PC Security Guardian

PC Security Guardian is a rogue antispyware program that has the same origins as Security Guard, Smart Internet Protection 2011, Internet Security Essentials and many others. The program is installed with a help of Trojan viruses which also configure it to start automatically when the system is restarted.

Once inside, PC Security Guardian generates its fake scanner and pretends looking for infections. Later on it even provides you with a list of supposedly detected threats and then undoubtedly asks to pay for a full version of PC Security Guardian so that it could remove those infections. Here are the treats that PC Security Guardian may display after scanning your system: Trojan-PSW.Win32.Dripper, Virus.Win32.Fake.a, Trojan-Spy.HTMLSunfraud.a, Trojan-PSW.Win32.Delf.d, Virus.BAT.Gray.705, Virus.BAT.IBBM.ClsV, Trojan-IM.Win32.Faker.a and similar. Even though these a real infections, it doesn’t mean at all that any of them exist on your system. PC Security Guardian only attempts to scare you and swindle your money away.

In addition, the program will keep displaying various pop up messages and security alerts stating that your computer is badly infected and recommending scanning your system with PC Security Gardian. You may also find it difficult to open certain programs and instead receive warning messages saying that the file is infected. to make it clear, PC Security Gardian will do everything in order to convince you that your system is at risk and you must do something about it. For example:

Warning! Access conflict detected!
An unidentified program is trying to access system process address space.
Process Name: AllowedForm
Location: C:\Windows\…\notepad.exe

Warning! Identity theft attempt detected

Memory access problem
WindowsErrorForm has encountered a problem at address 0x1FC408.
We are sorry for the inconvenience.
If you see this error again, operational information can be irrevocably lost.

In reality what you must do once found PC Security Guardian on your system is ignore all its scan results or security notifications and remove this application itself from your system. make sure to scan your computer with a reputable antispyware program, for example, spyhunter or Malwarebytes Anti-Malware. This will definitely ensure that you will not miss any infections on your system. S!Ri has also provided a registry code of PC Security Guardian: U2FD-S2LA-H4KA-UEPB which will help to get rid of this badware.

Automatic Malware removal tools

Download Spyhunter for Malware detection
(Win)

Note: Spyhunter trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions,

Download Combo Cleaner for Malware detection
(Mac)

Note: Combo Cleaner trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions, Refund Policy ,

Manual removal

Processes:

Dll:

Files:

%AllUsersProfile%\\PSRWKWWDAG\\
%AllUsersProfile%\\PSRWKWWDAG\\PSYITOENDG.cfg
%AllUsersProfile%\\<random characters>\\
%AllUsersProfile%\\<random characters>\\2218.mof
%AllUsersProfile%\\<random characters>\\288416.reg
%AllUsersProfile%\\<random characters>\\PSG.ico
%AllUsersProfile%\\<random characters>\\PSGSys\\
%AllUsersProfile%\\<random characters>\\[random]_[random].exe
%AllUsersProfile%\\<random characters>\\Quarantine Items\\
%AllUsersProfile%\\<random characters>\\mcp.ico
%AppData%\\Microsoft\\Internet Explorer\\Quick Launch\\PC Security Guardian.lnk
%AppData%\\Microsoft\\Windows\\Recent\\ANTIGEN.dll
%AppData%\\Microsoft\\Windows\\Recent\\CLSV.drv
%AppData%\\Microsoft\\Windows\\Recent\\CLSV.sys
%AppData%\\Microsoft\\Windows\\Recent\\FW.dll
%AppData%\\Microsoft\\Windows\\Recent\\PE.dll
%AppData%\\Microsoft\\Windows\\Recent\\PE.drv
%AppData%\\Microsoft\\Windows\\Recent\\PE.sys
%AppData%\\Microsoft\\Windows\\Recent\\SICKBOY.drv
%AppData%\\Microsoft\\Windows\\Recent\\energy.drv
%AppData%\\Microsoft\\Windows\\Recent\\dudl.exe
%AppData%\\Microsoft\\Windows\\Recent\\energy.sys
%AppData%\\Microsoft\\Windows\\Recent\\exec.sys
%AppData%\\Microsoft\\Windows\\Recent\\exec.tmp
%AppData%\\Microsoft\\Windows\\Recent\\fan.tmp
%AppData%\\Microsoft\\Windows\\Recent\\snl2w.dll
%AppData%\\Microsoft\\Windows\\Recent\\tempdoc.sys
%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\PC Security Guardian.lnk
%AppData%\\Microsoft\\Windows\\Start Menu\\PC Security Guardian.lnk
%AppData%\\PC Security Guardian\\
%AppData%\\PC Security Guardian\\Instructions.ini
%AppData%\\PC Security Guardian\\cookies.sqlite
%UserProfile%\\Desktop\\PC Security Guardian.lnk

Registers:

HKCU\\Software\\Classes\\SOFTWARE\\Microsoft\\Internet Explorer\\SearchScopes\\URL = \"http://findgala.com/?&uid=289&q={searchTerms}\"
HKCU\\Software\\Microsoft\\Internet Explorer\\Download\\RunInvalidSignatures = \"1\"
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\0 = \"msseces.exe\"
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\1 = \"MSASCui.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\2 = \"ekrn.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\3 = \"egui.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\4 = \"avgnt.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\5 = \"avcenter.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\6 = \"avscan.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\7 = \"avgfrw.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\8 = \"avgui.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\9 = \"avgtray.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\10 = \"avgscanx.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\11 = \"avgcfgex.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\12 = \"avgemc.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\13 = \"avgchsvx.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\14 = \"avgcmgr.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\\15 = \"avgwdsvc.exe
HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PC Security Guardian = \"\"%AllUsersProfile%\\<random characters>\\<random characters>_<random numbers>.exe\" /s /d\"
HKLM\\SOFTWARE\\Classes\\CLSID\\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKLM\\SOFTWARE\\Classes\\PSc99_289.DocHostUIHandler
HKLM\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AAWTray.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AVCare.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AVENGINE.EXE\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\About.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Ad-Aware.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AdwarePrj.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AlphaAV\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AlphaAV.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AluSchedulerSvc.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Anti-Virus Professional.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AntiVirus_Pro.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AntispywarXP2009.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AntivirusPlus\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AntivirusPlus.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\AntivirusPro_2010.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\PsImSvc.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\PskSvc.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Quick Heal.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\QuickHealCleaner.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\SafetyKeeper.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Save.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\SaveArmor.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\SaveDefense.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\SaveKeep.exe\\Debugger = \"svchost.exe\"
HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Secure Veteran.exe\\Debugger = \"svchost.exe\"
... <Many more entryies>

6 responses to “PC Security Guardian”

Steven says:

May 23, 2011 at 4:15 pm

I find it very difficult to trust your information. The program you claim to remove wants me to buy their program. To get rid of it, I’m supposed to buy yours! Sorry, you do not impress me as any more trustworthy than the pc security guardian program itself. NO SALE
admin says:

May 23, 2011 at 4:27 pm

Steven – this is up to you. You can also try other programs, that remove it for free, but do not offer free limited protection. Also, You can expand each detection of Spyware Doctor, and delete the file manually.
David Harrington says:

May 27, 2011 at 11:54 pm

Im finding it difficult to stop and erase this PC Guardian and I would like for you to remove it from my pc. I don’t think that I should have to be the one to go in and remove, download or anything to have this removed. Your administration should remove this, so remove please. I will not purchase this software due to I already have one installed.
admin says:

May 28, 2011 at 1:29 pm

David Harrington: we are not related to PC Security Guardian. Read removal instructions.
AAV says:

June 1, 2011 at 1:48 pm

You don’t HAVE to get his program. Just as long as you have any Anti-Virus program. That PC Guardian thing however is a virus.@Steven
Kyusokuu says:

June 3, 2011 at 10:35 pm

I had this on my computer. I have McAfee and the tech did a remote view and cleaned it out. This thing was embedded deep in my system but he got it. Took over an hour to the tune of $90. It was worth it though, a big headache that is now gone.

PC Security Guardian - How to remove

Automatic Malware removal tools

Manual removal

TOC

6 responses to “PC Security Guardian”

Leave a Reply Cancel reply