"You guys rock. Your instructions were spot on! Thank You"
- J. Powell

"I was infected by SystemTool today. Thanks for the help on the page. I have removed it completely"
- L. Lepsøe

"Your web page on Regclean was extremely helpful and very, very education. Its objectivity to was nothing short of excellent. Thank you..."
- Anthony G. Muya

"I want to express my thanks for the information on removing the browser hijacker. I took the steps you suggested and the follow-on precautions to prevent future infections... Thanks again"
- Carlos

For Information and Removal of ProtectShield

    - what is ProtectShield
    - automatic and manual removal instructions
    - personal assistance provided online or by phone to safely remove ProtectShield.


25th February 2011

ProtectShield - Rogueware

Rogue antivirus programs depend on confusion. Do I have security threats?  What is wrong?  Is my data safe?  They depend on quick reactions and rash decisions.  What they don't count on is that you will take the time to recognize the signs that you have a rogue antivirus program in your system and that you will learn how to remove it effective either automatically or manually.  Scareware programs like ProtectShield do not want you to take that extra time and scrutinize them, but this is exactly how you are able to avoid and remove them.


Introduction to ProtectShield

According to respected security firm, Panda Security, scareware is a $415 million a year industry.  Over two million rogue antivirus programs were discovered in 2010 alone, and there is a new crop of 2011 editions joining them.  The goal of these rogues is to make money on your need to keep your computer safe.  ProtectShield, like other forms of scareware, uses pop-ups and false scans in its campaign to convince you that there are severe security threats in your system.  It cannot be emphasized strongly enough that scareware provides little to no actual protection.  Instead of being the answer to security issues, they may be the cause of any issues you are experiencing. 


ProtectShield In Your Machine

Rogue antivirus programs typically follow a formula when they enter your system.  While inconvenient to be sure, at least this formula makes it easier to identify one.  And when you can identify one rogue, you have a much better chance of recognizing them all.   First, the scareware program appear to be inactive; users are not aware that anything is amiss, and the computer will continue to function as normal on the surface.  During this time, however, the scareware is modifying your security settings so it can run without detection.  Once it has completed this, it becomes much more active. 

Pop-ups.  These are perhaps the most noticeable signs precisely because they are the most irritating.  ProtectShield configures itself to launch every time you begin a Windows session.  It then issues "warnings" that your computer has been infected by malware.  This is essentially an intensive ad campaign that is designed to create the appearance of insecurity in your system.  These warnings, which can appear as balloon type messages and in the form of flashing icons on your taskbar, tell you that your computer is not protected and that you need to install the full version of the program in order to resolve risks.  This, of course, is the last thing you want to do.


False scan.  The scan windows generated by ProtectShield are perhaps a little more effective than those of many other rogues.  This is because this particular scareware program uses the trusted Windows logo.  It indicates that there is a scan in progress and urges you to register your copy of the program in order to protect your computer.  What this ad depends on is a quick glance and an even quicker reaction.  The hope is that you will see the trusted Windows symbol and immediately take the "warning" to be from this reputable source. 


Slow performance.  Running a rogue antivirus program takes a lot of power, and this power comes at the expense of your legitimate programs.  Routine tasks, such as opening browser windows or files, take much longer because the scareware is running constantly in the background.


Access to Your System

Scareware is increasingly common, and it is possible to inadvertently allow it into your system in any number of ways.  In the past, sites with "adult" content were usually considered to be the most likely way to allow trojans carrying malware into your system. This still happens, but the list of sites that are potential hotspots has grown.  It now includes sites with:


Remove ProtectShield

Identifying the rogue antivirus program is the first step.  The second, more difficult step, is to remove ProtectShield thoroughly and safely from your machine.  First, here are methods that will not work:

What will work?

Remove Files:



Remove Registry Values:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run "ProtectShield"



Delete Files:

%CommonPrograms%\ProtectShield\1 ProtectShield.lnk

%CommonPrograms%\ProtectShield\3 Uninstall.lnk

%CommonPrograms%\ProtectShield\2 Homepage.lnk







Removing ProtectShield Automatically/Safely

For free automatic removal we recommend using Malwarebytes Anti-Malware. This program is widely recommended by reputable third-party sites, so you can be reasonably confident of its ability to safely get rid of ProtectShield and any hidden Trojans. As a precaution we recommend double checking your system with SpyHunter. This program requires paid registration to enable deletions, however it has a money back guaranteed and is the top of the line in malware removal. It should catch malware that evades Malwarebytes and block anything that tries to reinstal itself.

Download SpyHunter

Remove ProtectShield Now:

  1. Download and install Malwarebytes Anti-Malware and SpyHunter Download  
  2. Run a scan with Malwarebytes Anti-Malware.
  3. Remove all the detected infections (free).
  4. Run a scan with SpyHunter
  5. Remove any remaining infections
  6. Reboot and rescan with SpyHunter. Your computer should now be clean.

Important note: If Malwarebytes is blocked by malware then run Chameleon (Start Menu → All Programs → MalwareBytes' Anti-Malware → Tools → Malwarebytes' Anti-Malware Chameleon). If you need further help removing ProtectShield please email us at or call for personal assistance on toll-free number 888-655-3453, within the USA and Canada.

Disclaimer: This webpage was created to provide information on ProtectShield and how to uninstall it. Manual removal instructions are intended for use by technical experts and should be used at your own risk. We do not own or endorse ProtectShield.

All content copyright 2006-2017, Bonobo Pty Limited. All Rights Reserved.
Privacy Policy | Terms Of Service