Trojan.SafeGuard

Short bio

Trojan.SafeGuard is Malwarebytes’ detection name for a Trojan that is marketed as a false anti-malware scanner.

Type and source of the infection

Trojan.SafeGuard performs a LSP hijack on infected machines.
Trojan.SafeGuard is usually installed by the users themselves as part of a bundler or as a result of aggressive marketing.

Protection

Malwarebytes protects users from Trojan.SafeGuard by using real-time protection.

Malwarebytes blocks Trojan.SafeGuard

Remediation

Malwarebytes can detect and remove Trojan.SafeGuard without further user interaction.

1. Please download Malwarebytes to your desktop.
2. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
3. Then click Finish.
4. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
5. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
6. When the scan is complete, make sure that All Threats are selected, and click Remove Selected.
7. Restart your computer when prompted to do so.

The user should be prompted to reboot at least once, because of the needed reset of the Winsock. Without a reboot, the user could potentially lose their Internet connection.