Windows Vista Blog

A rogue antivirus application related to Paladin Antivirus, Dr. Guard uses scare tactics to trick users into purchasing a software license. Dr. Guard reaches user systems via Trojan viruses that get downloaded from malicious websites advertising fake online scanners and along with fake video codec packs. Once installed, Dr. Guard disables all legitimate security programs that have already been installed on the system and proceeds to load itself at startup. Dr. Guard performs an endless stream of fake security scans on the system and reports that it is under threat from a large number of non-existent viruses and other malware. It also generates fake warning pop-ups from the Windows taskbar. Meanwhile, Dr. Guard repeatedly requests the user to purchase a license to the ‘full’ version of the software, claiming that the currently installed ‘trial’ version is incapable of removing the detected ‘threats’ properly. However, the so-called ‘full’ version of Dr. Guard is just as ineffective at removing these ‘threats’ as the ‘trial’ version, therefore, you should never allow yourself to be tricked into paying for it. Here www.removevirus.org/dr-guard-removal.html you will get more infos about this malware.

As soon as you find a copy of this malicious program on your system, you should take steps to immediately remove Dr. Guard. For Dr. Guard removal, it is necessary to stop processes, unregister DLLs, delete files and folders and remove registry entries.

File Removal Procedures

The first step in Dr. Guard removal is to stop the following processes:

• drguard.exe
• uninstall.exe
• asr64_ldm.exe

The next step is to unregister the following DLL files:

• drgext.dll
• drghook.dll

Finally, to complete file removal, delete the following files and folders:

• c:\Documents and Settings\[User]\Desktop\Dr. Guard Support.lnk
• c:\Documents and Settings\[User]\Desktop\Dr. Guard.lnk
• c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard
• c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\About.lnk
• c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Activate.lnk
• c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Buy.lnk
• c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Dr. Guard Support.lnk
• c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Dr. Guard.lnk
• c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Scan.lnk
• c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Settings.lnk
• c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Update.lnk
• c:\Documents and Settings\[User]\Application Data\Microsoft\Internet Explorer\Quick Launch\Dr. Guard.lnk
• c:\Program Files\Dr. Guard
• c:\Program Files\Dr. Guard\about.ico
• c:\Program Files\Dr. Guard\activate.ico
• c:\Program Files\Dr. Guard\buy.ico
• c:\Program Files\Dr. Guard\drg.db
• c:\Program Files\Dr. Guard\drgext.dll
• c:\Program Files\Dr. Guard\drghook.dll
• c:\Program Files\Dr. Guard\drguard.exe
• c:\Program Files\Dr. Guard\help.ico
• c:\Program Files\Dr. Guard\scan.ico
• c:\Program Files\Dr. Guard\settings.ico
• c:\Program Files\Dr. Guard\splash.mp3
• c:\Program Files\Dr. Guard\uninstall.exe
• c:\Program Files\Dr. Guard\update.ico
• c:\Program Files\Dr. Guard\virus.mp3
• %Temp%\asr64_ldm.exe

Once all these steps have been completed, Dr. Guard no longer resides on your file system. In order to make sure of this fact the best way to act is to conduct a complete file system scan using genuine antivirus software such as Spyware Doctor with Antivirus.

Registry Removal Procedures

Removing files and folders is not enough to ensure complete Dr. Guard removal. To completely remove Dr. Guard, you need to delete the following keys and settings from the Windows registry:

• HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\SimpleShlExt
• HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
• HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt
• HKEY_LOCAL_MACHINE\SOFTWARE\Dr. Guard
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Dr. Guard
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Dr. Guard”
• HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved “{5E2121EE-0300-11D4-8D3B-444553540000}”
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = “1″

After these steps have been completed, Dr. Guard removal reaches its end. However, due to the fact that Dr. Guard is usually installed by additional malware it is recommended to scan the entire PC using genuine antivirus software such as Spyware Doctor with Antivirus in order to make sure that the entire cleaning process has been completed successfully.

Conclusion

Manual Dr. Guard removal is not recommended for inexperienced users as any mistake made due to inexperience could cause damage to the computer. Inexperienced users are advised to use a web-based repair service such as www.onlinecomputerrepair.org or a legitimate antivirus application for safe and efficient Dr. Guard removal.