Remove Dr. Guard
Dr. Guard is a rogue program that presents itself as an anti-spyware system for your computer. By removing other working security programs from your computer, Dr. Guard is able to secure a place in your computer to run fake scans and alert you about false threats. The program initially comes in through Trojans and begins asking you to pay for a full version to delete the fake attacks on your computer. Instead of doing this, take the time to download a real anit-spyware system that actually works. If you feel that you are computer savvy enough to manually remove the program without deleting the wrong registry files (thereby hurting the integrity of your computer), follow the guide below.
Automatic Dr. Guard removal:
Dr. Guard Remover
Warning! If the automatic remover is blocked by the spyware, then boot into Windows Safe Mode and try again. Learn how to boot into Safe Mode here.
Manual Dr. Guard removal:
Kill processes: asr64_ldm.exe, drguard.exe, uninstall.exe
(Learn how to kill processes)
Unregister DLLs:
C:\Program Files\drgext.dll
C:\Program Files\drghook.dll
(Learn how to unregister DLLs)
Delete registry keys:
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\SimpleShlExt
HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\SimpleShlExt
HKEY_LOCAL_MACHINE\SOFTWARE\Dr. Guard
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Dr. Guard
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Dr. Guard"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5E2121EE-0300-11D4-8D3B-444553540000}"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = "1"
HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
(Learn how to delete registry keys)
Delete files:
%Temp%\asr64_ldm.exe
C:\Documents and Settings\[User]\Application Data\Microsoft\Internet Explorer\Quick Launch\Dr. Guard.lnk
C:\Documents and Settings\[User]\Desktop\Dr. Guard Support.lnk
C:\Documents and Settings\[User]\Desktop\Dr. Guard.lnk
C:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard
C:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\About.lnk
C:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Activate.lnk
C:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Buy.lnk
C:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Dr. Guard Support.lnk
C:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Dr. Guard.lnk
C:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Scan.lnk
C:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Settings.lnk
C:\Documents and Settings\[User]\Start Menu\Programs\Dr. Guard\Update.lnk
C:\Program Files\Dr. Guard\about.ico
C:\Program Files\Dr. Guard\activate.ico
C:\Program Files\Dr. Guard\buy.ico
C:\Program Files\Dr. Guard\drg.db
C:\Program Files\Dr. Guard\drgext.dll
C:\Program Files\Dr. Guard\drghook.dll
C:\Program Files\Dr. Guard\drguard.exe
C:\Program Files\Dr. Guard\help.ico
C:\Program Files\Dr. Guard\scan.ico
C:\Program Files\Dr. Guard\settings.ico
C:\Program Files\Dr. Guard\splash.mp3
C:\Program Files\Dr. Guard\uninstall.exe
C:\Program Files\Dr. Guard\update.ico
C:\Program Files\Dr. Guard\virus.mp3
(Learn how to delete files)
Delete folders:
C:\Program Files\Dr. Guard
Once you have removed Dr. Guard from your computer using either the automatic or manual method, make sure to block it and other malicious software using a HOSTS file. Please note that with the auomatic method, your computer should be protected from future spyware threats since you now have a spyware blocker program installed. We recommend downloading the HOSTS file from here, which contains a complete, up-to-date list of malicious websites especially if you used the manual method.
If this article has helped you, please take this time to share it with Digg using the Digg button (see Digg share button to the left) or retweet it using Twitter (see retweet button to the left). You may also want to follow us on Twitter to keep up-to-date with the latest spyware prevention tips and spyware threats. If you'd rather follow us from your Facebook account, please join our Facebook fan page.
I ran into a program called security guard that is doing the same thing. My kid allowed it access to her laptop and it got rid of Mcaffee and is causing fake alerts. It takes you to their website and want’s you to purchase their product. It has infected the “msconfig” file and all other files and is very hard to get rid of. I tried your free version but it won’t allow any executable programs to be run.