There is a removal instruction post (http://www.malwarebytes.org/forums/index.php?showtopic=7314) that says MBAM will remove Spyware Guard 2008, however MBAM is not currently capable of fully removing the infection. Furthermore, the post will not allow a reply.

I really hate to point this out, because I think MBAM is a fantastic product. I just want the programmers to have another look at it, to see why the threat is not being fully removed. I tried, repeatedly, to remove it (Safe Mode, regular mode, System Restore disabled, cleaned all temp files...) with no luck. I finally had to use a competitive product to remove it.

Ed Coyne
www.AngeloPC.com
Contact Me

Greetings Angelo PC, and welcome to Malwarebytes'. Most likely you have a new variant that MBAM doesn't completely remove (yet). The rogues these days are not only becoming more tenacious, but they are being modified (some daily) to avoid detection, and many have begun to target MBAM specifically (along with a few other products) because of what they've been able to do to rogues in the past. If you should come across this one again or are able to recall the url that it came from, please post the info so the developers can get ahold of some samples to get a handle on completely getting rid of it. Thanks for visiting, good luck and safe surfing.

This specific infection was on a customer's machine, but I'll report the next time I come across something like this. You may want to reference the following URL, which is what tipped-me-off to the resolution.

http://www.malwarehelp.org/spyware-guard-2...moval-2008.html

Yeah, and there's definetely more than a few variants out there for this one (probably packaged with different trojans and/or rootkits) judging by the comments to that article (good read by the way, very thorough on the exact files and reg entries related to the infection).

Angelo PC, thank you for your feedback. Note that exile360 is most likely correct about the new variant, they come out with a new one each time we come out with a way to detect the latest one. It's a never ending cycle. That is why we have people (many of them volunteers) who work hard to help individual users with malware removal issues. Often the logs that people submit are used to add new rules to our definitions, and we also will ask for samples to be submitted when we think a user has come across a new variant.

If you ever have a sample you need to upload, then you can do so at our UploadNET.

As far the thread you referenced not allowing replies, that is because it is in a special forum where people have to be part of certain groups to reply. This way we keep malware removal questions out of the tutorials.

Thanks for the info, Arthur. I really just discovered the forums and I'll be sure to use them in the future.

You guys have put out a pretty decent product, which has "saved my butt" on more than one occasion.

Your efforts are well-appreciated.

Glad we could help.