Home > Threats > GuardPcs

GuardPcs

Posted on 15 December 2009 under Rogue Programs

1. What is GuardPcs?

GuardPcs is a misleading computer program, in some cases may be incorrectly referred to as a virus. Since GuardPcs is not a virus, it does not have the reproductive ability, but may cause illegal money transaction and even private data theft.

Most misleading programs (GuardPcs is not excluded) has a Trojan horse component, through which user is mislead to install rogue program. Furthermore, during installation, a number of files will be dropped in Windows system directory, so that later they could be detected and treated as viruses. The name of each dropped file is indefinite - scattered sequence of numbers and letters. Here is an example of such file names:
  • 4d9fzparse25959.cpl
  • 4d90downlo5dzr2444.bin
Right after GuardPcs has been installed, simulated computer scan will be launched, which will finish system check in a very short time. Immediately after computer scan, a report with virus-like name entries will be generated, where each threat title is motivated by the file name that was dropped by a Trojan.

The essential feature of all misleading applications - a large amount of warning messages that alert user about computer security breaches and lead to rogue program purchase. Such messages usually carry false content, stating that the computer is infected with a viruses. In this case, acting on any of those messages, GuardPcs will be suggested as anti-virus tool, which has to be purchased in order to activate removal function.

GuardPcs licensed version is useless, accordingly, cash transfers are worthless. GuardPcs is not capable to remove computer viruses and other threats, even after the purchase.

2. GuardPcs screen shot:

GuardPcs

3. How to remove GuardPcs:

  1. Internet connection might be disabled or Internet browser might be blocked by GuardPcs, so it won't be possible to download any files to infected computer. In this case please download all files required for GuardPcs removal to another computer and then transfer them on the infected one using CD/DVD or USB flash drive.
  2. To remove GuardPcs download Spyware Doctor and install the program (for the installation guide click here). Before installation, make sure all other programs and windows are closed.
  3. After the installation, computer scan should be started automatically. If so, please move to the next step. If not, click "Status" on the left side menu and press "Scan Now" button to run computer scanner as shown in the picture below:

  4. After the scan has been completed and scan results have been generated, press "Fix Checked" button to remove GuardPcs.

  5. Restart the computer to complete GuardPcs removal procedure.

4. GuardPcs files:


C:\Program Files\GuardPcs Software\GuardPcs\GuardPcs.exe
C:\Program Files\GuardPcs Software\GuardPcs\uninstall.exe

5. Hijackthis entries:

O4 - HKCU\..\Run: [GuardPcs.exe] C:\Program Files\GuardPcs Software\GuardPcs\GuardPcs.exe