seems to work here too.

Anonymous said...

Will try this when i get home. thanks a lot

Anonymous said...

Hi, i tried this and it worked. However have turned on computer this morning and it has resurfaced. Is there anything else i can do other than go through the above again

Anonymous said...

thanks ..i really appreciate for it ..thanks

Anonymous said...

i cant find the personal shield file, im looking for it and i cant really find it.

Anonymous said...

Thank you!! really helped

Anonymous said...

thx a lot!!

Anonymous said...

. .
--- thanks lol

Anonymous said...

thanks brother

a7md50 said...

thanks a lot ,really helped

MzLila said...

not able to find the files to change and remove

Anonymous said...

Awesome ! Works like a charm. Thank you so much :-)

Anonymous said...

thank you very much.u save my life!

Anonymous said...

thx this really work

Anonymous said...

the purchase code worked!!! thanks heaps!!

Anonymous said...

cannot find the file to change and remove

Anonymous said...

Thank you!

Please correct the typo in:

"Alertane Personal Shield Pro removal instructions:"

which made me think twice about this webpage itself!

Anonymous said...

Thank you...it worked but also make sure you when you delete out of the registry you go under Run and also check under RunOnce that is where it was.

Anonymous said...

Thanks Sir,Your code worked and right now the anti malware is running the full scan.Already it has caught 5infected files.It may catch more until the scan is complete.I am sure the problem will be resolved.Thanks a million and God bless you.

Anonymous said...

Hi it worked like a charm.......thanks a lot...even I didn't have to delete the registry files manually.....the anti-malware software did it itself.....thanks again..

Anonymous said...

Did not find it in the root of All Users\Application Data on XP. But looked in the registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce and found that it was in a folder under All Users\Application Data\hN01300AaHoJ01300. The name of the executable was hN01300AaHoJ01300.exe

Anonymous said...

is it this

eN01300IoAmB01300 ?

Admin said...

Yes, that's the one.

Anonymous said...

I was at my wit's end trying to figure out a way to remove this till I found your blog.

Thanks a lot!

vijay said...

thank you very much it worked

Anonymous said...

Works thanks!!!!!

Anonymous said...

Thank so much!

Anonymous said...

the same things came up on my computer like the porn thing and all in the same order funny that.

Anonymous said...

after 1 week it shoved again, what to do?

Anonymous said...

I used the code.. And it worked.. do I need to search the folder, download the anti-malware and scan? and i already have an AVG

Anonymous said...

Thanks! The code worked. Prob is to remove all errors, can't do it with free software since it would only remove 15 out of 500 errors.. Can't I used my AVG 8.5?

Anonymous said...

Thank you! I was really worried I was going to have to wipe my computer!

Anonymous said...

Hvala! Radi!

Anonymous said...

Thank you very much, I was genuinely worried this time around as it didn't allow me to turn on antivirus etc.


thank you

Anonymous said...

thanks bhai mera babaaaaaaaaa

Anonymous said...

thaaaaaaaaaaaaaanks it work well.... but when i turn on my computer i got a message error loading c:\users\AppData\local\mci2at.dll
the specified module could not be found....
what does that meen and how i can solve it

Vaganova said...

It's not working. The computer that's infected won't connect to the internet! Halp!

Anonymous said...

I have the same eror that a module is not working at startup

Anonymous said...

It works like a charm. Thanx

Cynthia said...

My internet won't work since I removed the threat! What to do?

Anonymous said...

dziękuję.to działa:0 pozdrawiam

RAJA said...

Its really useful

Anonymous said...

Seems to be working for me. Thank you for the help! :)

Anonymous said...

tx a lot it sure did work..

Anonymous said...

Thanks a lot...this really help

Adnan said...

My problem is that my system is gets off within 45 secs aftr initial start what should i do to write the code as given by u..plz answer me as early as posssible..My problem is that my system is gets off within 45 secs aftr initial start what should i do to write the code as given by u..plz answer me as early as posssible..

Anonymous said...

can formatting will fix this problem? i already lost my internet connection.

Anonymous said...

Thank you very much........

franky said...

The easy way to kill the virus is : Turn off the computer and the power line off too ,take the battery out,click on the computer again,wait 2h without the battery & power ,put battery back in after the 2h and turn on the computer again .. : you computer will run again without the virus.

Anonymous said...

By "Don't forget to update the installed program before scanning." you say that we pay for the software that Ya? You all are in this scam first making the problem then charging unexpected and removing it.

Anonymous said...

on my vista computer, the rouge file extension *.pspro was not found when i searched for it. When i sorted the "Program Data" directory by date, i found a suspicious looking file folder name (a bunch of random letters). There were additional files in that folder (still no *.pspro) but when i renamed the file extension, the virus was gone.

The Pilgrims said...

"can formatting will fix this problem? i already lost my internet connection."

formatting the computer sure will delete all of the viruses, not only this one, but your data and programs will be deleted as well though.... :)

please consider it first, or try to do the manual steps, if you've lost your internet connection.....

ask the expert to done this manual steps, as it's very dangerous to play to, which can cause a system failure upon mistake

Anonymous said...

I did not find the file with a .exe or .pspro extension...What I found was a suspiciously named folder modified on the very time I began encountering the problem...

I opened the folder and found a file with a .exe file extension...I changed the file extension to .vir, restarted the computer, and figured out that the virus stopped working by then...

I immediately deleted the folder containing the suspicious file...

THANK YOU VERY MUCH!!!!!!!!!
(^^,)

Anonymous said...

Thx for your guide.

patton93 said...

My was hidden in C:\ProgramData\gE20302GcAhM20302\gE20302GcAhM20302.exe

Anonymous said...

thank so much! it worked. cant go to safe mode but i still installed the software and ran the scan, and it worked!

Rajesh said...

thank you very much....!

Bec said...

Help! I ran spyware doctor while in safe mode then when I boot up again I get nothing but a blank screen and the spyware program pops up to make a second pass obviously it's not getting all of it. With no internet connection what can I do?

Jannekeluif said...

I couldn't find any extentions but renamed the folder and renamed the two files in it to .vir
Can anyone tell me if that's ok?
I also found more folders with a name consisting of a series of numbers and letters. Is that a virus by definition?

Anamika said...

hi i removed the virus manually burt again after 3-4 days it pop up. PSP...:( how should i remove it permanently...i hav avira antivirus installed will it work?
pls help...i dont want to lose imp data from my pc. ASAP!