GuardPcs
December 15, 2009 Threat level:
(7 / 10)
GuardPcs description
GuardPcs is a bogus system security tool which tries to imitate the actions of a real antivirus application in order to trick the user into purchasing the license for using Guard Pcs. The application is nothing but a parasite which looks and acts the same as a number of other similar fake security tools like IguardPC, SiteAdware, AntiTroy and many others. In fact the only difference between these programs is their name.
GuardPcs just like the other applications of the kind is acquired online at various corrupt websites which use trans to download and install GuardPcs. As this fake anti-spyware enters the computer it configures itself to load automatically upon startup and performs numerous scans and displays fabricated warning messages to make the user believe that their machine has been seriously infected and that they need to purchase Guard Pcs in order to fix it. Unfortunately, being annoying is all that GuardPcs is actually capable of. Buying GuardPcs is just a waste of money.
Here an example of a fake security warning generated by GuardPcs:
Spyware Alert!
Your computer is infected with spyware. It could damage your
critical files or expose your private data on the Internet. Click
here to register your copy of GuardPcs and remove spyware
threats from your PC.
Moreover, GuardPcs may also harm the system and violate its functionality. GuardPcs should be removed immediately upon detection.
New processes created
GuardPcs.exeuninstall.exe Learn how to remove malicious processes
New GuardPcs registry entries created
HKEY_CURRENT_USER\Software\GuardPcsHKEY_LOCAL_MACHINE\SOFTWARE\GuardPcs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GuardPcs
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "GuardPcs.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ".exe" Download RegistryBooster 2010 to scan your registry errors
Learn how to remove malicious registry entries
New files and directories created
c:\Documents and Settings\All Users\Desktop\GuardPcs.lnkc:\Documents and Settings\All Users\Start Menu\Programs\GuardPcs
c:\Documents and Settings\All Users\Start Menu\Programs\GuardPcs\1 GuardPcs.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\GuardPcs\2 Homepage.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\GuardPcs\3 Uninstall.lnk
c:\Program Files\GuardPcs Software
c:\Program Files\GuardPcs Software\GuardPcs
c:\Program Files\GuardPcs Software\GuardPcs\GuardPcs.exe
c:\Program Files\GuardPcs Software\GuardPcs\uninstall.exe
C:\Windows\System32\.exe
%Temp%\.exe Learn how to unregister malicious DLL files
Symptoms in a Hijackthis log
O4 - HKCU\..\Run: [GuardPcs.exe] C:\Program Files\GuardPcs Software\GuardPcs\GuardPcs.exeHow to remove GuardPcs
To remove GuardPcs manually you must block rogue GuardPcs related websites, remove malicious processes and registry entries, unregister dlls and delete all malicious GuardPcs files from your computer.
Please note: cleaning your computer is a difficult and dangerous task, manually editing registry entries and removing processes and files may cause serious damage to your system. We strongly recommend scanning your computer with one of the legitimate antispyware scanners.