1 of 10
Danger level 9
Type: Rogue Anti-Spyware
Common infection symptoms:
  • Installs itself without permissions
  • Connects to the internet without permission
  • Slow internet connection
  • System crashes
  • Annoying Pop-up's
  • Slow Computer
Other mutations known as:
Fake Microsoft Security Essentials , WindowsSoftwareGuard

Windows Software Guard

Despite very public campaigns by the online security industry to educate its consumers on the dangers and perils associated with rogue security products many rogue applications continue to dupe consumers into paying for their worthless software, as in the case of Windows Software Guard. This rogue, which is directly related to the Fake Microsoft Security Essentials scam, will not only take control of your PC and render it defenseless against any type of attack, but Windows Software Guard will also devastate your system with its lasting damage.

Windows Software Guard makes use of established forms of infection. Using Trojan horse infections to infiltrate its host PCs, these Trojans are distributed via fake online malware scanners and seditious browser hijackers. These browser hijackers will forcefully redirect a user’s browsing and search session. Once the user lands on their compromised landing pages, the known system and browser weaknesses and susceptibilities will be abused so as to allow for Windows Software Guard’s Trojans and malware to infiltrate the system.

The infiltration of Windows Software Guard is virtually undetectable, and the user will remain completely unaware of its presence on the system until such time that Windows Software Guard reveals itself by spamming the PC owner with various fake security messages. These fake security messages were created with the sole purpose of tricking the user into thinking his system is under attack and has been compromised. Do not put any stock whatsoever into these fake security alerts, and remain wary of any correspondence received from Windows Software Guard.

Other symptoms associated with this rogue tool include being unable to launch any type of executable on the system as well as being denied access to the Desktop. Distressing as these symptoms are, there does seem to be a way to circumvent these symptoms and regain access to your Desktop. Follow these instructions to regain access of the Desktop and the ability to launch executables on the system;

1. Once the system reboot is complete, you will not be able to access the Desktop again but will instead be presented with the Windows Shield Protector startup screen. Select OK to start the Windows Software Guard system scan
2. Wait for the system scan to finish
3. Once Windows Software Guard’s system scan finishes you should now be able to close the Windows Software Guard startup screen.

You should now be able to access your Desktop again, and find that you are able to launch most executables. However, as long asWindows Software Guard still runs rampant on your system you will be subject to the following fake security alerts:

Microsoft Security Essentials Alert
Potential Threat Details
Microsoft Security Essentials detected potential threats that might compromise your private or damage your computer. Your access to these items may be suspended until you take an action. Click 'show details' to learn more.

Threat prevention solution found
Security system analysis has revealed critical file system vulnerability caused by severe malware attacks.
Risk of system files infection:
The detected vulnerability may result in unauthorized access to private information and hard drive data with a seriuos possibility of irreversible data loss and unstable PC performance. To remove the malware please run a full system scan. Press 'OK' to install the software necessary to initiate system files check. To complete the installation process please reboot your computer.

System Security Warning
Attempt to modify register key entries is detected. Register entries analysis is recommended.

System component corrupted!
System reboot error has occurred due to lsass.exe system process failure.

This may be caused by severe malware infections.
Automatic restore of lsass.exe backup copy completed.
The correct system performance can not be resumed without eliminating the cause of lsass.exe corruption.

Warning!
Name: firefox.exe
Name: c:program filesfirefoxfirefox.exe
Application that seems to be a key-logger is detected. System information security is at risk. It is recommended to enable the security mode and run total System scanning.

At the end of the day your PC’s safety is your own responsibility. Protect it, take back what is rightfully yours and destroy Windows Software Guard before it destroys your PC. Do this by investing in a properly functioning security tool which will not only detect and erase Windows Software Guard from the system, but also offer future protection against similar attacks and threats.

Download Spyware Removal Tool to Remove* Windows Software Guard
  • Quick & tested solution for Windows Software Guard removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Windows Software Guard

Files associated with infection (Windows Software Guard):

ambeea.exe
%AppData%\[random].exe

Processes to kill (Windows Software Guard):

ambeea.exe
%AppData%\[random].exe

Remove registry entries (Windows Software Guard):

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell “%AppData%\[random].exe”
Disclaimer

Comments

  1. DANNY Feb 8, 2011

    m very happy to get this antivirus becaz it has removed virus in my pc.

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.