Comments on: Remove Spyware Protect 2009/SysGuard.exe (Removal Info)

By: emlarge

emlarge — Sat, 06 Feb 2010 16:26:21 +0000

For those of you who can’t access the internet after being hit by this marware, I found that it had added a value in my system registry to the following key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSettings\ProxyServer If you remove this value you should be able to access the internet again. (Start -> Run -> Type regedit, browse to the directory above, and remove the value (don’t delete the key though, just remove the value).

By: Chrisy

Chrisy — Thu, 21 Jan 2010 19:29:34 +0000

Boot to Safe Mode. Go to run and type msconfig>click on Launch system restore>choose restore my computer to an earlier time>pick a date from when you know the system was not infected (it will be in bold) and restore your system to that time. It will reboot and finish up the job after the reboot and you log in.

By: LOP

LOP — Wed, 20 Jan 2010 15:47:15 +0000

I found the malware installed at the following location on my computer: D:\Documents and Settings\{USERNAME HERE}\Local Settings\Application Data\gxexoo\mryisysguard.exe
It also modified my startup routine to include refrence to this mryisysguard.exe such that it start up anytime I start my computer
Then it modified my IE internet option – Connection – LAN Settings – Use Automatic Configuration Script. It placed a refrence to a .pac file from my C:drive that direct the IE to a website!!!
Clean the malware by searching for text that contain sysguard in safe mode, you will probably get some variant of the spellings with sysguard.exe Delete the file and the folder, restore your IE LAN settings by removing text in the Address field on the: Use Automatic Configuration Script
More importantly, follow all the suggested steps by good people on this thread