PS Guard . . . . again

Ok I am running windows xp home sp1
ad aware
spybot S&D
AVG

I had previously been infected with this PS Guard crap and was able to sucsessfully kill it with spybot s&d. This time however when i do a scan with it and then tell it to fix(delete) the found problems i get told it couldn't kill 2 items because they are currently being used in the memory. It then asks if i want to run spybot after my next comp restart to delete ps guard before it loads. Now this all happened last time and when i re-booted last time spybot started before anything loaded, all i could see was my background there was no taskbar or desktop icons, and then finished killin ps guard. This time however when i reboot spybot does not start while windows is loading and therefore doesn't finish cleaning out ps guard. Does anyone know of a program specifically written for killing ps guard or a way to make spybot do what its supposed to do?

First off, you have to boot into safe mode - then run the adware cleaner. Checkout [insert fav AV software name] web site for manual removal instructions or tools.

My favorite is http://housecall.trendmicro.com/

You can try this tool prior to booting into safe mode and mannualy removing.

Hmm. i didn't know i had to boot into safe mode to get rid of this. is it possible then that the last time i had this, about a month ago, i didn't really get rid ofd it since i didn't scan/clean in safemode? And regarding safe mode its been way too long since i have booted to it let me just make sure i still remember what to do. i run msconfig right?

double post

reboot the PC and hit F8 before the XP logo appears

Restart your PC. When you see "starting windows" press F8 and choose safe mode from the command list.

Yay i was hoping someone would suggest that . . . well. . . . it doesn't do anything on my computer! When booting the only options i have prior to the xp logo appears is to hit f1 to enter bios options or hit f10 to enter system restore.

OK after the F1 - F10 option disapears from your screen - start pressing F8.

You probably have "quick boot" type options enabled in your BIOS

Well i never thought of hitting it after that initial "hit f1 for this f10 for this" page. When i get off of work, GAAAAH another 6 hours in this hell hole, i will try it and let you all know how it goes.

Also, i remember hearing, wether or not its true, that just pressing and holding f8 wont work, but i need to do a steady "tapping" of the f8 key. is this true or will just pressing it once and either holding it down or not holding work.

Holding down any key while booting any x86 hardware will cause issues. you can continually press F8 but if you hear a beep when pressing, stop.

will do. again thanx for all the preliminary help with my issue, and hopefully this will allow me to remove this crap so i dont have to come back for more help. Well at least for this issue, i love coming to this site for help and news

ANTIONLINE KICKS ASS!!!!

Hey dinowuff

Quote:

---

Holding down any key while booting any x86 hardware will cause issues

---

You forgot Windows Millenium Edition (who wouldn't want to?)...................holding down upper shift takes you straight into safe mode ;)

Jewishintent

http://www.ewido.net/en/
http://www.emisoft.com/en/software/free/

Download, update, reboot into safe mode, then run them.

:)

Ok i finally got around to trying to fix the comp and heres my current issues.
first off www.emisoft.com/en/software/free doesnt work and emisoft.com is some enviromental information systems site.

So here are the steps i took. Updated spybot and ad aware. downloaded ewido and updated it. booted into safe mode and ran ewido. 1755 infected objects found. cleaned/fixed/deleted them all. ran the other spybot which fixed maybe 7 things and ad aware found maybe 11 and fixed them. When i went back and booted my computer normally i immediatly got 3 prompts from ewido during windows loading stating i had a virus that the program needed to deal with and on all 3 prompts i told it to clean the problem. I still have PS Guard installing itself on my computer.

Another issue im runnin into, and im not sure wether or not this is caused by PS Guard or some other problem, is my isp is sbc-yahoo dsl and it comes with its on yahoo browser. Well about ever 5-10 min or so something tries to open my yahoo browser. It only brings me to the log in page, and i know better than to log in, but this is a problem when i am trying to play final fantasy online since they wrote it to crash if you minimize the game.

Any ideas?

Sorry about that, it was a typo.................the link should have been:

http://www.emsisoft.com/en/software/free/

The product is called A-Squared :)

Please remember to run "Housecall" as suggested by Dinowuff ;)

Quote:

---

Another issue im runnin into, and im not sure wether or not this is caused by PS Guard or some other problem, is my isp is sbc-yahoo dsl and it comes with its on yahoo browser. Well about ever 5-10 min or so something tries to open my yahoo browser. It only brings me to the log in page, and i know better than to log in, but this is a problem when i am trying to play final fantasy online since they wrote it to crash if you minimize the game.

---

Sounds like you have some BHO's (Browser Helper Objects) which you may or may not have put on your browser.

Read this bit of info and it may help and also point you in the right direction for resolving this issue.How_Did_I_Get_infected

Then submit your HJT log to any of these forums:
http://www.geekstogo.com/forum/index.php
http://forum.iamnotageek.com/index.php (has an Auto Analyzer)
http://forums.tomcoyote.org/index.php?
http://forum.aumha.org/viewforum.php?f=30

Sometimes the pests get saved to your Restore Points and each time you reboot, it gets reactivated, so before you do a thorough cleaning, you might want to disable system restore and when you are cleaned , set a manual restore point.

Something else to consider is download the WinXP SP2, as well as some of the latest patches as they are geared to malicious behaviour detections. ;)

Double post so the link works:

http://elamb.blogharbor.com/hacked/psguardremoval.htm

Full instructions and the tools to get rid of PS Guard :)

I will definatly try that but something else has gotten my attention while i was browsing other forums trying to fix the ps guard problem, and that is the silent dialer associated with it. Here is some info i found which unfortunatly does me little to no good since i really still don't know any of the tech lingo i o so admire.

. . . it's designed to fool you by showing a
believable spyware scan in which you are actually seeing your own files and
directory structures being collected in front of you, after completed it's
designed to make your system appear abused then it installs multiple trojans,
viruses, keyloggers, you name it and updates itself. After awhile it's
designed to make hundreds of international 1-900 calls then destroy your
machine when finished to make it harder to track back. . .

this quote was found here
http://www.msusenet.com/archive/topi...870990307.html
just more people trying to get rid of this spawn of satan

Hi,

I am really sorry about the typo in that second link. A-Squared is a specialist trojan and dialler killer which is why I suggested it. The new link I posted is OK because I copied it from the site itself :)

Good luck pal ;)

Found this:

Quote:

---

You have or have had a smitfraud infection on the computer. Download this removal toolhttp://noahdfear.geekstogo.com/smitRem.exe to you desktop but don't run it yet. Then boot the computer into Safe Mode then open the SmitRem folder and double click the RunThis.bat file.Your desktop and icons will disappear and then reappear again --- this is normal. Wait for the tool to complete and Disk Cleanup to finish --- this may take a while; please be patient. Then reboot into normal mode.

---

Over at http://www.computing.net/security/ww...rum/16513.html without seeing a HJT log I would assume that this exe is part of the PSguard Trojan and is probably on your PC. :(

Well something else i guess i should tell you guys that i really didn't want to have to is that my currently running copy of windows isn't 100% normal. Now i know that you are not allowed to help fix pirated software or help make it work but my windows is not pirated. What happened was a while back i got a virus i didn't know about for quite some time. My computer didn't come with the windows install cds, instead i got that restore partition and the ability to make recovery cds one time only. Well unfortunatly when i got around to making said recovery cds, took 7 normal cds or 2 burnable dvds, i accidently burned the virus to those making them pretty much obsolete. So long story short i didn't find out about the bad cd's until i took my pc to a friends house to fix some other virus crap and when he asked me to bring over the recovery cd's i made he scanned them first, thankfully, and informed of the problem with them. Now here is where my windows being not 100% normal comes in. I'm not sure exactly what he did to get windows reinstalled, he ended up formating and partitioning my hdd, but basicalyl its some sort of frankenwindows installed using the ok portions of my cds along with the corrupt portions being taken from his cd's. Because of this i can not authenticate my windows version and therefore am unable to currently update to sp2 or dl any security updates. I am currently working with one of our it guys at work in trying to get ms to authenticate my windows so i can update it but it looks like hes going to have to write something that will just end up fooling ms into thinking i am still using the fully original copy of my windows.

man that was long winded

ok more stuff i found over at www.msusenet.com is this. It seems to me that they found a way to get rid of the embedded reg key but again the technical talk really makes no sense to me. can any of you guys decipher this and let me know what it is, and could it help me?
the lines starting with > signifies a quote from the previous post

The big issue is I did an OS repair using the Windows Server
> 2003 SP1 installation CD and the entry is still there.

Ya, the "repair" concentrates on OS registry areas for the most
part.

> I don't trust the installation either but have no choice for
> about 5 months.
>
> I think in a previous post you made for sysinternals there was
> something about a C++ registry sample which created and removed
> such keys, can't find the sample do you know where it is?

Ah, if you are a C programmer and can use Native NT APIs then the
information you need is likely to be in the REGHIDE demo.

http://www.sysinternals.com/Informat....html#HiddenKe
ys

reghide.zip 24,749

C:\TEMP>unzip -l reghide.zip
Archive: reghide.zip
Length Date Time Name
-------- ---- ---- ----
38912 98-05-17 22:25 REGHIDE.MDP
5160 98-05-17 22:25 REGHIDE.C
115712 98-05-17 22:25 REGHIDE.NCB
6669 98-05-17 22:25 REGHIDE.MAK
0 98-05-17 22:24 RELEASE/
1691 98-05-17 12:36 REGHIDE.H
4749 98-05-17 22:25 RELEASE/REGHIDE.OBJ
26624 98-05-17 22:25 RELEASE/REGHIDE.EXE
-------- -------
199517 8 files

If that leads you to write a utility... <G>
It's beyond my knowledge and skills but such a little tool could be
useful (and dangerous of course). Hope that gets you somewhere!

--------------------------------------------------------------------------------

Knight Technologies08-19-2005, 04:36 AM
That's just what I needed thank you very much, it's been awhile since I've
messed with C but within a few seconds of analyzing those simple code
snippets I was able to immediately adopt the method to effectively remove
that entry for good.

It appears the method used was the same method as shown in the source code
so using the final step in the removal process came in handy as it's the same
signature, so what I did in simpler terms was changed the existing keys to
match to re-create the effect, the routine already automatically disables
upon clicking OK, thus, it removed the foul registry entry for me, then I did
some minor tidying up in RegEdit to remove the remaining structure.

In simple terms I kicked it's ass.

Thanks again!!!

Also i know that since im posting from work there is really not much to do besides talk about my problem but as soon as i get home today i will be implimenting everything we have talked about and/or decided on and will be finishing coresponding from home to make the fixing process much faster.

Quote:

---

Originally posted here by nihil
Double post so the link works:

http://elamb.blogharbor.com/hacked/psguardremoval.htm

Full instructions and the tools to get rid of PS Guard :)

---

Just a FYI...

You can edit a post and still have it link the urls. For some reason, after your initial submit, it removes the check from " Automatically parse URLs: automatically adds and around internet addresses. " The first option below the reply box. Simply check it off and your link will work right.