Personal Guard 2009

[aaron3579]

My Windows XP laptop was attacked by Personal Guard 2009 on the morning of September 8, 2009 at or around 11:00 AM. If you don’t know what it looks like, then I can tell you that it mimics Windows Security Center, and claims that your PC has no virus protection. It puts this little booger in the programs tray:

It simultaneously runs this executable at C:\Program Files\Personal Guard 2009\personalguard.exe which pops up in its own window and looks like anti spyware software. It proceeds to run a phony scan of the HDD and spits out a long report of false threats to the PC. ALSO every now and then it will blast a popup that claims the PC is under attack from hackers and gives the option to either buy the full version of Personal Guard 2009 or “continue unprotected.” I fought with this program until about 5:00 AM on September 9. As of the time of this writing, I have met with only partial success. Below I will list the steps that I have taken to overcome this virus to the best of my recollection. If you are reading this hoping to get rid of it, know that steps 1 through 16 did absolutely nothing to slow it down. Fill free to skip ahead.

1)I closed out the Personal Guard window, the false attack window and the fake windows security center window, and opened the task manager (ctr alt del) went to the “processes” tab and right clicked on the process with the image name “Personal Guard 2009” and hit “end process tree” then hit ok.

2)I opened control panel and ran the “Add or Remove Programs” utility. Sure enough, “Personal Guard 2009” was listed. I uninstalled it. In less than four minutes, the program had reconstituted and reinstalled itself and was doing all of the things described above all over again.

3)I manually deleted the directory C:\Program Files\Personal Guard 2009. In less than four minutes, the program had reconstituted and reinstalled itself and was doing all of the things described above all over again.

4)I opened the directory C:\Program Files\Personal Guard 2009 and ran the uninstall utility contained therein (C:\Program Files\Personal Guard 2009\uninstall). In less than four minutes, the program had reconstituted and reinstalled itself and was doing all of the things described above all over again.

5)I downloaded a secure delete program known as “Free Eraser” that deletes information by rewriting gibberish over it several times instead of just altering the file allocation table. I tossed the C:\Program Files\Personal Guard 2009 directory into it and set it to the maximum destruction setting. In less than four minutes, the program had reconstituted and reinstalled itself and was doing all of the things described above all over again.

6)I ran a full scan with my McAfee antivirus software (which I have the full version of). It found some stuff (I don’t really remember what all) and I hit fix all issues. Then I ran the personal guard directory through free eraser again. In less than four minutes, the program had reconstituted and reinstalled itself and was doing all of the things described above all over again.

7)I tried to use the cmd prompt as per this YouTube video:

But it would not let me rename the questionable file because it was locked due to being “in use.”

8)I downloaded and ran “Trojan Remover” to no effect.

9)I downloaded and ran “Malware Bytes” to no effect.

10)I downloaded and ran “Multi-Virus Cleaner 2009” to no effect.

11)I downloaded and ran “CCleaner” to no effect.

12)I called Alienware Tech Support, and they (the guy’s name was Sebastian; hard to forget) advised me to either try Spybot Search and Destroy or wipe the HDD and start over.

13)I downloaded and ran “Spybot Search and Destroy” to no effect.

14)I downloaded “Hijack This” in order to make a process log. I tried to start the system in Safe Mode but for some reason the system failed to boot in safe mode and I instead had to boot in “registry editing safemode”

15)Once I finally got it into safemode I reran all of the antivirus software mentioned heretofore plus made this log:



Logfile of HijackThis v1.99.1

Scan saved at 6:44:30 PM, on 9/8/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\common files\mcafee\mna\mcnasvc.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\AlienAutopsy\TEKS_Service.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\WINDOWS\Explorer.EXE

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Codyssey\Freeraser\Freeraser.exe

C:\Program Files\HijackThis\HijackThis.exe



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [FunctionKeyCtrl] C:\Program Files\Function Key Controller\FKC.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [CTAPR2] "C:\Program Files\Creative\Sound Blaster X-Fi\Console Launcher\CTAPR2.exe" /r

O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\RunOnce: [SpybotDeletingA6231] command.com /c del "C:\WINDOWS\SchedLgU.Txt"

O4 - HKLM\..\RunOnce: [SpybotDeletingC2435] cmd.exe /c del "C:\WINDOWS\SchedLgU.Txt"

O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\RunOnce: [SpybotDeletingB4398] command.com /c del "C:\WINDOWS\SchedLgU.Txt"

O4 - HKCU\..\RunOnce: [SpybotDeletingD9491] cmd.exe /c del "C:\WINDOWS\SchedLgU.Txt"

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O4 - Global Startup: Bluetooth.lnk = ?

O4 - Global Startup: EndWLAN.cmd

O4 - Global Startup: OSCust.lnk.disabled

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: OSDriver - {44433B5D-42EA-44F3-B04F-222A00EC1637} - C:\Documents and Settings\All Users\Microsoft Private Data\Microsoft\Media Index\Drivers\lan.dll

O21 - SSODL: SystemLoading - {82CCCA9A-BA12-4A3D-9D90-30920EB05F53} - C:\Documents and Settings\All Users\Microsoft Private Data\Microsoft\Media Index\Drivers\nhbferdtqo.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: ProductivIT Service (ProductivITService) - DynTek, Inc. - C:\Program Files\AlienAutopsy\TEKS_Service.exe

O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe





16)While in safemode, the virus seemed to be dormant, and I was eventually was able to run every scan with a “no harmful software detected” clean bill of health. I re-deleted the personal guard 2009 directory and restarted windows normally but the virus was back as soon as windows booted up.

17)At around noon today (Sep 9) I downloaded a program called “Killbox” available here: http://www.bleepingcomputer.com/files/killbox.php I ran this program and aimed it at C:\Program Files\Personal Guard 2009\personalguard.exe and told it to: Replace on reboot; use dummy; end explorer shell while killing file; All files. I rebooted the system and when it came back up, the virus made a short-lived appearance but then ceased.

18)Now, all I get is this error message every now and then:

http://picasaweb.google.com/aaron.leblanc1/PersonalGuard2009#5379181274912022946

All I can figure is that since I sabotaged the virus with this kill box program, it is attempting to run itself but can’t, and so I get this error message. Anyone that can offer further assistance is most welcome. Please keep in mind that my computer literacy is somewhat limited, and I would appreciate any instruction broken down Barney-style.

Thanks,
Aaron

 

[Madxgraphics]

Hi Aaron.............

Welcome to the forum.........

Can I suggest you post your HJT Report over at Bleepingcomputers.com as they have people over there that are dedicated to reading HJT reports and would be more able to help you.

 

[aaron3579]

Thanks so much. I will repost there. I'd actually like to post this a many places as possible so it might keep someone from going through the 18-hour battle that I went through. Killbox really seems to have helped this problem; my PC is *almost* back to normal.

But just knowing that the virus is still knocking on the door motivates me to find a way to eradicate it completely.

Again, thanks!

 

[Madxgraphics]

Thanks so much. I will repost there. I'd actually like to post this a many places as possible so it might keep someone from going through the 18-hour battle that I went through. Killbox really seems to have helped this problem; my PC is *almost* back to normal.

But just knowing that the virus is still knocking on the door motivates me to find a way to eradicate it completely.

Again, thanks!

Thanks for the heads up on this virus. In my opinion though I would try save what data I could and then reformat.

 

[aaron3579]

That might be my only option; it seems that killbox didn't have a lasting effect after all. After about an hour, the sucker is back. I am at square one again

 

[davek10001]

I tried the following and after reboot, I see that it tried to drop the desktop icon, only it didn't have an .exe to point to. Also the Personal Guard 2009 directory is now gone.

Malwarebytes was loaded previously with updated dat files.

1. (logged in as an admin user) Opened up command prompt and loaded the MMC and loaded the local group policy snap in. Added both wcenter.exe and personalguard2009.exe to the list of programs that are not allowed to run in windows. Rebooted. This did not stop it from running for some reason. I had success in the past for other malware programs, but this didn't stop it from opening.

2. Created a non-admin local account. Logged in. Both wcenter and personalguard ran, but there were some errors that these apps reported. also, I could not close the programs from their screens, I had to close them via task manager.

3. 'Run-as' admin user malwarebytes. Did a full system scan. During the scan it detected multiple instances of this malware. Also during the scan it kept trying to launch itself. I kept using taskmanager to stop the processes.

4. Once completed, I made sure all process were stopped and began the removal of all malware that it detected. Rebooted. Logged back in as the non-admin user and it did drop an icon to the desktop, but it is pointing to the program files\personal guard 2009 directory that no longer exists.

It has only been about a half hour, so I am hoping that I dont run into the same issue where it pops back up again after an hour or so. Also, I have not logged in as a local administrator yet (I want to see if it restores itself after a certain time period first).

I will post more after a few hours.

Dave

 

[davek10001]

Well, as a non-admin user, it seemed to hold it off, but remnants were still there. I finally logged in as the end user who is an admin and it restored itself again. With the time it takes to try to figure this out, I think I will just reimage this machine.

 

[aaron3579]

Yep, I'm afraid that after 3 days of fighting it, I opened the nuclear football (restore disk). I regret losing the programs that I bought for cheap off of the Iraqis while I was on deployment (it was over a grand in software). But that thing just wouldn't quit.

I think it's odd that there are a slew of sites on the web that claim to have the answer to this new bug because as far as I know, no real person that has had their PC attacked by it have been able to shake it without wiping the HD.

 

[Madxgraphics]

Yep, I'm afraid that after 3 days of fighting it, I opened the nuclear football (restore disk). I regret losing the programs that I bought for cheap off of the Iraqis while I was on deployment (it was over a grand in software). But that thing just wouldn't quit.

I think it's odd that there are a slew of sites on the web that claim to have the answer to this new bug because as far as I know, no real person that has had their PC attacked by it have been able to shake it without wiping the HD.

Sorry to say this, but using a restore disk might not even get rid of the virus. Some can remain even after reformatting.
Did you post an HJT over at Bleeping computers..? Did they respond..?
If you are worriewd about the programs you have, you could use a Linux Live CD to extract them and then reformat your hard drive.

Yes it is sad that there are a lot of sites out there that proclaim to be able to remove things but don't...

 

[aaron3579]

Yes, I did post the hjt, but nobody responded :-( that's part of the reason that I went ahead and reformated. The good news is that so far so good with the f-disk.

 

[JustHereToHelpAndSeekHelp]

Get Rid of Personal Guard 2009 without it coming back to life!

Create an Ultimate Boot CD http://www.ubcd4win.com/ and boot the machine from it. It will boot into a windows shell that will allow you to access the files on the hard drive and update the registry unfettered.

-Delete the following folders and all of their subfolders and files:
%UserProfile%\Start Menu\Programs\Personal Guard 2009
c:\Program Files\Personal Guard 2009
c:\Documents and Settings\All Users\Microsoft Private Data - THIS IS THE KEY TO ITS ABILITY TO RESTORE ITSELF.

-Delete the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Personal Guard 2009
HKEY_LOCAL_MACHINE\SOFTWARE\Personal Guard 2009
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "personalguard"