XLGuarder – XLG Security Center

24 July 2008 Unwanted Program 2 Comments

XLGuarder or XLG Security Center is considered as a bogus security application, opposite to its name. XLG Security Center will pop-up exaggerated scan results on computer and advice user to register (with pay) the program, a trick commonly used by rogue software.

XLG Security Center normally utilizes a harmful Trojan like Vundo and Zlob to successfully penetrate a target computer. At first, Trojan will eliminate presence of anti-virus program to install XLG Security Center without catching user’s attention. Once loaded, the rogue software will provide numerous warning alerts stating presence of several threats. Each time Windows starts, the rogue program will run a virus scan that issues fake reports. As you may notice, the rogue program plays deceptive moves in order to convince you that computer is infected. Do not fall into this trick. Instead, scan the computer with legitimate security program. As expected it will turn out that XLG Security Center is a threat that requires immediate removal.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista

Characteristics (Analysis)
XLG Security Center is a fake security application. Unlike Trojans and viruses, rogue programs will not infect other files on the compromised computer. However, as stated above, XLG Security Center is associated with Trojan that can harm the computer and cause instability when not take care off.

Trojan can end running process that belongs to anti-virus programs. It may also block certain Windows tools like registry editor, task manager and control panel. Additional registry entries by the Trojan make the rogue program to execute every time Windows starts.

Added Registry Entries:

HKEY_ALL_USERS\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\"Shell" = "%Windir%\sysutils\sysutil.exe"

Associated Files and Folders:

%UserProfile%\Start Menu\Programs\Protection\Uninstall XLG.lnk
%Windir%\iebho.dll
%Windir%\sysutils\settings.ini
%Windir%\sysutils\sounds\01.wav
%Windir%\sysutils\sysutil.exe
%Windir%\sysutils\sysutil_s.exe
%Windir%\sysutils\uninstall.exe
%Windir%\sysutils\warning\alertpage.jpg
%Windir%\sysutils\warning\spacer.gif
%Windir%\sysutils\warning\warningpage.html
%Windir%\sysutils\winsystip.exe

Automatic Removal of XLG Security Center using Malwarebytes' Anti-Malware

In order to completely remove the threat, it is best to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean computer and rename the executable file before executing on the infected machine.