Jump to content

Removal instructions for HomeGuard

Metallica
 Share

Recommended Posts

  • Staff
Metallica

Metallica

Posted
  • Staff
Posted

What is HomeGuard?

The Malwarebytes research team has determined that HomeGuard is a potentially unwanted program that behaves like spyware.
This application gathers information about the users' computer usage and their online behavior.

How do I know if my computer is affected by HomeGuard?

This is the main screen of the monitoring software:

main.png

You may see these warnings during install:

warning1.png

warning2.png

warning3.png

and these warnings during operations:

warning5.png

warning6.png

How did HomeGuard get on my computer?

Tracking applications use different methods for distributing themselves. This particular one was installed from their website:

website.png

How do I remove HomeGuard?

If you are the main user of the programs and you have the password you can uninstall the software from the main menu by clicking Uninstall.
For all other users, our program Malwarebytes can detect and remove this potentially unwanted program.

  • Please download Malwarebytes for Windows to your desktop.
  • Double-click MBSetup.exe and follow the prompts to install the program.
  • When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
  • Click on the Get started button.
  • Click Scan to start a Threat Scan.
  • When the scan is finished click Quarantine to remove the found threats.
  • Reboot the system if prompted to complete the removal process.

Is there anything else I need to do to get rid of HomeGuard?

  • No, Malwarebytes removes HomeGuard completely.

How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this potentially unwnated program.

As you can see below the full version of Malwarebytes would have protected you against the HomeGuard trackware. It would have blocked the installer before it became too late.
 

protection1.png


Technical details for experts

Possible signs in FRST logs: 

(Veridium Software) [File not signed] C:\Program Files\HomeGuard\HomeGuard.exe
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\nsis-pref.js [2020-04-29]
R2 HG51 AMC; C:\Program Files\HomeGuard\vglset.exe [3838976 2020-04-29] () [File not signed]
R2 HG52 AMC; C:\Program Files\HomeGuard\vglsetw.exe [4089856 2020-04-29] () [File not signed]
R4 WinDivert1.1; C:\Program Files\HomeGuard\hg425-71.dat3 [38064 2020-04-29] (Nemea Mjukvaruutveckling AB -> Basil)
C:\Program Files\HomeGuard
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HomeGuard

() [File not signed] C:\Program Files\HomeGuard\vmap.dll
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HG51 AMC => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HG52 AMC => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HG51 AMC => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HG52 AMC => ""="Service"
FirewallRules: [{276BB3CC-3EC7-4D1C-AC12-D5A22FEE90E8}] => (Allow) C:\Program Files\HomeGuard\vglsetw.exe () [File not signed]

Significant changes made by the installer: 

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files\HomeGuard
       Adds the file 108"="4/29/2020 9:09 AM, 0 bytes, A
       Adds the file 2561.pem"="4/29/2020 9:08 AM, 215556 bytes, A
       Adds the file 2ekd.dat"="4/29/2020 9:08 AM, 1070 bytes, A
       Adds the file hg425-71.dat3"="4/29/2020 9:08 AM, 38064 bytes, A
       Adds the file HomeGuard.exe"="4/29/2020 9:08 AM, 18468864 bytes, A
       Adds the file main.log"="4/29/2020 9:09 AM, 90 bytes, A
       Adds the file main.stg"="4/29/2020 9:08 AM, 72704 bytes, A
       Adds the file snem.exe"="4/29/2020 9:08 AM, 2749952 bytes, A
       Adds the file vemd.exe"="4/29/2020 9:08 AM, 2478080 bytes, A
       Adds the file VGLSET.EXE"="4/29/2020 9:08 AM, 3838976 bytes, A
       Adds the file vglsetw.exe"="4/29/2020 9:08 AM, 4089856 bytes, A
       Adds the file vmap.dll"="4/29/2020 9:08 AM, 601600 bytes, A
       Adds the file vmapw.dll"="4/29/2020 9:08 AM, 142848 bytes, A
    Adds the folder C:\Program Files\HomeGuard\Cache
       Adds the file _cache0.dat"="4/29/2020 9:13 AM, 43008 bytes, A
       Adds the file _cache1.dat"="4/29/2020 9:09 AM, 2048 bytes, A
       Adds the file _cache2.dat"="4/29/2020 9:09 AM, 2048 bytes, A
    Adds the folder C:\Program Files\HomeGuard\Cache\E56
    Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HomeGuard
       Adds the file HomeGuard.lnk"="4/29/2020 9:08 AM, 806 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{63D6B417-68A1-4692-9464-4B7A82621655}]
       "m"="REG_BINARY, ........
       "t"="REG_BINARY, ........
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F0D52062-4681-4314-9C46-536B975EDED1}]
       "p1"="REG_BINARY, ................................
       "p2"="REG_BINARY, ................
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HG51 AMC]
       "(Default)"="REG_SZ", "Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HG52 AMC]
       "(Default)"="REG_SZ", "Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HG51 AMC]
       "(Default)"="REG_SZ", "Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HG52 AMC]
       "(Default)"="REG_SZ", "Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HG51 AMC]
       "DelayedAutostart"="REG_DWORD", 0
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, "C:\Program Files\HomeGuard\vglset.exe"
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 2
       "Type"="REG_DWORD", 272
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HG52 AMC]
       "DelayedAutostart"="REG_DWORD", 0
       "Description"="REG_SZ", "HG Service"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, "C:\Program Files\HomeGuard\vglsetw.exe"
       "ObjectName"="REG_SZ", "LocalSystem"
       "Start"="REG_DWORD", 2
       "Type"="REG_DWORD", 272
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDivert1.1]
       "DeleteFlag"="REG_DWORD", 1
       "DisplayName"="REG_SZ", "WinDivert1.1"
       "ErrorControl"="REG_DWORD", 1
       "ImagePath"="REG_EXPAND_SZ, "\??\C:\Program Files\HomeGuard\hg425-71.dat3"
       "Start"="REG_DWORD", 4
       "Type"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDivert1.1\Enum]
       "0"="REG_SZ", "Root\LEGACY_WINDIVERT1.1\0000"
       "Count"="REG_DWORD", 1
       "NextInstance"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDivert1.1\Parameters\Wdf]
       "TimeOfLastSqmLog"="REG_QWORD, ....
       "WdfMajorVersion"="REG_DWORD", 1
       "WdfMinorVersion"="REG_DWORD", 9

Malwarebytes log: 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 4/29/20
Scan Time: 9:24 AM
Log File: 870b6e94-89ea-11ea-8ad2-00ffdcc6fdfc.json

-Software Information-
Version: 4.1.0.56
Components Version: 1.0.875
Update Package Version: 1.0.23132
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 233518
Threats Detected: 65
Threats Quarantined: 65
Time Elapsed: 7 min, 6 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 4
PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSET.EXE, Quarantined, 3089, 814694, , , , 
PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSETW.EXE, Quarantined, 3089, 814694, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\snem.exe, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vemd.exe, Quarantined, 3089, 814689, , , , 

Module: 35
PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSET.EXE, Quarantined, 3089, 814694, , , , 
PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSETW.EXE, Quarantined, 3089, 814694, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\snem.exe, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vemd.exe, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmapw.dll, Quarantined, 3089, 814689, , , , 

Registry Key: 3
PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HG51 AMC, Quarantined, 3089, 814694, 1.0.23132, , ame, 
PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HG52 AMC, Quarantined, 3089, 814694, 1.0.23132, , ame, 
PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WINDIVERT1.1, Quarantined, 3089, 814690, 1.0.23132, , ame, 

Registry Value: 3
PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HG51 AMC|IMAGEPATH, Quarantined, 3089, 814694, 1.0.23132, , ame, 
PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\HG52 AMC|IMAGEPATH, Quarantined, 3089, 814694, 1.0.23132, , ame, 
PUP.Optional.HomeGuard, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WINDIVERT1.1|IMAGEPATH, Quarantined, 3089, 814690, 1.0.23132, , ame, 

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\Cache\E56, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\Cache, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD, Quarantined, 3089, 814689, 1.0.23132, , ame, 

File: 17
PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSET.EXE, Quarantined, 3089, 814694, , , , 
PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\VGLSETW.EXE, Quarantined, 3089, 814694, , , , 
PUP.Optional.HomeGuard, C:\PROGRAM FILES\HOMEGUARD\HG425-71.DAT3, Quarantined, 3089, 814690, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\Cache\_cache0.dat, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\Cache\_cache1.dat, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\Cache\_cache2.dat, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\108, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\2561.pem, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\2ekd.dat, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\HomeGuard.exe, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\main.log, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\main.stg, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\snem.exe, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vemd.exe, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmap.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\Program Files\HomeGuard\vmapw.dll, Quarantined, 3089, 814689, , , , 
PUP.Optional.HomeGuard, C:\USERS\{username}\DESKTOP\HOMEGUARD-SETUP_X64.EXE, Quarantined, 3089, 814716, 1.0.23132, , ame, 

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention

Save yourself the hassle and get protected.

Link to post
Share on other sites
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.