XP Guard

14 November 2010 Rogue 0 Comment

XP Guard is a must removed software. Once a presence is observes on your computer, immediately run a virus scan. XP Guard virus will enter the computer in various ways. The most common is via Trojan that will download and install it on user’s PC without their knowledge. Trojan also looks for software vulnerabilities to be able to gain an access on the target computer. When it gains an access, the malware will perform changes on the configuration to load include self on Windows start-up. When loaded, XP Guard will always alert users of possible virus infection through fake pop-up messages. A task bar warning will also provide notices to victim about presence of viruses. As expected, only a full version is advertised as the only solution to fix this computer problem.

XP Guard can be acquired without your consent by visiting fake multimedia web site that will require a ‘player’ download. This needed tool will initiate the installation of XP Guard once you click on it. Moreover, this potentially unwanted program will disguise as an update to other software like Adobe, Flash Player, and Java. Among other means to spread XP Guard are instant messaging channels and spam email messages. Let us not also discount that the malware may invade your computer when a Trojan that is part of it has infected your system.

Screen Shot Images:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Characteristics (Analysis)
This malware creates the following registry entry to run every Windows reboot.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “XPGuard”

XP Guard will hijack Internet explorer home page and replaced it with a malicious URL. In addition, it can be replace with a fake ‘error’ page stating that it cannot continue browsing due to virus infection.

Malware Behavior
Once malware is running on the computer, it provides numerous of undesirable alert and warning messages. Displaying fake messages tend to mislead users on the security status of the system. One example of the phony alert contains this text.

XP Guard Firewall Alert
XP Guard has blocked a program from accessing the Internet
Internet Explorer is infected with Trojan-BNK.Win32.Keylogger.gen
Private data can be stolen by third parties, including credit card details and passwords.
This software should not be trusted and removed from PC.

Added Registry Entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XP-Guard
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "XPGuard" 
HKEY_CURRENT_USER\Software\XPGuard

Associated Files and Folders:

%UserProfile%\Desktop\XP-Guard.lnk
%UserProfile%\Start Menu\Programs\XPGuard
%UserProfile%\Start Menu\Programs\XPGuard\XP-Guard Web Site.lnk
%UserProfile%\Start Menu\Programs\XPGuard\XP-Guard.lnk 
c:\Program Files\XPGuard
c:\Program Files\XPGuard\INSTALL.LOG
c:\Program Files\XPGuard\UNWISE.EXE
c:\Program Files\XPGuard\XP-Guard Web Site.url
c:\Program Files\XPGuard\XP-Guard.exe

This guide requires a tool called Malwarebytes' Anti-Malware. It is a free tool designed to eradicate various computer infections. MBAM scanner is distributed for free.

Boot Windows in Safe Mode With Networking

1. First thing to do is to reboot the computer in Safe Mode with Networking to avoid XP Guard from loading at start-up. You may want to print this procedure as we have to restart the computer to complete the removal process.
- Restart the computer.
- Before Windows begins to load, press F8 on your keyboard.
- It will display an Advanced Boot Options menu. Please select Safe Mode with Networking.
- Windows will now start in Safe Mode.

Remove XP Guard with MalwareBytes' Anti-Malware

2. Download removal tool from this page and save it on your Desktop or any location on your PC.
3. When finish downloading, double-click on the file to install the application.
4. Follow the prompts and install with default configuration.
5. Before the installation completes, you need to update the database.

6. Click Finish. Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
7. When finished updating, the tool will run. Select Perform full scan on main screen to check your computer thoroughly.
8. When scanning is finished click on Show Results.
9. Make sure that all detected threats are checked, click on Remove Selected. This will delete all files and registry entries that belongs to XP Guard.
10. Restart your computer.

Note: If XP Guard prevents mbam-setup.exe from downloading. Download the software from another computer. Renaming it to something like 'anything.exe' can help elude the malware.