Internet Security Guard Rogue Anti-Spyware - removal guide

Internet Security Guard

Created: 2012-01-25 02:57:41 Author: Renata Mykolaityte

Information about Internet Security Guard

Internet Security Guard is a dangerous malware categorized as rogue anti-spyware. It should be linked to the Rogue.VirusDoctor family of scams that all share the same GUI and act almost identically. That meas that just like earlier its versions, Internet Security Guard starts using various manipulations for making you concerned about your PC and then swildling your money. If you also get Internet Security Guard on your computer, please use a reputable anti-spyware to remove this scam from your machine.

In most of the cases, users report that they have never installed Internet Security Guard on their computers. In fact, they are partially right – this scam has capabilities to come inside through securitu vulnerabilities found and then make some startup configuration changes. As a result, Internet Security Guard is launched as soon as you reboot your computer. In addition, Internet Security Guard runs a scanner that pretends to check infected machine for all sorts of infections and, of course, reports tons of them detected. Keep in mind that all those 'viruses' are invented files that have nothing to do with a real your computer's functionality.

Some of those files are: %UserProfile%\Recent\ANTIGEN.exe, %UserProfile%\Recent\cb.drv, %UserProfile%\Recent\CLSV.dll, %UserProfile%\Recent\eb.dll, %UserProfile%\Recent\energy.exe, %UserProfile%\Recent\energy.tmp, %UserProfile%\Recent\fan.sys, %UserProfile%\Recent\fix.sys, %UserProfile%\Recent\FW.drv, %UserProfile%\Recent\gid.dll.

Internet Security Guard alerts say:

Address space conflict
Warning! Access conflict detected
An unidentified program is trying to access system process address space.

System Message
Your PC may still be infected with dangerous viruses. Internet Security Guard protection is needed to prevent data loss and avoid theft of your personal data and credit card details. Click here to activate protection.

Memory access problem
WindowsErrorForm has encountered a problem at address 0x1FC408.
We are sorry for the inconvenience.

When after the fake scan, Internet Security Guard reports for the victim that he/she should go ahead and update it to its full version and purchase it. This is the main thing because Internet Security Guard tries to deceive you and get your money. However, you should simply ignore these serious problems detected and keep in mind that all its adds are falsified. waste your money in order to have those problems resolved. You should never believe Internet Security Guard alerts and ignore any of its popup notifications or scanners for granted. The right thing to do in your situation is to remove Internet Security Guard ASAP. To remove Internet Security Guard, use a reputable anti-spyware program and run a full system scan with it after updating.

Internet Security Guard Facts

For automatic Internet Security Guard removal, please download Spyware Doctor:

Spyware Doctor

Internet Security Guard pretends to increase security of your PC
Internet Security Guard free version will show popups, alerts and fake results to convince you to pay
Internet Security Guard creators will not deliver license keys upon paying or the full version will not be functional
Internet Security Guard might be used to download and advertise other malicious software
Internet Security Guard might disable some of your PCs or its programs functions

Manual Internet Security Guard removal instructions

Note: Manual removal of parasite Internet Security Guard is tedious and dangerous task if done incorectly. Stoping and deleting incorrect executables and DLLs, deleting registry entries might harm your PC. Thus we recommend using Spyware Doctor of PCTools for automatical scan and removal of computer parasites, or another reputable spyware remover.

1

Kill malicious Processes:

How to kill malicious processes

ISa76.exe
ANTIGEN.exe
energy.exe
PE.exe
SM.exe

2

Unregister malicious Dlls:

How to unregister malicious DLLs

CLSV.dll
eb.dll

3

Remove malicious Registery entries:

How to remove malicious registry entries

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes
HKEY_CURRENT_USER\Software\3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\IS9c5_8027.DocHostUIHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av360.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McSACore.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zatutor.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalm2601.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=8027&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PRS" = "http://127.0.0.1:27777/?inj=%ORIGINAL%"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "879905773703"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "feed/7.1.08027"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "DisallowRun" = "1"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "0" = "msseces.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "1" = "MSASCui.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "10" = "avgscanx.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "11" = "avgcfgex.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "12" = "avgemc.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "13" = "avgchsvx.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "14" = "avgcmgr.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "15" = "avgwdsvc.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "3" = "egui.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "4" = "avgnt.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "5" = "avcenter.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "6" = "avscan.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "7" = "avgfrw.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "8" = "avgui.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun "9" = "avgtray.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Internet Security Guard"
HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes "URL" = "http://findgala.com/?&uid=8027&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = "no"

4

Remove harmful Files:

How to remove harmful files

%AppData%\Internet Security Guard\
%AppData%\Internet Security Guard\cookies.sqlite
%AppData%\Internet Security Guard\Instructions.ini
%AppData%\Microsoft\Internet Explorer\Quick Launch\Internet Security Guard.lnk
%CommonAppData%\79b35\
%CommonAppData%\79b35\ISa76.exe
%CommonAppData%\79b35\ISG.ico
%CommonAppData%\ISEUG\
%CommonAppData%\ISEUG\ISKIYFOAG.cfg
%UserProfile%\Desktop\Internet Security Guard.lnk
%UserProfile%\Recent\ANTIGEN.exe
%UserProfile%\Recent\cb.drv
%UserProfile%\Recent\CLSV.dll
%UserProfile%\Recent\eb.dll
%UserProfile%\Recent\energy.exe
%UserProfile%\Recent\energy.tmp
%UserProfile%\Recent\fan.sys
%UserProfile%\Recent\fix.sys
%UserProfile%\Recent\FW.drv
%UserProfile%\Recent\gid.dll
%UserProfile%\Recent\PE.exe
%UserProfile%\Recent\ppal.sys
%UserProfile%\Recent\SICKBOY.tmp
%UserProfile%\Recent\sld.sys
%UserProfile%\Recent\SM.dll
%UserProfile%\Recent\SM.exe
%UserProfile%\Recent\snl2w.drv
%UserProfile%\Recent\tjd.tmp
%UserProfile%\Start Menu\Internet Security Guard.lnk
%UserProfile%\Start Menu\Programs\Internet Security Guard.lnk

5

Scan your System:

Scan your System with free scanners for remaining computer parasites

*Name
*E-mail

Security Guard

Created: 2010-03-25 08:43:03 Author:Renata Mykolaityte

Security Guard is known as one of the most dangerous and wildly spreading rogue anti-spyware at the moment. The program is based on Trojans which are the main mean of infiltrating Security Guard into the system. When the Trojan installs Security Guard it also creates a bunch of files which are later detected as infections when the program runs its scanner. Here is a list what files can be created: %UserProfile%\Recent\ANTIGEN.sys %UserProfile%\Recent\ANTIGEN.tmp...

Posted in: Rogue Anti-Spyware

No comments yet

Privacy Protection

Created: 2012-01-25 03:08:35 Author:Gaby C.

Privacy Protection is a dangerous malware that should be eliminated before it starts initiating problems on your PC. This fraudware is already known for its extremely malicious activity when it finds itself on the computer – Privacy Protection displays annoying system scanners, alerts and notifications and then starts requiring to purchase its license for fixing everything. However, purchasing Privacy Protection means giving your money to scammers, so never do that! Use updated...

Posted in: Rogue Anti-Spyware

No comments yet

Vista Security 2012

Created: 2012-01-26 03:40:57 Author:Gaby C.

Vista Security 2012 is a rogue anti-spyware that uses sneaky methods helping it to get users' money. In order to receive some credits, this malware displays continuous system scanners and alerts that all report the same thing: your PC is dangerously infected by tons of viruses. However, you should never believe such messages displayed by Vista Security 2012 name. Keep in mind that this program is a dangerous malware that in reality has an empty virus database, so it has no capabilities to...

Posted in: Rogue Anti-Spyware

No comments yet