Personal Guard 2009

Help,

I'm cleaning a PC XP machine, MBAM & SAS find the varmit, but require a reboot & Personal Guard comes right back.

Try Avira rescue CD & can't get to the flag to change languages, nor can I get to the scanner start button. Tried choosing (at start of Avira load) 1, 3, 4 ,5 video modes - alqays the same buttons can't be reached. I have 3 diff Avira rescues, they all act the same on this machine.

KAV rescue cd scans in 15 seconds & does nothing

Dr. Web finds nothing, run from windows or boot disc

HJT finds 04 personal guard, fixing this it just comes back

Google gives many manual cures, deleting the reg files, allows deleting c:\program files\personalguard folder. but in 30 seconds it's back.

when manual delete talks of %program files% & %user...% % is a variable? Using search %program files% us searching c:\program files, or am i confused here.

This rogue is frustrating the hell out of me.

Thanks
Rico

 

run the msconfig and disable the services and the the program that start with

 

Hehe. Sounds like a tough one. Send me your Hijack This log and I may be able to help

Or you can post it on a dedicated Hijack This forum

 

See:
http://www.bleepingcomputer.com/virus-removal/remove-personal-guard-2009

I would try again following their instructions for removal using MBAM. I would then run something like CCleaner after MBAM. Good luck.

 

Rico have you been to this site? It lists all the files/registry entries/etc... associated with Personal Guard and where they are located so you can remove them.

Hope this helps.

 

XP vm and after a scan/clean with MBAM the rogue Personal Guard 2009 is completely gone on reboot.

You are updating MBAM before scanning huh?

 

Hi Guys,

I saw several of the above sights & tried but it keeps coming back. I thought if I find "lan.dll" & unregister it that would help, I cannot find the file. MBAM was not the latest.

Can I manually update MBAM?

Thanks Guys
Rico

 

did you tried disable it's service withing msconfig?and did you tried to manually delete some registry keys?in safe mode?

 

in safe mode?

 

Another option you could try is uninstalling this rogue using Revo Uninstaller,I've had success with it on similar hard to remove rogues.

 

Hi Guys,

Safe mode I cannot enter.

I did try deleting registry entries (from the manual removal, links above) no luck.
Delete the registry entries then delete, program files\persoalguard <folder>, it comes back within a minute.

Tried Sophos rootkit - came up clean.

Tried the latest MBAM - it finds & tries to delete, but a reboot & it's back.

I have not seen a 'service' for this rogue

I'll try revo & report back

 

Hi,

Revo removed, but it was back instantly.

F-secure easy clean - did not find anything wrong

Smit-Fraud - seems to have knocked it out or dazed, personal guard. next scan with SAS which found killbox's attempt to kill personal guard. Tried rebooting to avira boot disc, still in german now way to select start scan or english. Back to windows, now scanning with avast worm.

I'll be back

Rico

 

@Rico try to restore your system 1 day before your problem start

 

Rico, Try this and see if it helps:

http://download.cnet.com/Remove-Fake-Antivirus/3000-2239_4-10915342.html

Alan

 

Hi Guys,

I did try Revo in advanced mode, still came right back.

SmitFraudFix - KO'd the sucker, I then deleted its folder, did the SAS which found killbox's attempt at personalguard.exe. Several reboots + clean MBAM & SAS scans. I thinks it's gone. I'll add Mister_Al's solution to my zip drive. Seems like rogue security apps are popular now.

I like SmitFraud, as it kills all processes, then scans. I guess that's similar to what I tried & failed to do, clean from boot disc, & safe- mode, both have fewer process's running.

Thanks
Rico