Related to the well-known fake antivirus application known as Paladin Antivirus, Dr. Guard uses the same methods as its relative to trick users in to purchasing its license. Dr. Guard reaches a user’s system via Trojan viruses that get downloaded from websites promoting fake virus scanners and along with fake video codec packs, as well as other malicious software. Once installed, Dr. Guard disables any legitimate security software that may be installed on the system and then proceeds to perform endless fake scans on the computer, reporting that the user’s system is dangerously infected with viruses and other malware. It also generates fake warning pop-ups from the Windows taskbar. The aim of all this activity is to try and induce the user into paying for a software license to the ‘full’ version of Dr. Guard, as it claims that the currently installed ‘trial’ version is incapable of properly cleaning out the detected ‘threats’. However, Dr. Guard is a fake application and therefore none of its versions can clean your computer no matter how much you pay for it.
As soon as you find a copy of this malicious program on your system, you should take steps to immediately delete Dr. Guard. For Dr. Guard removal, it is necessary to stop processes, unregister DLLs, delete files and folders and remove registry entries.
File Removal Procedures
The first step you need to take in order to delete Dr. Guard is to stop the following processes:
- drguard.exe
- uninstall.exe
- asr64_ldm.exe
The next step is to unregister the following DLL files:
- drgext.dll
- drghook.dll
Finally, to complete file removal, delete the following files and folders:
- c:\Documents and Settings\[User]\Desktop\Dr. Guard Support.lnk
- c:\Documents and Settings\[User]\Desktop\Dr. Guard.lnk
- c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard
- c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\About.lnk
- c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Activate.lnk
- c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Buy.lnk
- c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Dr. Guard Support.lnk
- c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Dr. Guard.lnk
- c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Scan.lnk
- c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Settings.lnk
- c:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Update.lnk
- c:\Documents and Settings\[User]\Application Data\Microsoft\Internet Explorer\Quick Launch\Dr. Guard.lnk
- c:\Program Files\Dr. Guard
- c:\Program Files\Dr. Guard\about.ico
- c:\Program Files\Dr. Guard\activate.ico
- c:\Program Files\Dr. Guard\buy.ico
- c:\Program Files\Dr. Guard\drg.db
- c:\Program Files\Dr. Guard\drgext.dll
- c:\Program Files\Dr. Guard\drghook.dll
- c:\Program Files\Dr. Guard\drguard.exe
- c:\Program Files\Dr. Guard\help.ico
- c:\Program Files\Dr. Guard\scan.ico
- c:\Program Files\Dr. Guard\settings.ico
- c:\Program Files\Dr. Guard\splash.mp3
- c:\Program Files\Dr. Guard\uninstall.exe
- c:\Program Files\Dr. Guard\update.ico
- c:\Program Files\Dr. Guard\virus.mp3
- %Temp%\asr64_ldm.exe
Once all these steps have been completed, Dr. Guard no longer resides on your hard disk. However, in order to make sure that the additional malware that has initially helped during the installation of Dr. Guard on your PC does not come back to its original functionality it is recommended to scan all files and folders using genuine antivirus software such as Spyware Doctor with Antivirus.
Registry Removal Procedures
Removing files and folders is not enough to ensure complete Dr. Guard removal. To completely delete Dr. Guard, you need to delete the following keys and settings from the Windows Registry:
- HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\SimpleShlExt
- HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
- HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt
- HKEY_LOCAL_MACHINE\SOFTWARE\Dr. Guard
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Dr. Guard
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr”
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Dr. Guard”
- HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved “{5E2121EE-0300-11D4-8D3B-444553540000}”
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = “1″
Now it is safe to say that Dr. Guard has been completely removed from your system. Even if this is true in most cases, scanning the entire PC using legitimate antivirus software such as Spyware Doctor with Antivirus may proof to be a wise decision considering the fact that fake security software such as Dr. Guard has features specifically designed to preserve their presence on an infected system.
Conclusion
It is not recommended for inexperienced users to attempt to delete Dr. Guard, as any mistake on your part could cause damage to the operating system. Therefore inexperienced users are advised to use an online repair service such as www.onlinecomputerrepair.org or legitimate antivirus software to completely and safely delete Dr. Guard.