Windows Guard Tools computer infection deletion

1.Description

Windows Guard Tools can be braught to the category of pseudo AV software.

2. Behavior inside the compromised system

Windows Guard Tools pretends to scan the system for malicious objects. When this fake scanning is over, the list of detected threats is generated whre one can read about numerous viruses, worms and Trojans residing on the system. If one tries to remove these threats, he/she will be rerouted to the site where the commercial version of Windows Guard Tools is offered to eliminate the insecure stuff

3. Files

In the process of the installation, Windows Guard Tools copies the following files to the hard disk.

• %AppData%\NPSWF32.dll
• %AppData%\Protector-[rnd].exe
• %AppData%\result.db

4. System registry

Windows Guard Tools creates the following registry entries:

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Inspector %AppData%\Protector-[rnd].exe
• HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnHTTPSToHTTPRedirect 0
• HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\ID 4
• HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\UID [rnd]
• HKCU\Software\Microsoft\Windows\CurrentVersion\Settings\net [date of installation]
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ConsentPromptBehaviorAdmin 0
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ConsentPromptBehaviorUser 0
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA 0
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe\Debugger svchost.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe\Debugger svchost.exe
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE\Debugger svchost.exe

6. Windows Guard Tools automatic Remover