Prozac Online Buy Antabuse Cipro Online Buy Cymbalta Toprol XL Online Buy Cipro Elimite Online Buy Neurontin Nexium Online Buy Seroquel

PSGuard is a fake anti-spyware software that changes the Windows wallpaper to issue fake security notifications stating that your computer is infected with spyware. This deceptive tactic is only intended to trick you into purchasing PSGuard or a similar rogue anti-spyware program called Winhound. PSGuard uses a root-kit to keep registry key HKEY_LOCAL_MACHINE\SOFTWARE\ShudderLTD protected.

Automated Detection for PSGuard

PSGuard Manual Removal Instructions

Stop PSGuard system processes:

uninstiu.exe
psguardinstall.exe
psguard.exe
psguard.exe psguardinstall.exe uninstiu.exeintell32.exe
intell32.exe

Unregister PSGuard DLLs:

wndsystem.dll
oleext32.dll
oleext.dll
localization.dll
core.dll

Remove PSGuard files:

uninstiu.exe
wppp.html
wndsystem.dll
oleext32.dll
oleext.dll
localization.dll
core.dll
psguardinstall.exe
psguard.exe
wppp.htmlintell32.exe

Remove PSGuard registry values:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallInternetUpdate
HKEY_LOCAL_MACHINESOFTWAREShudderLTDPSGuard
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemNoDispBackgroundPage=1
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemNoDispAppearancePage=1
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoActiveDesktopChanges=1
HKEY_CURRENT_USERControlPanelDesktopWallpaper=%System%wppp.html
HKEY_CURRENT_USERControlPanelDesktopWallpaperStyle=0
F61D1CE1-5199-4B57-B59E-C6819EA92F3B
982392F9-9C65-48B4-B667-3459C46630D1
F4364EEC-31F5-4B8B-A7E0-3B6394C9D23F
F100A342-3AC5-47FF-B5B3-FCDB6FC9F016
E0D6C30A-B9A3-4181-8099-3B0D5A2B98AF
D6A7D177-0B2F-4283-B2E8-B6310A45E606
D5D6E9B5-30D5-4457-AC8B-399205F50411
CF1674CC-EC9A-4AEE-996E-65A8F7C0B0E4
CB9385AB-8541-4B2F-A363-48F64C612993
C6E2A22C-B3A8-43A4-B5EC-A5BB671AB3F7
B803D266-A08D-4A4C-9604-6D35689ABE09
B26B5883-F15F-4283-B3D5-A1728077DE47
A917B2F3-A9BF-477C-A0E3-0382D0376159
A20F5672-7486-4D27-BD2B-E555E4692C5F
A00E2305-7001-4200-BA00-5779F9A3E7D3
8EC33B7D-9953-4EDB-ACE2-D4C105968601
8B6C0168-BAAC-4C7C-911E-0132590F5661
7B6A3434-8625-4ABF-B79D-09D98C2498C4
4723879B-8F52-4BE7-9994-626AFA539366
3A350193-C7F7-4E10-B347-02FF4C3CC4E9
2C462D06-3BA0-48BB-9282-BB6519FE86E9
28FEDB90-53C7-4928-994A-CEE782606507
20F8B70D-9F16-4DCB-8788-90A0498E46B9
1C94EA51-3800-4F08-B5DC-A5B67823FFEA
1BD98DFD-2DA9-4C54-85D7-BE03A0F9C487
17E02586-A91D-4A9D-A74E-187B05DFFE6F
15DC7116-E58E-4395-A45A-A1C99B17C030
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunPSGuard
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionUninstallInternet UpdateHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunintell32.exe
HKEY_LOCAL_MACHINE SOFTWAREShudderLTDPSGuard
HKEY_CURRENT_USER SoftwareMicrosoftWindows CurrentVersionPoliciesSystemNoDispBackgroundPage=1
HKEY_CURRENT_USER SoftwareMicrosoftWindows CurrentVersionPoliciesSystemNoDispAppearancePage=1
HKEY_CURRENT_USER SoftwareMicrosoftWindows CurrentVersionPoliciesExplorerNoActiveDesktopChanges=1
HKEY_CURRENT_USER Control PanelDesktopWallpaper=%System%wppp.html
HKEY_CURRENT_USER Control PanelDesktopWallpaperStyle=0
HKEY_CLASSES_ROOTTypelib{F61D1CE1-5199-4B57-B59E-C6819EA92F3B}
HKEY_CLASSES_ROOTTypelib{982392F9-9C65-48B4-B667-3459C46630D1}
HKEY_CLASSES_ROOTInterface{F4364EEC-31F5-4B8B-A7E0-3B6394C9D23F}
HKEY_CLASSES_ROOTInterface{F100A342-3AC5-47FF-B5B3-FCDB6FC9F016}
HKEY_CLASSES_ROOTInterface{E0D6C30A-B9A3-4181-8099-3B0D5A2B98AF}
HKEY_CLASSES_ROOTInterface{D6A7D177-0B2F-4283-B2E8-B6310A45E606}
HKEY_CLASSES_ROOTInterface{D5D6E9B5-30D5-4457-AC8B-399205F50411}
HKEY_CLASSES_ROOTInterface{CF1674CC-EC9A-4AEE-996E-65A8F7C0B0E4}
HKEY_CLASSES_ROOTInterface{CB9385AB-8541-4B2F-A363-48F64C612993}
HKEY_CLASSES_ROOTInterface{C6E2A22C-B3A8-43A4-B5EC-A5BB671AB3F7}
HKEY_CLASSES_ROOTInterface{B803D266-A08D-4A4C-9604-6D35689ABE09}
HKEY_CLASSES_ROOTInterface{B26B5883-F15F-4283-B3D5-A1728077DE47}
HKEY_CLASSES_ROOTInterface{A917B2F3-A9BF-477C-A0E3-0382D0376159}
HKEY_CLASSES_ROOTInterface{A20F5672-7486-4D27-BD2B-E555E4692C5F}
HKEY_CLASSES_ROOTInterface{A00E2305-7001-4200-BA00-5779F9A3E7D3}
HKEY_CLASSES_ROOTInterface{8EC33B7D-9953-4EDB-ACE2-D4C105968601}
HKEY_CLASSES_ROOTInterface{8B6C0168-BAAC-4C7C-911E-0132590F5661}
HKEY_CLASSES_ROOTInterface{7B6A3434-8625-4ABF-B79D-09D98C2498C4}
HKEY_CLASSES_ROOTInterface{4723879B-8F52-4BE7-9994-626AFA539366}
HKEY_CLASSES_ROOTInterface{3A350193-C7F7-4E10-B347-02FF4C3CC4E9}
HKEY_CLASSES_ROOTInterface{2C462D06-3BA0-48BB-9282-BB6519FE86E9}
HKEY_CLASSES_ROOTInterface{28FEDB90-53C7-4928-994A-CEE782606507}
HKEY_CLASSES_ROOTInterface{20F8B70D-9F16-4DCB-8788-90A0498E46B9}
HKEY_CLASSES_ROOTCLSID{1C94EA51-3800-4F08-B5DC-A5B67823FFEA}
HKEY_CLASSES_ROOTCLSID{1BD98DFD-2DA9-4C54-85D7-BE03A0F9C487}
HKEY_CLASSES_ROOTCLSID{17E02586-A91D-4A9D-A74E-187B05DFFE6F}
HKEY_CLASSES_ROOTCLSID{15DC7116-E58E-4395-A45A-A1C99B17C030}
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindowsCurrent VersionRunPSGuard
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindowsCurrent VersionRunintell32.exe

Important Disclaimer

PSGuard is related to:

  » No related posts

This entry was posted on Wednesday, June 28th, 2006 at 6:31 pm and is filed under Rogue Anti-Spyware Program, Trojans. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.