Antivirus Protection 2012 screen shot
For more screen shots of this infection click on the image above.
There are a total of 7 images you can view.

While running, Antivirus Protection 2012 will also display fake security alerts on your computer. These alerts are designed to make you think that you have a severe computer infection or that your computer is sending private data to a remote location. The text of these alerts include:

Security Center
Unauthorized remote connection!
Your system is making an unauthorized personal data transfer to a remote computer!
Warning! Unauthorized personal data transfer is detected! It may be your personal credit card details, logins and passwords, browsing habits or information about files you have downloaded.
To protect your private data, please click “Prevent Connection” button below.

You have been infected by a proxy-relay trojan server with new and danger “SpamBots”.
You have a computer with a virus that sends spam.
This is a mass-mailing worm with backdoor thus allowing un-authorized access to the infected system.
It spreads by mass-mailing itself to e-mail addresses harvested from the local computer or by querying on-line search engines such as google.com.
The IP <ip address> address that YOU are getting from Internet Service Provider (ISP) for YOU personal computer is on some major blacklist.
Your computer has been used to send a huge amount of junk e-mail messages during the last days.
You IP <ip address> will be marked in the Police log file as mass-mailing spam assist.
Upgrading to the full version Antivirus Protection 2012 it will eliminate the majority of Spam attempts.

Antivirus Protection 2012
Your computer is being used as spamming machine. You can get sued for spam. Your computer WIL BE DISCONNECTED FORM <sic> INTERNET BECAUSE SPAMMING OTHER PCs.

Security Center Alert
To help protect your computer, Security Center has blocked some features of this program.
Do you want to block this suspicious software?
Name: Sft.Dez.Wien
Risk: High

Last, but not least, when you attempt to run the wordpad.exe, mspaint.exe, winword.exe, excel.exe, msaccess.exe, powerpnt.exe, firefox.exe, opera.exe, or wmplayer.exe executables, this infection will close the program and display a fake message stating that the program is infected:

Antivirus Protection 2012
The application excel.exe was launched successfully but it was forced to shut down due to security reasons. This application infected by a malicious software program which might present damage for the PC. It is highly recommended to make a full scan of your computer to exterminate the malicious programs from it.

Just like the fake scan results, all of these alerts and the browser hijacking are fake and are only being shown to scare you into purchasing the program.

Without a doubt, this program was developed to scare you into thinking that your computer has a serious computer security problem so that you will then purchase it. Therefore, do not purchase Antivirus Protection 2012 for any reason, and if you already have, please contact your credit card company and state that the program is a computer virus and a scam and that you would like to dispute the charge.

Once the rogue is installed on your computer it will be configured to start automatically when Windows starts. Once started it will perform a fake scan and then state that there are numerous infections present. If you attempt to use the program to remove these infections, though, it will state that you first need to purchase it before it can do so. This is a scam as the scan results are all fake, and in many cases, the infected files do not even exist on your computer. Therefore, please ignore the scan results and do not purchase the program.

Windows Shield Tool screenshot
For more screen shots of this infection click on the image above.
There are a total of 4 images you can view.

While the rogue is running it will also hijack many of the infected computer’s functions. For example, when you attempt to run an executable it will terminate it automatically. Furthermore, Windows Shield Tool will hijack the Windows Task Manager and Registry editor so that when you launch them, it will instead open the rogue’s Advanced Process Control screen, which acts like a task manager. This allows the rogue to take full control of your computer until you pay the “ransom”.

Last, but not least, this infection will also display fake security warnings that are designed to make you think that your computer has a severe computer security problem. These warnings may state that your computer is downloading copyrighted material, has viruses, or is sending out spam email.

Error
Software without a digital signature detected.
Your system files are at risk. We strongly advise you to activate your protection.

Error
Attempt to run a potentially dangerous script detected.
Full system is highly recommended.

Warning! Virus Detected
Threat detected: FTP Server
Infected file: C:\Windows\System32\dllcache\wmploc.dll

Just like the scan results, all of these security alerts are fake and should be ignored.

As you can see, Windows Shield Tool is a scam that was created to trick you into thinking your computer was severely infected so that you will then purchase it. For no reason should you purchase this program, and if you have, you should contact your credit card company and dispute the charge stating that the program is a scam and a computer virus.