Remove Web Surf Shield virus (Removal Guide)

The Web Surf Shield notification is a computer virus, which will block your from visiting Facebook, Google, Youtube and other websites, and instead it will display a fake error message asking you to complete a survey or download a malicious program.

This threat is distributed through several means. Malicious websites, or legitimate websites that have been compromised, may drop this Trojan onto a compromised computer. This drive-by-download often happens surreptitiously. Another method used to propagate this type of malware is spam email containing infected attachments or links to malicious websites. The threat may also be downloaded manually by tricking the user into thinking they are installing a useful piece of software.
The Web Surf Shield virus is also prevalent on peer-to-peer file sharing websites and is often packaged with pirated or illegally acquired software.

Once install on a computer, Web Surf Shield virus will drop several malicious files, and it modify the HOSTS file by adding additional rules which will redirect your web browser.
The HOSTS file is like an address book, when you type an address like www.facebook.com into your browser, the Hosts file is consulted to see if you have the IP address, or “telephone number,” for that site. When infected with this trojan, the cyber criminals will add to your Hosts some new rules,which will resolve domain names to their malicious IP addresses.

After your HOSTS file was changed, whenever you’ll try to visit Amazon, eBay, PayPal and other popular websites, you’ll be redirect a to malicious domain which will ask you to complete a survey before allowing you visit to any of these websites.

Web Surf Shield

Access to this page has been temporarily blocked. Please take time to download our Web Surf Shield update below.
You can continue accessing this site after this update. Thank you!

If by any chance, you download and install Web Surf Shield, then each time you will try to access Youtube, Facebook or any other website, this infection will ask you to complete a survey.
The Web Surf Shield message will ask you to verify that you are a human and not a computer by filling in the survey. If you agree to take this survey, you’ll have to enter your phone number and by completing the survey you automatically agree that you will pay $5 a week for a service you definitely do not need.

The Web Surf Shield message is a scam, and you should ignore any alerts that this malicious software might generate.
Under no circumstance should you enter your phone number or pay any amount of money as this could lead to identity theft, and if you have, you should contact your bank and dispute the charge stating that the program is a scam and a computer virus.

How to remove Web Surf Shield virus (Removal Guide)

This page is a comprehensive guide, which will remove the Web Surf Shield infection from your your computer. Please perform all the steps in the correct order. If you have any questions or doubt at any point, STOP and ask for our assistance.
STEP 1: Reset the Windows Hosts file back to its default settings
STEP 2: Run RKill to terminate Web Surf Shield malicious processes
STEP 3: Remove Web Surf Shield virus with Malwarebytes Anti-Malware Free
STEP 4: Remove Web Surf Shield trojan with RogueKiller
STEP 5:  Remove Web Surf Shield infection with HitmanPro
STEP 6: Remove Web Surf Shield virus from Internet Explorer, Firefox and Chrome
STEP 7: Remove Web Surf Shield adware with AdwCleaner

STEP 1: Reset the Windows Hosts file back to its default settings

The Web Surf Shield Trojan has modified your Hosts file, so that you’ll be redirected to those survey websites. To reset the Hosts file back to its default settings, we will run Microsoft Fix it 50267, however because usually the cyber criminals have changed the permissions for the HOSTS file, we will first need to revert this modification.

1. Hosts-perm.bat is a batch file that will reset the permissions for the Windows HOSTS file.
   This infection will change the permissions on the HOSTS file so that you are unable to delete it or modify it. Hosts-perm.bat will reset these permissions so that you will once again have full access to it.
   You can download Hosts-perm.bat from the below link:
   HOSTS-PERM.BAT DOWNLOAD LINK  (This link will open a new web page from where you can download Hosts-perm.bat)
   Double-click the hosts-perm.bat file and when it is done you will see a message stating “The Permissions on the HOSTS file have been reset.”.Press any key on your keyboard to exit the batch file.
2. Download Microsoft Fix it 50267 from the below link.
   MICROSOFT FIX IT 50267 DOWNLOAD LINK  (This link will automatically download Microsoft Fix it 50267 on your computer)
3. Double click on MicrosoftFixit50267, then follow the prompts to reset your Windows Hosts file.
   

STEP 2: Run RKill to terminate Web Surf Shield malicious processes

RKill is a program that will attempt to terminate all malicious processes associated with Web Surf Shield infection, so that we will be able to perform the next step without being interrupted by this malicious software.
Because this utility will only stop Web Surf Shield running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again.

1. Please download the latest official version of RKill from the below link.
   RKILL DOWNLOAD LINK (This link will automatically download RKILL renamed as iExplore.exe)
2. Double click on iExplore.exe to start RKill and stop any processes associated with Web Surf Shield virus.
   
3. RKill will now start working in the background, please be patient while the program looks for Web Surf Shield malicious process and tries to end them.
   
4. When the Rkill utility has completed its task, it will generate a log. Do not reboot your computer after running RKill as the malware programs will start again.
   

---

STEP 3: Remove Web Surf Shield virus with Malwarebytes Anti-Malware FREE

Malwarebytes Anti-Malware Free utilizes Malwarebytes powerful technology to detect and remove all traces of malware including worms, trojans, rootkits, rogues, dialers, spyware and more.

1. You can download Malwarebytes Anti-Malware Free from the below link, then double-click on the icon named mbam-setup.exe to install this program.
   MALWAREBYTES ANTI-MALWARE DOWNLOAD LINK(This link will open a download page in a new window from where you can download Malwarebytes Anti-Malware Free)
2. When the installation begins, keep following the prompts in order to continue with the setup process, then at the last screen click on the Finish button.
   
3. On the Scanner tab, select Perform quick scan, and then click on the Scan button to start searching for the Web Surf Shield malicious files.
   
4. Malwarebytes’ Anti-Malware will now start scanning your computer for Web Surf Shield virus as shown below.
   
5. When the Malwarebytes Anti-Malware scan has finished, click on the Show Results button.
   
6. You will now be presented with a screen showing you the computer infections that Malwarebytes Anti-Malware has detected. Make sure that everything is Checked (ticked), then click on the Remove Selected button.
   
7. Once your computer will restart in Windows regular mode, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats.

---

STEP 4: Remove Web Surf Shield registry keys with RogueKiller

RogueKiller is a utility that will scan for the Web Surf Shield rootkit, registry keys and any other malicious files on your computer.

1. You can download the latest official version of RogueKiller from the below link.
   ROGUEKILLER DOWNLOAD LINK (This link will open a new web page from where you can download RogueKiller on your computer)
2. Double-click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds,  then click on the Scan button to perform a system scan.
   
3. After the scan has completed, press the Delete button to remove Web Surf Shield malicious registry keys or files.
   

---

STEP 5: Remove Web Surf Shield infection with HitmanPro

HitmanPro is a second opinion scanner, designed to rescue your computer from malware (viruses, trojans, rootkits, etc.) that have infected your computer despite all the security measures you have taken (such as anti virus software, firewalls, etc.).

1. You can download HitmanPro from the below link:
   HITMANPRO DOWNLOAD LINK (This link will open a web page from where you can download HitmanPro)
2. Double-click on the file named HitmanPro.exe (for 32-bit versions of Windows) or HitmanPro_x64.exe (for 64-bit versions of Windows). When the program starts you will be presented with the start screen as shown below.
   
   Click on the Next button, to install HitmanPro on your computer.
   
3. HitmanPro will now begin to scan your computer for Web Surf Shield trojan.
   
4. When it has finished it will display a list of all the malware that the program found as shown in the image below. Click on the Next button, to remove Web Surf Shield virus.
   
5. Click on the Activate free license button to begin the free 30 days trial, and remove all the malicious files from your computer.
   

---

TEP 6: Remove Web Surf Shield redirect from Internet Explorer, Firefox and Google Chrome

Remove Web Surf Shield from Internet Explorer

1. Open Internet Explorer, click on the gear icon  (Tools for Windows XP users) at the top (far right), then click again on Internet Options.
   
2. In the Internet Options dialog box, click on the Advanced tab, then click on the Reset button.
   
3. In the Reset Internet Explorer settings section, check the Delete personal settings box, then click on Reset.
   
4. When Internet Explorer finishes resetting, click Close in the confirmation dialogue box and then click OK.
5. Close and open Internet Explorer.

Remove Web Surf Shield from Mozilla Firefox

1. At the top of the Firefox window, click the Firefox button, go over to the Help sub-menu (on Windows XP, click the Help menu at the top of the Firefox window), and select Troubleshooting Information.
   
2. Click the Reset Firefox button in the upper-right corner of the Troubleshooting Information page.
   
3. To continue, click Reset Firefox in the confirmation window that opens.
4. Firefox will close and be reset. When it’s done, a window will list the information that was imported. Click Finish

Remove Web Surf Shield from Google Chrome

1. Click the Chrome menu   button on the browser toolbar, select Tools and then click on Extensions.
   
2. In the Extensions tab, remove Allyrics, Allyrics-1 and any other unknown extensions by clicking the trash can icon.
   Basically, if you have not installed an extension, you should remove it from your web browser.
   

---

STEP 7: Remove Web Surf Shield adware with AdwCleaner

The AdwCleaner utility will scan your computer for Web Surf Shield malicious files that may have been installed on your computer without your knowledge.

1. You can download AdwCleaner utility from the below link.
   ADWCLEANER DOWNLOAD LINK (This link will automatically download AdwCleaner on your computer)
2. Before starting AdwCleaner, close all open programs and internet browsers, then double-click on the AdwCleaner icon.
   
   If Windows prompts you as to whether or not you wish to run AdwCleaner, please allow it to run.
3. When the AdwCleaner program will open, click on the Scan button as shown below.
   
   AdwCleaner will now start to search for Web Surf Shield malicious files that may be installed on your computer.
4. To remove the Web Surf Shield malicious files that were detected in the previous step, please click on the Clean button.
   
   AdwCleaner will now prompt you to save any open files or data as the program will need to reboot the computer. Please do so and then click on the OK button.

---

Your computer should now be free of the Web Surf Shield infection. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes Anti-Malware to protect against these types of threats in the future, and perform regular computer scans with HitmanPro.
If you are still experiencing problems while trying to remove Web Surf Shield from your machine, please start a new thread in our Malware Removal Assistance forum.