Removal Instructions for XL Guarder
Title: XL Guarder
Also Known as: XLGuarder
Severity scale:
XL Guarder is a rogue security application that will harass the infected user with fake security warnings, pop-ups, and fake system scans that yield fraudulent results. It will constantly try to convince the user to buy the program so that it can remove the fake threats that it claims to have found.
XL Guarder can be manually downloaded or it can infect a computer through Trojan horses. Though this program claims to be benevolent, its actions are nothing short of malevolent. On top of trying to scam the user, it will hinder Internet performance as well as the computer’s performance in general.
AKA:
XLife Guarder
XLG Security Center
XL Guarder file contents:
spacer.gif
alertpage.jpg
warningpage.html
warning
uninstall.exe
winsystip.exe
sysutil_s.exe
sysutil.exe
Uninstall XLG.lnk
iebho.dll
If this rogue has infected your computer, you should remove it as soon as possible. To do this manually, you should kill the following process:
XL Guarder
Then you should delete the following registry values:
HKEY_CLASSES_ROOT\CLSID\{D032570A-5F63-4812-A094-87D007C23012}
HKEY_CLASSES_ROOT\iebho.TIEAdvBHO
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = C:\WINDOWS\sysutils\sysutil.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sysutils
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D032570A-5F63-4812-A094-87D007C23012}
HKEY_CURRENT_USER\Software\sysutils
You should then delete the following DLL and reboot your system:
%WINDIR%\iebho.dll
Finally, you should delete these files:
%WINDIR%\sysutils\warning\spacer.gif
%WINDIR%\sysutils\warning\alertpage.jpg
%WINDIR%\sysutils\warning\warningpage.html
%WINDIR%\sysutils\warning
%WINDIR%\sysutils\uninstall.exe
%WINDIR%\sysutils\winsystip.exe
%WINDIR%\sysutils\sysutil_s.exe
%WINDIR%\sysutils\sysutil.exe
%WINDIR%\sysutils\sounds\03.wav
%WINDIR%\sysutils\sounds\02.wav
%WINDIR%\sysutils\sounds\01.wav
%WINDIR%\sysutils\sounds
%WINDIR%\sysutils\settings.ini
%WINDIR%\sysutils
%WINDIR%\iebho.dll
%UserProfile%\Start Menu\Programs\Protection
%UserProfile%\Start Menu\Programs\Protection\Uninstall XLG.lnk
This will effectively get rid of XL Guarder, but it will not get rid of any other malicious software that may be infecting your computer. If you really want your computer free of malware, then you should use SpyZooka. SpyZooka is the only legitimate antispyware that is guaranteed to remove 100% of spyware, and it has been approved by the Better Business Bureau. So, if you want complete protection from spyware and other malware, you want SpyZooka.a
