Search the Community

What is HomeGuard?The Malwarebytes research team has determined that HomeGuard is a potentially unwanted program that behaves like spyware.This application gathers information about the users' computer usage and their online behavior.How do I know if my computer is affected by HomeGuard?This is the main screen of the monitoring software:You may see these warnings during install:and these warnings during operations:How did HomeGuard get on my computer?Tracking applications use different methods for distributing themselves. This particular one was installed from their website:How do I remove HomeGuard?If you are the main user of the programs and you have the password you can uninstall the software from the main menu by clicking Uninstall.For all other users, our program Malwarebytes can detect and remove this potentially unwanted program. Please download Malwarebytes for Windows to your desktop. Double-click MBSetup.exe and follow the prompts to install the program. When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen. Click on the Get started button. Click Scan to start a Threat Scan. When the scan is finished click Quarantine to remove the found threats. Reboot the system if prompted to complete the removal process. Is there anything else I need to do to get rid of HomeGuard? No, Malwarebytes removes HomeGuard completely. How would the full version of Malwarebytes help protect me?We hope our application and this guide have helped you eradicate this potentially unwnated program.As you can see below the full version of Malwarebytes would have protected you against the HomeGuard trackware. It would have blocked the installer before it became too late. Technical details for expertsPossible signs in FRST logs: (Veridium Software) [File not signed] C:\Program Files\HomeGuard\HomeGuard.exe FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\nsis-pref.js [2020-04-29] R2 HG51 AMC; C:\Program Files\HomeGuard\vglset.exe [3838976 2020-04-29] () [File not signed] R2 HG52 AMC; C:\Program Files\HomeGuard\vglsetw.exe [4089856 2020-04-29] () [File not signed] R4 WinDivert1.1; C:\Program Files\HomeGuard\hg425-71.dat3 [38064 2020-04-29] (Nemea Mjukvaruutveckling AB -> Basil) C:\Program Files\HomeGuard C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HomeGuard () [File not signed] C:\Program Files\HomeGuard\vmap.dll HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HG51 AMC => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HG52 AMC => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HG51 AMC => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HG52 AMC => ""="Service" FirewallRules: [{276BB3CC-3EC7-4D1C-AC12-D5A22FEE90E8}] => (Allow) C:\Program Files\HomeGuard\vglsetw.exe () [File not signed] Significant changes made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Program Files\HomeGuard Adds the file 108"="4/29/2020 9:09 AM, 0 bytes, A Adds the file 2561.pem"="4/29/2020 9:08 AM, 215556 bytes, A Adds the file 2ekd.dat"="4/29/2020 9:08 AM, 1070 bytes, A Adds the file hg425-71.dat3"="4/29/2020 9:08 AM, 38064 bytes, A Adds the file HomeGuard.exe"="4/29/2020 9:08 AM, 18468864 bytes, A Adds the file main.log"="4/29/2020 9:09 AM, 90 bytes, A Adds the file main.stg"="4/29/2020 9:08 AM, 72704 bytes, A Adds the file snem.exe"="4/29/2020 9:08 AM, 2749952 bytes, A Adds the file vemd.exe"="4/29/2020 9:08 AM, 2478080 bytes, A Adds the file VGLSET.EXE"="4/29/2020 9:08 AM, 3838976 bytes, A Adds the file vglsetw.exe"="4/29/2020 9:08 AM, 4089856 bytes, A Adds the file vmap.dll"="4/29/2020 9:08 AM, 601600 bytes, A Adds the file vmapw.dll"="4/29/2020 9:08 AM, 142848 bytes, A Adds the folder C:\Program Files\HomeGuard\Cache Adds the file _cache0.dat"="4/29/2020 9:13 AM, 43008 bytes, A Adds the file _cache1.dat"="4/29/2020 9:09 AM, 2048 bytes, A Adds the file _cache2.dat"="4/29/2020 9:09 AM, 2048 bytes, A Adds the folder C:\Program Files\HomeGuard\Cache\E56 Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HomeGuard Adds the file HomeGuard.lnk"="4/29/2020 9:08 AM, 806 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{63D6B417-68A1-4692-9464-4B7A82621655}] "m"="REG_BINARY, ........ "t"="REG_BINARY, ........ [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F0D52062-4681-4314-9C46-536B975EDED1}] "p1"="REG_BINARY, ................................ "p2"="REG_BINARY, ................ [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HG51 AMC] "(Default)"="REG_SZ", "Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HG52 AMC] "(Default)"="REG_SZ", "Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HG51 AMC] "(Default)"="REG_SZ", "Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HG52 AMC] "(Default)"="REG_SZ", "Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HG51 AMC] "DelayedAutostart"="REG_DWORD", 0 "ErrorControl"="REG_DWORD", 1 "ImagePath"="REG_EXPAND_SZ, "C:\Program Files\HomeGuard\vglset.exe" "ObjectName"="REG_SZ", "LocalSystem" "Start"="REG_DWORD", 2 "Type"="REG_DWORD", 272 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HG52 AMC] "DelayedAutostart"="REG_DWORD", 0 "Description"="REG_SZ", "HG Service" "ErrorControl"="REG_DWORD", 1 "ImagePath"="REG_EXPAND_SZ, "C:\Program Files\HomeGuard\vglsetw.exe" "ObjectName"="REG_SZ", "LocalSystem" "Start"="REG_DWORD", 2 "Type"="REG_DWORD", 272 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDivert1.1] "DeleteFlag"="REG_DWORD", 1 "DisplayName"="REG_SZ", "WinDivert1.1" "ErrorControl"="REG_DWORD", 1 "ImagePath"="REG_EXPAND_SZ, "\??\C:\Program Files\HomeGuard\hg425-71.dat3" "Start"="REG_DWORD", 4 "Type"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDivert1.1\Enum] "0"="REG_SZ", "Root\LEGACY_WINDIVERT1.1\0000" "Count"="REG_DWORD", 1 "NextInstance"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDivert1.1\Parameters\Wdf] "TimeOfLastSqmLog"="REG_QWORD, .... "WdfMajorVersion"="REG_DWORD", 1 "WdfMinorVersion"="REG_DWORD", 9 Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 4/29/20 Scan Time: 9:24 AM Log File: 870b6e94-89ea-11ea-8ad2-00ffdcc6fdfc.json -Software Information- Version: 4.1.0.56 Components Version: 1.0.875 Update Package Version: 1.0.23132 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 233518 Threats Detected: 65 Threats Quarantined: 65 Time Elapsed: 7 min, 6 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 4 PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSET.EXE, Quarantined, 3089, 814694, , , , PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSETW.EXE, Quarantined, 3089, 814694, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\snem.exe, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vemd.exe, Quarantined, 3089, 814689, , , , Module: 35 PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSET.EXE, Quarantined, 3089, 814694, , , , PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSETW.EXE, Quarantined, 3089, 814694, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\snem.exe, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vemd.exe, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmapw.dll, Quarantined, 3089, 814689, , , , Registry Key: 3 PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HG51 AMC, Quarantined, 3089, 814694, 1.0.23132, , ame, PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HG52 AMC, Quarantined, 3089, 814694, 1.0.23132, , ame, PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WINDIVERT1.1, Quarantined, 3089, 814690, 1.0.23132, , ame, Registry Value: 3 PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HG51 AMC|IMAGEPATH, Quarantined, 3089, 814694, 1.0.23132, , ame, PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HG52 AMC|IMAGEPATH, Quarantined, 3089, 814694, 1.0.23132, , ame, PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WINDIVERT1.1|IMAGEPATH, Quarantined, 3089, 814690, 1.0.23132, , ame, Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 3 PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\Cache\E56, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\Cache, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD, Quarantined, 3089, 814689, 1.0.23132, , ame, File: 17 PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSET.EXE, Quarantined, 3089, 814694, , , , PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSETW.EXE, Quarantined, 3089, 814694, , , , PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\HG425-71.DAT3, Quarantined, 3089, 814690, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\Cache\_cache0.dat, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\Cache\_cache1.dat, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\Cache\_cache2.dat, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\108, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\2561.pem, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\2ekd.dat, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\HomeGuard.exe, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\main.log, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\main.stg, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\snem.exe, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vemd.exe, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmapw.dll, Quarantined, 3089, 814689, , , , PUP.Optional.HomeGuard, C:\USERS\{username}\DESKTOP\HOMEGUARD-SETUP_X64.EXE, Quarantined, 3089, 814716, 1.0.23132, , ame, Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.