How to Remove Additional Guard | Additional Guard Removal Guide
Additional Guard is a rogue antivirus application and like many of these it can either be installed with or without the users permission. Even without a person actually wanting it, but simply visiting the wrong web page users may find this program on their system. Once on their system this software will popup many ads and warnings. It will claim that your computer is infected with many viruses and has many problems that only it can fix and of course, it CAN’T fix them unless you pay. It’s really a scam that will cost you money and not solve any problems. Read on for how to remove additional guard.
You may wish to start with the control panel and attempt to uninstall additional guard via the control panels add/remove programs applet. This may work and if it does that is almost as easy as rogue antivirus removals get. You still would want to scan your system with a tool such as malwarebytes antimalware and run a virus scan with a trusted antivirus product.
Among the warnings you may see from this rogue are the following:
System alert!
Suspicious software which may be malicious has been
detected on your PC. Click here to remove this threat
immediately using Additional Guard.
System message
Your PC may still infected with dangerous viruses.
Additional Guard protection is needed to prevent data loss
and avoid theft of your personal data and credit card details.
Click here to activate protection.
Warning! Virus Detected
Threat detected: Trojan-PSW.Win32.Dripper
Additional Guard also creates the following files to later claim they have viruses:
%user%\Recent\ANTIGEN.drv
%user%\Recent\ANTIGEN.tmp
%user%\Recent\cid.dll
%user%\Recent\CLSV.tmp
%user%\Recent\ddv.dll
%user%\Recent\eb.drv
%user%\Recent\eb.exe
%user%\Recent\energy.dll
%user%\Recent\energy.sys
%user%\Recent\exec.exe
%user%\Recent\exec.tmp
%user%\Recent\fan.drv
%user%\Recent\FS.drv
%user%\Recent\FS.exe
%user%\Recent\kernel32.drv
%user%\Recent\PE.sys
%user%\Recent\ppal.exe
The next thing you can try to remove additional guard is to start an attempt at an automated removal with malwarebytes antimalware. You can find a download link for it on the virus removal toolkit page. While you’re there you may also want to download process explorer as you may need it a bit later in the removal.
If you are unable to install malwarebytes antimalware you may try the following things: 1) rename the installer from mbam-setup.exe to something like firefox.exe then retry your installation/update and run a scan 2) restart into safe mode with networking and retry the install/update and scan. 3) Continue with the next step of a manual removal of additional guard and then retry the install, update and scan after that is finished.
The following processes are associated with additional guard and should be killed off using the task manager. If you are unable to launch task manager you may try the following. 1) First copy the taskmgr.exe executable file, copy it to the desktop and then rename the file to something else like iexplore.exe and retry launching it. 2) reboot to safe mode and see if the processes below are running. 3) Use process explorer instead to kill off the following processes:
WIf9a.exe
The following files and folders should be deleted to fully remove additional guard:
%docs\All Users\Application Data\WINAGSys
%docs%\All Users\Application Data\17c1f\WIf9a.exe
%docs%\All Users\Application Data\WINAGSys\winag.cfg
%user%\Application Data\Additional Guard
%user%\Application Data\Additional Guard\Instructions.ini
%user%\Desktop\Additional Guard.lnk
%user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Additional Guard.lnk
%user%\Start Menu\Additional Guard.lnk
%user%\Start Menu\Programs\Additional Guard.lnk
Even after you have completed your deletion of the above files you have completed the first part of the manual removal of additional guard. You should still install, update and run a scan with malwarebytes antimalware and a trusted antivirus application to make sure that your system is clean.