Security Shield 2011

According to S!Ri:
Security Shield 2011 is a fake anti-virus tool. is a new version of Security Shield, System Tool, Security Tool, Total security 2009, System Security rogue.
It displays disturbing fake alert messages and detects inexistent infections to scare users.

Now they use a cool Windows XP template, the flat style of older rogues was boring :')

To register (and help removal), copy paste this code: 64C665BE-4DE7-423B-A6B6-BC0172B25DF2

Essential Cleaner

According to S!Ri:
Essential Cleaner is a new version of MS Removal Tool, System Tool, Security Tool, Total security 2009, System Security rogue.
This fake anti-spyware tool displays fake alert messages, prevent execution of legit programs, detects inexistent infections and Hijacks desktop background to scare users.

To register (and help removal), copy paste one of these codes:
EEDA-S0DF5-GS5E0-FG14S-2DF8G
EEDA-JUYH3-24GHJ-HGKSH-FKLSD
EEDA-89OF7-7324R-5SAD4-TG68U
EEDA-HFVDR-9844O-U54DA-5TBSC
EEDA-G8FB6-1V87S-DRT1S-63SRG
EEDA-4BGY2-JY4KO-IT98Y-7HJ43
EEDA-5D1V2-XB0D5-JT1TY-97DS3
EEDA-F40SA-1ER5H-4FG5D-F8412
EEDA-SERFH-2642S-F04SD-64FG1
EEDA-S0DF5-GS5E0-FG14S-2DF8G
EEDA-452S3-ER00F-TSE35-S8FSD
EEDA-FGS5D-649RG-4S53D-412SF
EEDA-4TS8R-D6F5D-4JH8T-U4JK5
EEDA-2AE32-1VFC2-B6894-G67YU
EEDA-P9685-4H41A-DSW3A-2R64T
EEDA-5SRTS-AEHUF-YA54S-D6F35
EEDA-A1SDF-RY4E8-7U98D-F1GB2
EEDA-A1SDF-6AS4D-RF5RE-79G84
EEDA-TTUYJ-7UO54-G561H-J1D6F
EEDA-G84H6-S854F-79ZA8-W4ERS
EEDA-6W954-FX65B-41VDF-8G4JI
EEDA-U94KO-LF4G4-1V8S1-2CRFE
EEDA-TGN15-RFF29-AASDJ-ASD65
8812702347
7713712456
6614722565
EEDB-ADEEF-FEADD-2FEAA-3EFA7
EEDB-ADEEE-3ADEF-4A78C-32768
4432125899
5532225898
6632325897

Note for reverse engineers ~

Anti VMware:

 Double check: (TextBox/Clipboard)

MS Removal Tool

According to S!Ri,

MS Removal Tool is a new version of System Tool, Security Tool, Total security 2009, System Security rogue. This fake anti-spyware tool displays fake alert messages, prevent execution of legit programs, detects inexistent infections and Hijacks desktop background to scare users.

To register (and help removal), copy paste one of these codes:

WNDS-5D1V2-XB0D5-JT1TY-97DS3
WNDS-JUYH3-24GHJ-HGKSH-FKLSD
WNDS-89OF7-7324R-5SAD4-TG68U
WNDS-HFVDR-9844O-U54DA-5TBSC
WNDS-G8FB6-1V87S-DRT1S-63SRG
WNDS-4BGY2-JY4KO-IT98Y-7HJ43
WNDS-F40SA-1ER5H-4FG5D-F8412
WNDS-SERFH-2642S-F04SD-64FG1
WNDS-S0DF5-GS5E0-FG14S-2DF8G
WNDS-452S3-ER00F-TSE35-S8FSD
WNDS-FGS5D-649RG-4S53D-412SF
WNDS-4TS8R-D6F5D-4JH8T-U4JK5
WNDS-2AE32-1VFC2-B6894-G67YU
WNDS-P9685-4H41A-DSW3A-2R64T
WNDS-5SRTS-AEHUF-YA54S-D6F35
WNDS-A1SDF-RY4E8-7U98D-F1GB2
WNDS-A1SDF-6AS4D-RF5RE-79G84
WNDS-TTUYJ-7UO54-G561H-J1D6F
WNDS-G84H6-S854F-79ZA8-W4ERS
WNDS-6W954-FX65B-41VDF-8G4JI
WNDS-U94KO-LF4G4-1V8S1-2CRFE
WNDS-TGN15-RFF29-AASDJ-ASD65
AAAA-BBBBB-CCCCC-DDDDD-EEEEE

Notes for reverse engineers ~

Anti VMware:

And some others tricks who make it difficult to run it with VMware.. but finaly with patience...

Auto copy:

Serial check:

Like previous versions, this rogue continue to use Clipboard API for see if the serial is not inside.