Internet Security Guard is a fake antivirus program that belongs to the same rogue family as Virus Doctor. Such programs are classified as rogueware or also scareware, since they used different strategies in order to scare the user into purchasing their full versions.

The infection uses two methods for spreading. The first one is realized with the help of Trojans, hidden in compromised websites. Only one click through such a website triggers the Trojans’ installation. They enter the targeted PC without the user’s knowledge – through vulnerabilities found in the computer system. Most vulnerabilities are present due to outdated software. Therefor, it is highly recommended that you keep all your software up-to-date by downloading updates only from the official website of the given product.

The second method for delivering the Internet Security Guard infection to vulnerable computers counts on the users’ participation. Online scanners are placed on some websites. If the user authorizes Windows Web Security (this is the name of the scanner) to scan the PC, the program will pretend to be scanning, but no such process is actually taking place. All these scanning tools do is to present a preliminary list of infections and then prompt the victim to purchase the fake full version of Internet Security Guard. You should keep in mind that it is not safe to download any programs before you have checked online whether they are legitimate or not. Aggressive advertising is something usual for rogues, therefore you should never blindly trust online scanners.

Provided that Internet Security Guard manages to get inside of a computer system, its first task is to configure itself to start automatically as soon as Windows starts. It does not waste any time, but starts creating numerous files with random names such as: 

%UserProfile%\Recent\cb.drv
%UserProfile%\Recent\CLSV.dll
%UserProfile%\Recent\eb.dll
%UserProfile%\Recent\fix.sys
%UserProfile%\Recent\FWD.drv
%UserProfile%\Recent\gid.dll
%UserProfile%\Recent\PE.exe
%UserProfile%\Recent\ppal.sys
%UserProfile%\Recent\snl2w.drv
%UserProfile%\Recent\tjd.tmp

Then, the malware program evokes its fake scanning tool – this is exactly when the user becomes aware of the rogue’s presence inside the PC. The scans this application pretends to be performing are completely bogus – they only list non-existing infections or the harmless files that it has previously created. Its interface includes scary warnings just to make the victim think there are indeed some serious security issues, but the mere truth is that Internet Security Guard only wants to force through its phony full version. Therefor at the end of each scan it does not let the user remove the so-called infections, but urges him/her to purchase its “license” first. There is probably no need to say that this “licensed” version is also fraudulent.

Fake pop-ups are another deception weapon used by the villain. They are displayed every time and again, and they are not only irritating, but they also slow down the overall performance of the PC. The data included in them is made-up just to frighten the victim and make the scan-results look more legitimate. Some of these alerts are: 

System Message
Your PC may still be infected with dangerous viruses. Internet Security Guard protection is needed to prevent data loss and avoid theft of your personal data and credit card details. Click here to activate protection

Memory access problem
WindowsErrorForm has encountered a problem at address 0x1FC408. We are sorry for the inconvenience.

There is no doubt that everything Internet Security Guard does is aimed at misleading its victims into paying for its fake services. Whether you buy the full version of this software or not, the result will be the same – the counterfeit scans will continue to claim there are some malicious viruses inside the system and the deceitful notifications will not seize to appear. Therefor, you should not let Internet Security Guard trick you, but eliminate it as soon as you spot it on your PC with the help of a genuine AV program.

You can easily remove Internet Security Guard by removing its malicious files and folders:

Delete Internet Security Guard files:

%Programs%\Internet Security Guard.lnk
%StartMenu%\Internet Security Guard.lnk
%Desktop%\Internet Security Guard.lnk
%AppData%\Microsoft\Internet Explorer\Quick Launch\Internet Security Guard.lnk
%CommonAppData%\[random]\[random].exe
%CommonAppData%\[random]\ISG.ico
%CommonAppData%\[random]\[random].cfg
%AppData%\Internet Security Guard\Instructions.ini
%AppData%\Internet Security Guard\ScanDisk_.exe

Delete Internet Security Guard registry entries:

 HKCU\Software\Microsoft\Windows\CurrentVersion\Run “Internet Security Guard” “%CommonAppData%\[random]\[random].exe” /s /d

*SpyHunter’s free scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter’s malware suite to remove the malware threats.