Wini Guard: How to Remove WiniGuard (Removal)

December 29th, 2008 | by Alex |

Wini Guard Descriptions:

Wini Guard, also known as WiniGuard, is new counterfeit anti-spyware software that created to invade yoru privacy and ruin the Internet community. Just like most fake antispywares, Wini Guard issues misleading and exaggerated results. Wini Guard usually installed itself onto your PC without your permission, through Vundo Trojan, Virus or fake software. WiniGuard will display fake system alerts or fake security alerts to trick user to buy the paid version of WiniGuard , in order to remove the potential and reported problems. Not only does it cause your machine to slow down dramatically, it would also put your privacy and data in risk.

ams Download SpyHunter* Spyware Detection Utility.

Manual Wini Guard Removal Instructions:

Stop Wini Guard Processes:
(Learn how to do this)
WiniGuard.exe

Find and Delete these Wini Guard Files:
(Learn how to do this)
c:\Program Files\WiniGuard\WiniGuard.exe
c:\Program Files\WiniGuard\WiniGuard.url
c:\Program Files\WiniGuard\uninst.exe
c:\Program Files\WiniGuard\Lang
c:\Program Files\WiniGuard\Lang\English.ini
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\WiniGuard 1.32.lnk
%UserProfile%\Desktop\WiniGuard.lnk
%UserProfile%\My Documents\WiniGuard
%UserProfile%\My Documents\WiniGuard\SDBHO.dll
%UserProfile%\My Documents\WiniGuard\sdcfg.dat
%UserProfile%\My Documents\WiniGuard\Logs
%UserProfile%\My Documents\WiniGuard\Quarantine
%UserProfile%\Start Menu\Programs\WiniGuard
%UserProfile%\Start Menu\WiniGuard 1.32.lnk
%UserProfile%\Start Menu\Programs\WiniGuard\WiniGuard 1.32.lnk
%UserProfile%\Start Menu\Programs\WiniGuard\WiniGuard Website.lnk
c:\Program Files\WiniGuard
c:\Program Files\WiniGuard\blacklist.txt
c:\Program Files\WiniGuard\msvcp71.dll
c:\Program Files\WiniGuard\msvcr71.dll
c:\Program Files\WiniGuard\sdev.sgn

Remove Wini Guard Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “WiniGuard”

asm Download SpyHunter* Spyware Detection Utility.

bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark bookmark


Add this page to Favorite (For Internet Explorer)


Disclaimer

  1. 65 Responses to “Wini Guard: How to Remove WiniGuard (Removal)”

  2. By lee raines on Nov 7, 2008 | Reply

    can i just remove winiguard through add/remove

  3. By Ronnie Johnson on Nov 30, 2008 | Reply

    i have done all this. i have ran numerous virus, spyware, malware, and adware scans and i still have this problem. according 2 all my searches on my comp there is no winiguard on it anywhere. but these pop ups on my desktop saying low memory due 2 viruses and infiltration alert your computer is being attacked from internet so on and so on do u want winiguard 2 handle this attack? how is it asking me this if its not on my computer?????????

  4. By Bram on Dec 3, 2008 | Reply

    I am having the same problem with you Ronnie Johnson,

    I guess nothing we can do now besides formatting our computer all over again.

    Please if someone have suggestion.

  5. By Angie on Dec 3, 2008 | Reply

    Dear Ronnie…

    It’s because you removed the Winiguard but you have a Zlob. Check in all your computer processes and HKEYs for that. It might be under some weird acronym… like the one I have which is kdqam.exe

    Good luck

  6. By andrew on Dec 4, 2008 | Reply

    after removing these things manually or automatically with an malware romover, do a system restore to before you first installed winiguard

  7. By Alan on Dec 7, 2008 | Reply

    What is a Zlob and how would i find the one that’s taking over my machine?

  8. By McCowboy on Dec 7, 2008 | Reply

    Winiguard is a nasty bitch. I could never imagine I would get infected with something like this. How the hell can I get rid of winiguard bullshit?

  9. By hack on Dec 10, 2008 | Reply

    I HAVE THE SAME PROBLEM A PIG SOUND COMES UP
    AND [POPS UP ALL THE TIME I WAS TOLD TO
    BASICLY REBOOT THE DISK THAT CAME WITH MY COMPUTER BUT BACK UP FILES.

  10. By Alf on Dec 10, 2008 | Reply

    I’m having the same problem.
    I went to task manager and tried to find the “zlob,” but could not find anything.
    What is an: hkeys ?
    Thanks for any help.
    Alf

  11. By Alf on Dec 12, 2008 | Reply

    I found the answer at Yahoo.com!
    1. do a search on Hard drive for all files called winiguard and delete them.
    2.go to registry edit (bottom left corner of your screen) type in “regedit” hit control F and search Winiguard each registry it finds delete, you must keep hiting control F and searching it and deleting until all gone.
    3. restart computer in safe mode.
    go to folder C:Windows?system32 and delete the files called baloon.exe and cfrog.exe.
    4.restart again and open internet explorer go to internet options go to advance tab,click the restart button.
    It works my problems are solved no more pig sounds, etc.
    good luck!
    Alf

  12. By Moderator Kevin G. on Dec 19, 2008 | Reply

    I have also discovered for those experiencing the “pop-ups” Making certain noises telling you have a virus, Go on to task manager(crtl+alt+del) and find a process called “Baloon” End it and the pop up will no longer make noises or show

  13. By Broman on Dec 20, 2008 | Reply

    Ok this is what i did and i believe i have completely removed all components …. hopefully :(

    Ok straight away search for the Winiguard folder. It’s called Winiguard so it isn’t hard to find. Something like c:/Programs/Winiguard i think and delete this folder.

    Then bring up Regedit. With XP search for run then open it, type regedit which brings up the Register Editor. Don’t F*#@ around with these as hey can stuff your computer. Press Ctrl + F to bring up the find box. Type WiniGuard and delete files specifically linked to the program, easily identifiable as under the data column it indicates that it is associated with the program. Repeat the search and delete process multiple times until no registries are found.

    Ctrl + Shift + Esc to bring up the Windows Task Manager. Search for a program called Baloon.exe Delete this program and you should be fine.

    I did another search of the Registry Editor to make sure no files remained and i recommend you do the same. Can’t be too careful especially with such an annoying piece of Malware like WiniGuard.

    Good Luck

    Oh and F*&% WiniGuard and people who exploit others using similar strategies!

  14. By Broman on Dec 20, 2008 | Reply

    Sorry i forgot to mention that Baloon.exe will still be buried in your computer. It is located in C:/Windows/system32 delete this!

    In addition a program called cfrog will be running which brings up a pop-up indicating system memory to be low and instructs you to close all programs … i’d rather not and can only assume this would not be a good idea :P open the Windows Task Manager again. Locate the file cfrog.exe and end this process. Search through the system 32 file and locate this program. Delete ASAP.

    Hope this works for you. If not we can all pool resources and hunt down the creators of this program and get some revenge …. okay maybe i’m a little sensitive because someone wasted an hour of my life!

    Cheers :)

  15. By Luther G on Dec 20, 2008 | Reply

    Wow what a stinky bug…however he is what I did to remove it…I am not that computer literate si I contact symatec online chat…they took control of my comp and removed that stinky bug…it cost me $99.99 with a 30 day retry if it occures again…hope this helps

  16. By kopo on Dec 21, 2008 | Reply

    What do you do if you go to the file in C:/Windows/system32 does not have exe after it. I tried to delete the two files and it won’t let me. It said they may be running or disk full any suggestions?

  17. By chris2low on Dec 23, 2008 | Reply

    alright i need help the wini guard keeps poping up and making the kiss sound then like a few later a box comes up and says low memory but my computer beeeps forever i want this wini gone its driving me nuts plz help

  18. By Ojo on Dec 24, 2008 | Reply

    Caused by winiguard malware and it showed up as cfrog.exe under my running processes. Always there at startup, i need to end the process tree each time. Can this be removed manually through the registry?

  19. By Galina on Dec 30, 2008 | Reply

    thanks a lot, it helped.

  20. By swig on Jan 1, 2009 | Reply

    For Broman re comments 20DEC08 Much appreciated your expert advice appears to have got rid of the dreaded Winiguard, fingers crossed

  21. By earlessdude1388 on Jan 8, 2009 | Reply

    kopo,
    Search for cfrog.exe in the task manager, then seach for it in system32, this way you can delete it.

  22. By Calql8tor on Jan 10, 2009 | Reply

    I found a couple more things.

    1. ctrl-alt-del kill
    “winiguard”
    “baloon”
    “cfrog”

    This should prevent need for safemode and will allow delete.

    2. search hdd and delete everything with
    “winiguard”
    “baloon”
    “cfrog”
    I found additional files in c:\windows\prefetch

    3. start->run->regedit
    search and delete all entries with
    “winiguard”
    “baloon”
    “cfrog”
    one at a time moving the cursor back to the top each time (start from beginning)

    4. You should be complete!

  23. By Lauren on Jan 15, 2009 | Reply

    Thank you!!! Thank You!! Thank You!!! I was literally on the verge of tears B/C of WiniGuard, I’m not that Technologically advanced as it is, so to go through the intricate parts of systems to remove an agressive piece of software was kind of daunting, but going through the registry and the task maneger took care of Everything! Thank you so much.

  24. By Rachael on Jan 28, 2009 | Reply

    It won’t allow me to delete this system32 at all. It’s telling me I need permission. But I am the admin. so I don’t know what the deal is here. Why is it asking for permission although I give it to delete it but it refuses my request!!!

  25. By tyler on Jan 29, 2009 | Reply

    dont delete system32 file. just the balloon file located in it

  26. By tyler on Jan 29, 2009 | Reply

    system32 is a folder that basically makes ur computer run. if u delete it your computer will basically no longer exist… the only thing u should do is to delete the balloon file located in it.

  27. By oliver on Jan 30, 2009 | Reply

    I found those two the balloon file and a frog file i kill them using the process explorer and now they are gone. Just I hoope those alerts aren’t appearing anymore, I’ll tell you if they are or not nex time i write yoou guys.

  28. By oliver on Jan 30, 2009 | Reply

    It worked. for me anyways.
    Thanks for all your comments very helpfull.

  29. By john on Feb 3, 2009 | Reply

    great job. i found the baloon an cfrog an now the virus is gone. thanks

    ps to find the system32 file i had to search for it.

  30. By tyler on Feb 3, 2009 | Reply

    this is weird, i deleted the files a week ago. No problems, but yet now they have returned… any help?

  31. By John E. on Feb 4, 2009 | Reply

    Ctrl.-Alt.-Delete helped me the most getting to Task Manager and deleting baloon.exe. Problem solved. Thanks!

  32. By Jake on Feb 7, 2009 | Reply

    i unistalled it first but then the pop ups wont stop comeing i need help!!!!!!

  33. By cody on Feb 8, 2009 | Reply

    none of those files exist on my computer in the system 32 or registry (that i can find) or task manager. I still have the annoying balloon with a link that goes no where and another one from antivirus pro!!! anyone got any other ideas. i didnt find anything in prefetch either.

  34. By Jordan on Feb 8, 2009 | Reply

    Another program you all might need to search for is called Promo. I went through and deleted all the balloon files, cfrog, and winiguard. But I was still getting the side popups. I ironically have had my computer on mute for like the past 3 days, so I dont know if I was getting any sounds. One thing I realized was that I had a Promo thing running whenever I opened task manager, and for some reason that just seemed odd to me. So as I searched through all the system23 files I came upon a Promo file that was created at the same time that I downloaded the virus. I deleted that program, and also removed it from my task manager, and I haven’t had a popup yet.

  35. By Lexi on Feb 9, 2009 | Reply

    Thank you so much Jordan. I have been tearing my hair out trying to fix this and its finally stoppped! I had tried everything else suggested and nothing worked til I deleted the promo files from System32 and the Registry!

  36. By Kemper on Feb 9, 2009 | Reply

    Beware that the baloon.exe file can sometimes appear as promo.exe or something else. When your in task manager look for “securety center” on the right side of the screen, right down the .exe file on the left side and end that process. Now go to the registry editor and search for the .exe file that you found in task magager ( mine was promo.exe ) and Delete it! You also have to delete the cfrog.exe file and anything with winiguard in the name.

  37. By James on Feb 9, 2009 | Reply

    TO ANYONE WHO STILL HAS POP-UPS AFTER DELETING WINIGUARD.

    Go to your Task Manager and find on there something called “promo.exe”

    Delete this, and then go to the Start menu and choose “search”

    Search for the same thing in “All Files and Folders”, then under “Local Disk (C:)”.

    You’ll find the file with the logo of Windows security next to it. Delete this and the pop-ups and site blocking discontinues.

    Hope this helps. It took me 3 days to find it.

  38. By steck1 on Feb 9, 2009 | Reply

    i was just infected with this bs winiguard…to remove it i just did a system restore back to 3 days ago(or to just before you got infected) and it is gone
    i didnt have to remove or delete any programs…hope it will work for you

  39. By steck1 on Feb 9, 2009 | Reply

    do a system restore to a day or two before you were infected.worked for me

  40. By LaNeal on Feb 10, 2009 | Reply

    Thanks so much Jordan hard as hell to figure out hey all I never had the ballon.exe file I had just the frog one and Promo look in system32 and search for promo you have to delete the promo file first in task manager then go to system32 okay finally gone thanks again Jordan

  41. By Will on Feb 11, 2009 | Reply

    i wish i could of done a system restore but i had installed some vital applications (world of warcraft :P) and then winiguard pops up along with his friendly buddy the memory noise thing. the thing is i didnt go on to the winiguard website or download anything of theres it just came on to my pc.

    so eventually not being able to find it on my avg i came on to the net and all i have to say is thank you yahoo and this site ^_^, it was a b1″*h playing wow and then piggy squeek -_- fun fun fun i tell ya.

    thank you all :)

  42. By Ali on Feb 12, 2009 | Reply

    If i could see you guys..i would by you all drinks,

    you just saved me, and my Friends ass. he downloaded this from surfing the net, and the site told him he was infected and needed a antivirus.

    anyways i am starting a business on my lap top that was NOT backed up. so thank you VERY MUCH!

    btw.

    when you go to delete the promo.exe, you need to Ctrl+alt+del and end the process first then go into windows32 and delete the file Promo.

    GOOD LUCK EVERYONE!

  43. By Dj on Feb 14, 2009 | Reply

    THANK YOUUUU!!!!!!!!!!!!!!!!!!!!!!!!!!
    i deleted the cfrog but i couldnt find baloon so i was scrollin down an kemper stated that baloon is also called promo
    found it an deleted it

    YEZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
    thank you KEMPER AN EVERY1 ELSE!

  44. By dt10 on Feb 14, 2009 | Reply

    Jordon you are a sexy S.O.B. Thank you!

  45. By madhu on Feb 15, 2009 | Reply

    3. start->run->regedit
    search and delete all entries with
    “winiguard”
    “baloon”
    “cfrog”
    one at a time moving the cursor back to the top each time (start from beginning)

    goto C:\Windows\System32

    delete 1)cfrog.exe
    2)promo.exe

    when you go to delete the promo.exe, you need to Ctrl+alt+del and end the process first then go into windows32 and delete the file Promo.

  46. By Don on Feb 16, 2009 | Reply

    Well thak you all for helping me delete that piece of SH*T off my comp. But i did everything and i can’t get my kaspersky to go into my comp can anyone help me out

  47. By Don on Feb 16, 2009 | Reply

    You guys are very helpful. hope we can find them SOB’s who made this and send tht SH*T back to them

  48. By Daniel on Feb 16, 2009 | Reply

    OMG! thank you guys so much!!!!!!!! winiguard is GONE! omg im so happy! now…I WANT A REFUND OF 3 DAYS OF MY LIFE, WINIGUARD!!!!

  49. By Caroline on Feb 19, 2009 | Reply

    It took me a while to get this S**t of my computer but I was finally able to. I had all three, cfrog, baloon and promo on mine. Deleted it from task manager and regedit, then system32. What a pain in the a$%! BIG thanks to everyone. XOXO

  50. By Gunna on Feb 19, 2009 | Reply

    Yo I deleted that file named “promo.exe” and it completely got rid of it! Phew! Now i just gotta watch out for these damn trojans again! Thanks people. Especially KEMPER. Bless yaz

  51. By Pcc on Feb 21, 2009 | Reply

    Wow! This was bs! I hate getting these kind of spyware. I ran all my trojan, virus, spyware remover and nothing could fix it. I read many forums and they suggested everything but removing the promo.exe and promo file in system32. Jordan, you’re a god, you saved my life. Now I can go to sleep in peace.

  52. By Ozzy on Feb 24, 2009 | Reply

    This thing is truly a nasty piece of work. It infected my kid’s computer. Thanks so much to Jordan and everyone else who posted helpful comments. Winiguard had infected three or four seperate locations and it’s gone now as near as I can tell. Took me more than an hour to find them all even with all of the wonderful advice.

  53. By Jay Kaos (SYD) on Feb 25, 2009 | Reply

    Winiguard is the worst thing ever!! I hope the douchebag who has nothing better to do wid theyre time and created this gets ripped into pieces!!!! COCK!

  54. By Jonathan on Mar 1, 2009 | Reply

    Thank you so much everyone, I thought I’d never get that damn thing out of my system. Feels like a weight’s just been lifted off my shoulders - I was afraid I’d have to reformat for a while there. Anyway, thanks again and hopefully those Winiguard assholes get what’s coming to them!

  55. By alfonso on Mar 2, 2009 | Reply

    I think you guyz are fucken awesome,i got rid of this fucken shitiguard because of you…thanx!

  56. By Bob on Mar 4, 2009 | Reply

    Also look for cfrog.exe running in your task manager and in your Hkey_local… Run folder. After killing and removing it from the run folder you may also notice one called Promo.exe. Kill this process and remove from run folder. In addition you will now probably find 600+ junk files with various extentions and false created dates in your c:\windows and c:\windows\system32. Most of these will start with odd file combinations like 1cb4fr18eer9f… . You will also find a couple listed under something like e4fhie… few54weq… and a bunch under the letter z as well. I found 700+ in c:\windows and another 600+ in system 32. I deleted them all. It has seemed to die down for the moment and nothing extra appears to be loading. Various scans have come up clean, but they didnt help much in the first place. Good Luck!!

  57. By guy on Mar 7, 2009 | Reply

    that fixed it

  58. By mike on Mar 15, 2009 | Reply

    thank you to all of you.i reached to point of committing my first societte attempt cos of this wini shit guard! thank you cyberspace and thank you all you wonderful people who put your time to give back your bit to father universe!

  59. By Greg on Mar 26, 2009 | Reply

    promo was on mine, this program made life HORRIBLE for me!

  60. By David on Mar 28, 2009 | Reply

    Okay, did all the free spyware,malware or whatever the hell its called. Got somethings off, but not all. I was planning on throwing my P.O.S laptop away because of this damn WiniGuard. But I found the promo.exe under the task manager and search and the regestry. BYEBYE Winiguard! My laptop is saved!
    P.S. F**K WINIGUARD!!!

  61. By Valerie on Apr 16, 2009 | Reply

    Thank you all so much. I think that pig is finally gone!!!

  62. By Gordon on Apr 25, 2009 | Reply

    In “system32″ deleting baloon and cfrog, I noticed ddozens of “cookies” that were of the exact same date and time. You may want to delete those also.

  63. By brandon on May 23, 2009 | Reply

    I deleted all the files, but when I’m trying to update my spyware doctor it’s failing. The Internet is redirecting or failing, I heard there is a keyword list that if keyed or searched it shuts down. Anyone know how to get rid of this? Please help! I need to remove the malware but it won’t let my computer.

  64. By steve-0 on May 29, 2009 | Reply

    i have the same problem but it has gotten a lot worse. my computer just restarts by itself now.

  65. By steve-0 on May 29, 2009 | Reply

    im beginning to think its impossible.

  66. By Elliott on Jun 13, 2009 | Reply

    Why do all the Winiguard removal pages on various sites miss this promo.exe? We shouldn’t have to scroll down through all the user comments to find that detail.

Post a Comment