[Shenlux]

I tried to post a hjl and got sent to a page saying outdated version detected...? I tried to get a newer version but can't seem to find a download that works right now. If anyone has a current link I would appreciate it. My problem is NOT the malware itself. I think I took care of it. I had the hijacked browser and desktop telling me I had spyware and a little button in my quicklaunch toolbar that produced a spyware removal tool requiring registration. Some marketing strategy. At some point while I was trying to get rid of PCGuard th elittle button in the quicklaunch bar duplicated and I now have two. I have my desktop and browser back and everything seems to be clean except these buttons. They don't do anything anymore, just sit there staring at me. How can get rid of the buttons?
Thanks,
Shen

[Advertisements]

there is a link in the sticky in this forum, follow that and post a HijackThis log. Once you've done that I can assist you with completing removal of your parasite

[Avohir]

there is a link in the sticky in this forum, follow that and post a HijackThis log. Once you've done that I can assist you with completing removal of your parasite

[Shenlux]

Thanks. The HJT link worked this time. Don't think it's needed at the moment though. I went through the cleaning process one more time and the buttons and everything dissappeared. Let's see if I can remember what I did.....

I unchecked psgaurd.exe, intell32.exe, apigx.exe, winwb.exe and iedz.exe in task manager, rebooted to safe mode, did a search for each of the files on my computer and removed them. Then I rebooted and ran the latest version of Avast. This gave me back my desktop and browser and got rid of the "spyware removal" program but I had the two quicklaunch buttons for it. After a couple of restarts I found intell32.exe and psguard.exe back in the task manager but psguard seemed to be a ghost, no running program. I checked for suspicious run entries in the registry (yeah I know, not supposed to play with the registry) and ran the older version of hijackthis. I don't remember exactly what I found. Iwas very tired at that point. Sorry.

I tried it again; unchecked intell32.exe and PSguard.exe in task manager, deleted them in safe mode and ran Avast again. This time the buttons and everything have dissappeared. After a few restarts there is no sign of this thing on my PC anymore. Hope this helps somebody.

BTW I am still running Win98se. All the info I found on removing PSGuard elsewhere required the use of ewido which doesn't work on my system. This wasn't as hairy as some of things that pop up on people's computers unwanted, but it had quite a presentation and took a while to get rid of it.

[Avohir]

We actually have a targeted fix for smitfraud (and PSGuard is a variant of that) that is wonderfully effective in removing it. Unfortunately after the "do it yourself" repairs you've made, I'm not sure how effective it would be. However, since you appear to have resolved your issue I'll go ahead and close this topic.

[Avohir]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.