Severity scale  
  (72/100)

Windows Additional Guard. How to Remove? (Uninstall Guide)

removal by - -   Also known as WindowsAdditionalGuard, WindowsAdditional Guard, Windows AdditionalGuard | Type: Rogue Antispyware
12
Windows Additional Guard is a misleading security application that displays fake security alerts and reports false system security threats to trick you into purchasing the program. The application is a clone of such rogue anti-spyware applications as Windows Protection Suite and Windows System Suite. Once installed, WindowsAdditional Guard will imitate system scan and report a variety of infections and errors. Then it will prompt you to pay for a full version of the program to remove non-existing infections. Ignore scan results and uninstall Windows Additional Guard from your computer as soon as possible.

Windows Additional Guard is promoted through the use of Trojans, browser hijackers, fake online anti-malware scanners and other malicious software. Usually, Trojans display fake security warnings and suggest you to active Windows AdditionalGuard in order to ensure full system protection. While active, the misleading application will constantly display system notifications about insecure internet connection or supposedly harmful files found on your PC. You will see fake security alerts with the following or similar text:

"Insecure Internet activity. Threat of virus attack
Due to Internet browsing your PC can easily get infected with viruses, worms, and trojanswithout your knoledge, and that can lead to system slowdown, freezes and crashes. Also insecure Internet activity can result in revealing your personal information. To get full advabced real-time protection your PC ant Internet activity, install an antivirus and antispyware software. We recommend you to protect your PC now and continue safe Internet browsing."

"Warning! Your computer is infected
Warning!Trojan Found!
Threat detected: Trojan
File name: eb.exe
Threat name: Trojan-Spy.HTML.Bayfraud.hn
Recommended: Please click "Remove all" to eliminate all possible threats and protect Your PC"

What is more, Windows Additional Guard will hijack your web browser and redirect you to various misleading websites. It it will also hijack all search results and display fake notifications about possible Internet attacks. You will notice that your computer is slower than usual too. As you can see WindowsAdditional Guard is nothing more but a scam. Do not purchase this program. Instead, please use the removal guide below to remove Windows Additional Guard from your computer manually for free. If you have undesignedly purchased this program, contact your Credit Card Company or bank immediately. You should also scan your computer with a reputable anti-spyware application to make sure there are no other malware installed on your computer. Related files: cb.exe, cookies.sqlite, sqlite3.dll, mozcrt19.dll

Windows Additional Guard properties:
• Changes browser settings
• Shows commercial adverts
• Stays resident in background

It might be that we are affiliated with any of our recommended products. Full disclosure can be found in our Agreement of Use. By downloading any of provided Anti-spyware software you agree with our Privacy Policy and Agreement of Use.
Do it now!
Download
Reimage - remover Happiness
Guarantee
Compatible with Microsoft Windows
What to do if failed?
If you failed to remove infection using Reimage Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Windows Additional Guard. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Reimage is recommended to uninstall Windows Additional Guard. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Not using OS X? Download a remover for Windows.
Press Mentions on Reimage
Alternate Software
Alternate Software
STOPzilla
Tested and Confirmed! STOPzilla removes Windows Additional Guard (2009-09-06 23:58:01)
Malwarebytes Anti Malware
Tested and Confirmed! Malwarebytes Anti Malware removes Windows Additional Guard (2009-09-06 23:58:01)
Plumbytes
We are testing Plumbytes's efficiency (2009-09-07 00:17)
Hitman Pro
STOPzilla
Tested and Confirmed! STOPzilla removes Windows Additional Guard (2009-09-06 23:58:01)
Malwarebytes Anti Malware
Tested and Confirmed! Malwarebytes Anti Malware removes Windows Additional Guard (2009-09-06 23:58:01)
Webroot SecureAnywhere AntiVirus
Windows Additional Guard screenshot
Windows Additional Guard snapshot

Windows Additional Guard manual removal

Kill processes:
WI345d.exe
cb.exe
exec.exe
ppal.exe
Delete registry values:
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\WI345d.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" => "http://search-gala.com/?&uid=7&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "967907703"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows Additional Guard"
Unregister DLLs:
mozcrt19.dll
sqlite3.dll
ddv.dll
energy.dll
FS.dll

Delete files:
578.mof
mozcrt19.dll
sqlite3.dll
WI345d.exe
WINAG.ico
WINAGSys
vd952342.bd
winag.cfg
Windows Additional Guard.lnk
cookies.sqlite
ANTIGEN.tmp
cb.exe
CLSV.tmp
ddv.dll
dudl.drv
energy.dll
energy.sys
exec.exe
fan.drv
FS.dll
PE.drv
ppal.exe
SICKBOY.tmp
tjd.sys
search.xml
Delete directories:
c:\Documents and Settings\All Users\Application Data\345d567
c:\Documents and Settings\All Users\Application Data\WINAGSys
%UserProfile%\Application Data\Windows Additional Guard

Information updated:

Comments on Windows Additional Guard

Post a comment

Attention: Use this form only if you have additional information about a parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Home page Name



«

(All fields are required)