Home > Threats > IGuardPC

IGuardPC

Posted on 12 December 2009 under Rogue Programs

1. What is IGuardPC?

IGuardPC is a fake computer security software, designed to trick user and talk him into dishonest money transfer for faked program license.

User's confusion is achieved by displaying warning messages regarding computer security. Here is an example of Spyware Alert! warning, generated by fake Windows Security Center which is installed along with IGuardPC:
  • Your computer is infected with spyware. It could damage your critical files or expose your private data on the internet. Click here to register your copy of IGuardPC and remove spyware threats from your PC.
Fake Windows Security Center is used as a means of IGuardPC advertising. Fake Security Center is identical compared to an original one, so this is a very effective way to deceive user and make him believe that IGuardPC is recommended by Windows.

Since IGuardPC simulates anti-virus application, and computer scan is inevitable feature, IGuardPC will imitate computer scan, generating report containing found threats. All virus names in the report are not real, besides, at the time of IGuardPC installation, Windows system directory is supplement by a list of files with random names, which later will be treated as viruses in scan report. These files can not damage the computer and is only used to affect the user.

2. IGuardPC screen shot:

IGuardPC

3. How to remove IGuardPC:

  1. Internet connection might be disabled or Internet browser might be blocked by IGuardPC, so it won't be possible to download any files to infected computer. In this case please download all files required for IGuardPC removal to another computer and then transfer them on the infected one using CD/DVD or USB flash drive.
  2. To remove IGuardPC download Spyware Doctor and install the program (for the installation guide click here). Before installation, make sure all other programs and windows are closed.
  3. After the installation, computer scan should be started automatically. If so, please move to the next step. If not, click "Status" on the left side menu and press "Scan Now" button to run computer scanner as shown in the picture below:

  4. After the scan has been completed and scan results have been generated, press "Fix Checked" button to remove IGuardPC.

  5. Restart the computer to complete IGuardPC removal procedure.

4. Hijackthis entries:

O4 - HKCU\..\Run: [IGuardPc.exe] C:\Program Files\IGuardPc Software\IGuardPc\IGuardPc.exe