PSGuard Removal Guide

PSGuard Description

PSGuard is a corrupt illegally distributed anti-malware application. It is secretly installed to victim PCs by many trojans, which usually are variants of the Smitfraud spyware.

PSGuard Automatic Detection (Recommended)

Is your PC infected with PSGuard? To safely & quickly detect PSGuard, we highly recommend you...

Download SpyHunter's* Malware Scanner.

PSGuard Manual Removal Instructions

Backup Reminder: Always be sure to back up your PC before making any changes.

Step 1 : Use Windows Task Manager to Remove PSGuard Processes

Remove the "PSGuard" processes files:

Read more on How to kill PSGuard Processes

Step 2 : Use Registry Editor to Remove PSGuard Registry Values

Locate and delete "PSGuard" registry entries:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallInternetUpdate
HKEY_LOCAL_MACHINESOFTWAREShudderLTDPSGuard
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemNoDispBackgroundPage=1
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemNoDispAppearancePage=1
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoActiveDesktopChanges=1
HKEY_CURRENT_USERControlPanelDesktopWallpaper=%System%wppp.html
HKEY_CURRENT_USERControlPanelDesktopWallpaperStyle=0
F61D1CE1-5199-4B57-B59E-C6819EA92F3B
982392F9-9C65-48B4-B667-3459C46630D1
F4364EEC-31F5-4B8B-A7E0-3B6394C9D23F
F100A342-3AC5-47FF-B5B3-FCDB6FC9F016
E0D6C30A-B9A3-4181-8099-3B0D5A2B98AF
D6A7D177-0B2F-4283-B2E8-B6310A45E606
D5D6E9B5-30D5-4457-AC8B-399205F50411
CF1674CC-EC9A-4AEE-996E-65A8F7C0B0E4
CB9385AB-8541-4B2F-A363-48F64C612993
C6E2A22C-B3A8-43A4-B5EC-A5BB671AB3F7
B803D266-A08D-4A4C-9604-6D35689ABE09
B26B5883-F15F-4283-B3D5-A1728077DE47
A917B2F3-A9BF-477C-A0E3-0382D0376159
A20F5672-7486-4D27-BD2B-E555E4692C5F
A00E2305-7001-4200-BA00-5779F9A3E7D3
8EC33B7D-9953-4EDB-ACE2-D4C105968601
8B6C0168-BAAC-4C7C-911E-0132590F5661
7B6A3434-8625-4ABF-B79D-09D98C2498C4
4723879B-8F52-4BE7-9994-626AFA539366
3A350193-C7F7-4E10-B347-02FF4C3CC4E9
2C462D06-3BA0-48BB-9282-BB6519FE86E9
28FEDB90-53C7-4928-994A-CEE782606507
20F8B70D-9F16-4DCB-8788-90A0498E46B9
1C94EA51-3800-4F08-B5DC-A5B67823FFEA
1BD98DFD-2DA9-4C54-85D7-BE03A0F9C487
17E02586-A91D-4A9D-A74E-187B05DFFE6F
15DC7116-E58E-4395-A45A-A1C99B17C030
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunPSGuard
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionUninstallInternet UpdateHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunintell32.exe
HKEY_LOCAL_MACHINE SOFTWAREShudderLTDPSGuard 
HKEY_CURRENT_USER SoftwareMicrosoftWindows CurrentVersionPoliciesSystemNoDispBackgroundPage=1 
HKEY_CURRENT_USER SoftwareMicrosoftWindows CurrentVersionPoliciesSystemNoDispAppearancePage=1 
HKEY_CURRENT_USER SoftwareMicrosoftWindows CurrentVersionPoliciesExplorerNoActiveDesktopChanges=1 
HKEY_CURRENT_USER Control PanelDesktopWallpaper=%System%wppp.html 
HKEY_CURRENT_USER Control PanelDesktopWallpaperStyle=0 
HKEY_CLASSES_ROOTTypelib{F61D1CE1-5199-4B57-B59E-C6819EA92F3B}  
HKEY_CLASSES_ROOTTypelib{982392F9-9C65-48B4-B667-3459C46630D1}  
HKEY_CLASSES_ROOTInterface{F4364EEC-31F5-4B8B-A7E0-3B6394C9D23F}  
HKEY_CLASSES_ROOTInterface{F100A342-3AC5-47FF-B5B3-FCDB6FC9F016}  
HKEY_CLASSES_ROOTInterface{E0D6C30A-B9A3-4181-8099-3B0D5A2B98AF}  
HKEY_CLASSES_ROOTInterface{D6A7D177-0B2F-4283-B2E8-B6310A45E606}  
HKEY_CLASSES_ROOTInterface{D5D6E9B5-30D5-4457-AC8B-399205F50411}  
HKEY_CLASSES_ROOTInterface{CF1674CC-EC9A-4AEE-996E-65A8F7C0B0E4}  
HKEY_CLASSES_ROOTInterface{CB9385AB-8541-4B2F-A363-48F64C612993}  
HKEY_CLASSES_ROOTInterface{C6E2A22C-B3A8-43A4-B5EC-A5BB671AB3F7}  
HKEY_CLASSES_ROOTInterface{B803D266-A08D-4A4C-9604-6D35689ABE09}  
HKEY_CLASSES_ROOTInterface{B26B5883-F15F-4283-B3D5-A1728077DE47}  
HKEY_CLASSES_ROOTInterface{A917B2F3-A9BF-477C-A0E3-0382D0376159}  
HKEY_CLASSES_ROOTInterface{A20F5672-7486-4D27-BD2B-E555E4692C5F}  
HKEY_CLASSES_ROOTInterface{A00E2305-7001-4200-BA00-5779F9A3E7D3}  
HKEY_CLASSES_ROOTInterface{8EC33B7D-9953-4EDB-ACE2-D4C105968601}  
HKEY_CLASSES_ROOTInterface{8B6C0168-BAAC-4C7C-911E-0132590F5661}  
HKEY_CLASSES_ROOTInterface{7B6A3434-8625-4ABF-B79D-09D98C2498C4}  
HKEY_CLASSES_ROOTInterface{4723879B-8F52-4BE7-9994-626AFA539366}  
HKEY_CLASSES_ROOTInterface{3A350193-C7F7-4E10-B347-02FF4C3CC4E9}  
HKEY_CLASSES_ROOTInterface{2C462D06-3BA0-48BB-9282-BB6519FE86E9}  
HKEY_CLASSES_ROOTInterface{28FEDB90-53C7-4928-994A-CEE782606507}  
HKEY_CLASSES_ROOTInterface{20F8B70D-9F16-4DCB-8788-90A0498E46B9}  
HKEY_CLASSES_ROOTCLSID{1C94EA51-3800-4F08-B5DC-A5B67823FFEA}  
HKEY_CLASSES_ROOTCLSID{1BD98DFD-2DA9-4C54-85D7-BE03A0F9C487}  
HKEY_CLASSES_ROOTCLSID{17E02586-A91D-4A9D-A74E-187B05DFFE6F}  
HKEY_CLASSES_ROOTCLSID{15DC7116-E58E-4395-A45A-A1C99B17C030}  
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindowsCurrent VersionRunPSGuard 
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindowsCurrent VersionRunintell32.exe

Step 3 : Use Windows Command Prompt to Unregister PSGuard DLL Files

Search and unregister "PSGuard" DLL files:

Read more on How to Remove PSGuard DLL Files

Step 4 : Detect and Delete Other PSGuard Files

Remove the "PSGuard" processes files:

Read more on How to Delete Harmful Files

Site Disclaimer

Publication Date: Tue Mar 28 2006 12:19:23 EDT

User Comments

Username:

Joshua Issac

Date Posted:

2008-06-05 16:08:08

Comment:

This is a good set of instructions. When my computer was infected with PSGuard, I could not use the Add/Remove Programs section to remove the virus. It just would not uninstall. I could not open Internet Explorer, which was then my only browser, and I my antivirus (Panda Antivirus Platinum) kept closing immediately after I launched it. Finally, I remembered System Restore to restore my computer and then deleted the files. How do the virus makers expect me to buy their software if I can't even open Internet Explorer? I have not seen any response to PS Guard like mine anywhere on the Internet. Strange!

RECOMMENDED

Top Parasite Threats

Recent Parasite Threats

Resources and Tools

Recent Articles

Subscribe To