Personal Guard 2009

Personal Guard 2009 is a fake Antivirus Software (rogue). The database is null, 0Kb. Updating the software, we get an unpacked version of the PE, but still no database for malware detection.



BleepingComputer Personal Guard 2009 removal guide.

Windows Additional Guard, Windows Guard Pro, Ultimate System Guard

Windows Additional Guard, Windows Guard Pro, Ultimate System Guard are the new rogues from the same family as Smart Virus Eliminator, Windows Protection Suite, Windows System Suite, Windows Security Suite, Malware Destructor 2009, FastAntivirus, MalwareCatcher, VirusShield, Extra Antivirus, Virus Sweeper, Ultra Antivir 2009, Virusdoctor, VirusMelt, VirusAlarm.

Windows Additional Guard, Windows Guard Pro, Ultimate System Guard display fake alerts to scare users.







Thanks to Sparsha

Save Keeper

SaveKeeper is the new rogue of the Winisoft family (Quick Heal Cleaner, System Cop, BlockDefense, SaveDefense, Trust Ninja, SaveSoldier, SaveKeep, Winishield, WiniFighter, WiniBlueSoft)

Antivirus Pro 2010

Antivirus Pro 2010 is the new Braviax family rogue (PC Antispyware 2010, Home Antivirus 2010, PC Security 2009, Home Antivirus 2009).

The rogue creates fake files on the system and detects it as malware to scare users.



Thanks to Malekal and Sparsha

Contraviro

Contraviro is a new fake malware cleaner (rogue). The GUI and name has changed, but it is the same code as Unvirex rogue.



The engine is from Clam AntiVirus (ClamAV), an open source (GPL) and free anti-virus toolkit.

HijackThis symptoms:

O2 - BHO: StatusBarPane - {CCB5551D-8594-4999-85F9-1E3EABCB95AC} - C:\Program Files\Contraviro\IEAddon.dll
O4 - HKLM\..\Run: [Contraviro] C:\Program Files\Contraviro\Contraviro.exe
O10 - Unknown file in Winsock LSP: c:\program files\contraviro\siglsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\contraviro\siglsp.dll

Notice the LSP Hijack. Removing siglsp.dll file without restoring the LSP chain will break Internet connexion.

QuickHealCleaner

Quick Heal Cleaner is the new clone of the Winisoft family (System Cop, BlockDefense, SaveDefense, Trust Ninja, SaveSoldier, SaveKeep, Winishield, WiniFighter, WiniBlueSoft)

Proof Defender 2009

Proof Defender is a Fake anti-malware software, a clone of Perfect Defender.

defender2009.com (76.76.101.85)
defender-2009.com (76.76.101.85)
pdefender2009.com (76.76.101.85)
proofdefender.com (76.76.101.85)
pdefzone.com (76.76.101.85)
perfectd-review.com (76.76.101.85)

Protection System rogue

Protection System is a fake anti-malware software, clone of CoreGuard Antivirus 2009.



Sunbelt blog reports (thanks to Patrick Jordan) Protection System detects Malwarebytes MBAM installation. The rogue runs MalwareBytes uninstaller to remove the protection.



CoreGuard Antivirus 2009 was also uninstalling MBAM:


The rogues removes the legit AntiMalware to confuse users and protect itself from being detected.

Protection System steal MBAM database version 2551. Of course, if the database is used by the rogue, the engine is not the same and can only use a small part of it to its advantage.

SystemCop rogue

System Cop is the new clone of the Winisoft family (BlockDefense, SaveDefense, Trust Ninja, SaveSoldier, SaveKeep, Winishield, WiniFighter, WiniBlueSoft)



Thanks to remixed

Windows Police Pro Rogue

Windows Police Pro is a Fake Security Software (Rogue). It is a clone of Windows Antivirus Pro It displays fake alerts and prevent execution of binaries to scare users.