AV Guard Online

6 October 2011 Rogue 0 Comment

AV Guard Online looks like a decent software that is capable of removing virus from your computer. This program tells computer user that it can also prevent damages brought by malware infection. However, the real intention is to deceive users who are facing severe problems cause by no other than AV Guard Online itself. The truth about this rogue software is that it has already misled so many victims through its other variants like Security Guard 2012 and OpenCloud Security.

With the aid of Trojan, AV Guard Online can creep into your computer with all comfort. In fact, antivirus programs installed on the computer will never see that it is coming. An advanced technique called rootkit is able to conceal all of Trojan activities. There is more harm on this Trojan if it resides on the system for long. That it not only will load AV Guard Online but also disables any applications on the computer by blocking its executable files.

AV Guard Online and other software of the same kind aim to play tricks to its victims and shortly emphasizing the need for the purchase of its full version. Fake scan results, extensive display of warnings and browser redirection are just some of its mischief methods to persuade victims. When followed, all of these will lead to a payment-processing web site that may result to a purchase of useless security product.

Screen Shot Images:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Characteristics (Analysis)
Rogue security software like AV Guard Online is employing randomly selected file name to make it difficult for users and antivirus as well to locate and delete the file.
Example: cqxGpFoY0wcHSws.exe

This fake antivirus application executes start-up command through this added registry entry.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run.

Files mentioned above will be dropped to these target folders.
Windows XP – C:\Windows\System32, C:\Users\, C:\Documents and Settings\Application Data and C:\Documents and Settings\Start Menu\
For Windows Vista and Windows 7 – C:\Windows\System32, C:\Users\, C:\Users\AppData\Roaming, C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu

Malware Behavior
When AV Guard Online virus is installed on the computer, it will display excessive pop-up alerts and security notices stating that infection exists on the system. Some of this warning contains the following messages:

Security Warning
There are critical system files on your computer that were modified by malicious software.
It may cause permanent data loss.
Click here to remove malicious software.

Warning: Infection is Detected
Windows has found spyware infection on your computer!
Click here to update your Windows antivirus software

Warning: Spyware Detected
Windows has found spy programs running on your computer!
Click here to update your Windows antivirus software

Warning! Infection found
Unauthorized sending E-MAIL with subject “RE:” to was CANCELLED.

Related Registry Entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "(random characters

Associated Files and Folders:

%AppData%\cqxGpFoY0wcHSwsAV Guard Online.ico
%StartMenu%\Programs\AV Guard Online\
%StartMenu%\Programs\AV Guard Online\AV Guard Online.lnk
%System%\(random characters).exe
%UserProfile%\Desktop\AV Guard Online.lnk 
%AppData%\(random characters)
%AppData%\(random characters)
%AppData%\(random characters)
%AppData%\ldr.ini

This guide requires a tool called Malwarebytes' Anti-Malware. It is a free tool designed to eradicate various computer infections. MBAM scanner is distributed for free.

Boot Windows in Safe Mode With Networking

1. First thing to do is to reboot the computer in Safe Mode with Networking to avoid AV Guard Online from loading at start-up. You may want to print this procedure as we have to restart the computer to complete the removal process.
- Restart the computer.
- Before Windows begins to load, press F8 on your keyboard.
- It will display an Advanced Boot Options menu. Please select Safe Mode with Networking.
- Windows will now start in Safe Mode.

Remove AV Guard Online with MalwareBytes' Anti-Malware

2. Download removal tool from this page and save it on your Desktop or any location on your PC.
3. When finish downloading, double-click on the file to install the application.
4. Follow the prompts and install with default configuration.
5. Before the installation completes, you need to update the database.

6. Click Finish. Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
7. When finished updating, the tool will run. Select Perform full scan on main screen to check your computer thoroughly.
8. When scanning is finished click on Show Results.
9. Make sure that all detected threats are checked, click on Remove Selected. This will delete all files and registry entries that belongs to AV Guard Online.
10. Restart your computer.

Note: If AV Guard Online prevents mbam-setup.exe from downloading. Download the software from another computer. Renaming it to something like 'anything.exe' can help elude the malware.