WiniGuard Description

WiniGuard is a fake anti-spyware program that is related to the same family of rogues such as Softsafeness. WiniGuard uses many misleading methods to cohort computer users into purchasing a full version of the WiniGuard application. WiniGuard is unable to detect or remove spyware. WiniGuard can be difficult to manually detect and remove in some cases.

Type: Rogue AntiSpyware Programs

Automatic Detection of WiniGuard

WiniGuard Technical Report

As new WiniGuard details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following WiniGuard files with its MD5s were created in the system:

WiniGuard has typically the following processes in memory:

• %PROGRAM_FILES%\Innovagest 2000 SL\WiniGuard\WiniGuard.exe
• c:\Program Files\WiniGuard\msvcp71.dll
• logaes.dll
• baloon.exe
• %PROGRAM_FILES%\Innovagest 2000 SL\WiniGuard\logaes.dll
• c:\Program Files\WiniGuard\uninst.exe
• %UserProfile%\My Documents\WiniGuard\SDBHO.dll
• cfrog.exe
• %SYSTEMROOT%\system32\baloon.exe
• winiguard_installer[1].exe
• c:\Program Files\WiniGuard\WiniGuard.exe
• c:\Program Files\WiniGuard\msvcr71.dll
• WiniGuard.exe
• %SYSTEMROOT%\system32\cfrog.exe

WiniGuard created the following directories, files, paths:

• %ProgramFiles%\Innovagest 2000 SL\WiniGuard
• %AllUsersProfile%\Start Menu\Programs\WiniGuard

WiniGuard creates the following registry entries:

• WiniGuard
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “WiniGuard”

Important Article Disclaimer