Additional Guard Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCart

Additional Guard is a rogue anti-spyware program. Additional Guard is known as a deceiving application in the way that it is able to display misleading parasite threat notifications. In addition to the popup messages that Additional Guard fabricates, it attempts to scan the system that it is installed on only to return fake parasite results.

Additional Guard uses these extortion tactics to get you to ultimately purchase the full version of Additional Guard which is incapable of detecting or removing computer parasites. It is imperative that Additional Guard be removed the instant that it is detected so that you may prevent further damage to your computer.

Type: Rogue AntiSpyware Programs

How Can You Detect Additional Guard?

Additional Guard Technical Report

As new Additional Guard details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Additional Guard files with its MD5s were created in the system:

Additional Guard has typically the following processes in memory:

• %UserProfile%\Application Data\2565da61\sqlite3.dll
• %UserProfile%\Recent\energy.dll
• %UserProfile%\Recent\FS.dll
• c:\Documents and Settings\All Users\Application Data\117fc\WI339.exe
• %UserProfile%\Recent\cid.dll
• %UserProfile%\Recent\PE.sys
• %UserProfile%\Application Data\2565da61\mozcrt19.dll
• %UserProfile%\Recent\ddv.dll
• %UserProfile%\Recent\exec.exe
• %UserProfile%\Recent\tjd.sys
• c:\Documents and Settings\All Users\Application Data\117fc\sqlite3.dll
• %UserProfile%\Recent\FS.exe
• %UserProfile%\Application Data\2565da61\AG345d.exe
• %UserProfile%\Recent\cb.exe
• %UserProfile%\Recent\energy.sys
• %UserProfile%\Recent\ppal.exe
• c:\Documents and Settings\All Users\Application Data\117fc\mozcrt19.dll
• %UserProfile%\Recent\eb.exe

Additional Guard created the following directories, files, paths:

• %AppData%\Additional Guard

Additional Guard creates the following registry entries:

• HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://search-gala.com/?&uid=220&q={searchTerms}”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “Additional Guard”
• HKEY_CLASSES_ROOT\xp_7a9be.DocHostUIHandler
• HKEY_CLASSES_ROOT\Software\Microsoft\Internet Explorer\SearchScopes “URL” = “http://search-gala.com/?&uid=220&q={searchTerms}”
• HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” = “1?

Important Article Disclaimer