Vista Guardian, XP Guardian and Win 7 Guardian

2 February 2010 Rogue 7 Comments

Vista Guardian is a malware that belongs to a family of rogue who has the tendency to rename itself depending on the infected computer’s operating system. In this case, Vista Guardian targets Vista systems. Other version of this malicious software includes Win7 Guardian and XP Guardian. The malware always incorporate the OS name to its activities for deceptive purposes. This will make the unwanted program to convince user that it is a legit component of Microsoft Windows. More than that, Vista Guardian will disguise as an anti-virus program that will remove threats and protect computer from viruses.

Vista Guardian, XP Guardian and Win 7 Guardian commonly arrive on computer as a Trojan component. It will modify system settings and hijacked Internet browser to a fake security web sites. On similar web site, malicious Java Script file is hosted and waiting to be downloaded and run on visitor’s PC. Vista Guardian silently loads into the system via drive-by-download method. Without any complicated process, this fake antivirus will take control of the system. It is configured in the manner that removing will be enormously difficult for the user.

Alias: Vista Guardian 2010, XP Guardian 2010, Win 7 Guardian 2010

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Characteristics (Analysis)
Vista Guardian, XP Guardian and Win 7 Guardian are fake anti-virus applications. Unlike Trojans and viruses, these applications do not reproduce once it enters the system. They usually propagate by means of another infection. Once inside the computer, it generates some changes to Internet browser and registry. Rogue program process an attempts to call itself on every Windows boot-up by placing an entry on Windows registry. A more sophisticated rogue programs can halt security application by ending relevant process.

Malware Behavior
While Vista Guardian, XP Guardian or Win 7 Guardian runs inside the affected machine, it will display fake warnings on possible virus infections on the computer that will have message similar to this:

Vista Guardian 2010 Firewall Alert!
Vista Guardian 2010 has blocked a program from accessing the Internet
Internet Explorer is infected with Trojan-BNK.Win32-Keylogger.gen
Private data can be stolen by third parties, including credit card details and passwords.

Added Registry Entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “AntiVirusOverride” = “1?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center “FirewallOverride” = “1?
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CLASSES_ROOT\.exe\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_CLASSES_ROOT\secfile\shell\open\command “(Default)” = “av.exe” /START “%1? %*
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command “(Default)” = “av.exe” /START “firefox.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command “(Default)” = “av.exe” /START “firefox.exe” -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command “(Default)” = “av.exe” /START “iexplore.exe”

Associated Files and Folders:

%Documents and Settings%\[UserName]\Application Data\av.exe
%Documents and Settings%\[UserName]\Application Data\[random characters]

Boot Windows in Safe Mode With Networking

1. First thing to do is to reboot the computer in Safe Mode with Networking to avoid Vista Guardian, XP Guardian and Win 7 Guardian from loading at start-up. You may want to print this procedure as we have to restart the computer to complete the removal process.
- Restart the computer.
- Before Windows begins to load, press F8 on your keyboard.
- It will display an Advanced Boot Options menu. Please select Safe Mode with Networking.
- Windows will now start in Safe Mode.

Remove Vista Guardian, XP Guardian and Win 7 Guardian with MalwareBytes' Anti-Malware

2. Download removal tool from this page and save it on your Desktop or any location on your PC.
3. When finish downloading, double-click on the file to install the application.
4. Follow the prompts and install with default configuration.
5. Before the installation completes, you need to update the database.

6. Click Finish. Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
7. When finished updating, the tool will run. Select Perform full scan on main screen to check your computer thoroughly.
8. When scanning is finished click on Show Results.
9. Make sure that all detected threats are checked, click on Remove Selected. This will delete all files and registry entries that belongs to Vista Guardian, XP Guardian and Win 7 Guardian.
10. Restart your computer.

Note: If Vista Guardian, XP Guardian and Win 7 Guardian prevents mbam-setup.exe from downloading. Download the software from another computer. Renaming it to something like 'anything.exe' can help elude the malware.