ScaryBear Software

There is currently an infection on the loose that makes browser preferences default to search.eshield.com, so use this guide to get rid of it if attacked.

URL blacklisting is a fancy thing, especially if users are alerted on harmful websites before they actually navigate there. This type of functionality is a deal with no strings attached if it’s built into the web browser or an Internet security suite installed on a computer, but matters turn upside down when actors like eShield come into play. Said company claims to deliver safe web surfing and searching by means of its browser extension, flagging entries as “safe (low or no risk)”, “caution (some risk)” or “warning (serious risk)”, which differ in coloring displayed next to each website. A number of facts about this add-on, though, make users regret to be using it promptly after the setup. Moreover, very importantly, in most cases you don’t even allow the application to get in – and yet it’s there. How come? That’s because it bears quite a few features of the commonplace adware, intruding on systems furtively and changing one’s web surfing patterns well beyond its competence.

In the distribution context, eShield Safe Search product relies on channels other than the habitual download from the official site. As a matter of fact, it’s got a web page that reviews the app’s features in the most favorable light, but once the Download button is clicked the most popular browsers come up with a “reported unwanted software page” warning or similar. Although this alert can be bypassed at one’s own risk, this turns out not to be the main way that this program is spreading. Its makers prefer taking advantage of installers for third-party freeware such as VLC Media Player, Media Player Classic, bundled variants of WhatsApp setup and the like. Accepting the terms of service for the above means you agree to also install eShield – as cunning as that.

As soon as this extension is affixed to the browser, its effect won’t be restricted to the purported online security features only. The adware changes the settings for homepage, default search and new tab so that search.eshield.com will be recurrently visited instead of the sites that the user had defined for those values. Aside from meddling with browser configuration proper, the bug adds a fair amount of registry information and modifies shortcut parameters, making it harder to clean up the mess behind it. In the long run, therefore, the victim faces a predicament where the unwanted page keeps popping up, with no ability to put in the correct settings and make them work. What helps in circumstances like this is an adware removal technique that combats the virus from several angles at a time.

eShield removal with automatic cleanup tool

An optimal workflow for eliminating the search.eshield.com adware is to leverage a security application which will identify all potentially malicious software on your computer and handle it the right way. This approach ensures thoroughness of the removal and system remediation, and allows avoiding unintended damage that might occur as a result of manual malware deletion.

1. Download and install eShield removal software. Launch it and click the Start New Scan button. Wait for the application to check your computer for threats

2. When the app is done scanning your system, it will come up with an extensive list of detected objects. Click the Fix Threats option to have the utility completely remove this malware and affiliated infections found on your PC.

Uninstall troublemaking software through Control Panel

– Go to Start menu and select Control Panel on the list

– Click on the Uninstall a program (Add or Remove Programs) button

– Take a good look at the software list displayed. Search for eShield there – note that the spelling or wording may be somewhat different, so focus on suspicious entries. When found, the culprit should be uninstalled

– Be advised search.eshield.com should but may not necessarily be listed anywhere on Control Panel therefore it may be problematic to figure out which particular program is associated with the virus in your case. If you are unsure, stick to the automatic cleanup advice or try the browser reset option described below.

Get rid of eShield adware by resetting the affected browser

FYI: This procedure will lead to the loss of custom browser settings, including bookmarks, cookies, passwords saved, and all browsing history. Also, some components of the virus may be beyond the browsers proper. Please keep this in mind when making a decision to proceed.

Reset Internet Explorer to its defaults

– Go to Tools –> Internet Options

– Select the Advanced tab as shown below and click the Reset button

– Read the warning about the effects of resetting IE. If you are sure, proceed by checking the Delete personal settings option and clicking Reset

Reset Mozilla Firefox

– Go to Help –> Troubleshooting Information

– Firefox will come up with the Troubleshooting Information screen. Click the Refresh Firefox button to complete the process

Reset Google Chrome

– Go to the Chrome Menu icon and pick Settings on the list

– Click on the Show advanced settings button

– Click on the button reading Reset browser settings

– On the notification box that pops up, review the consequences of Chrome reset and click Reset if it’s ok with you

Double-checking never hurts

To make sure the eShield adware has been removed, consider running an additional security scan as a completion of the cleanup procedure.