What DriveGuard.exe does?
• Adds itself to startup and the task manager.
• Adds a registry key for making changes in the registry editor.
• Adds Autorun.inf file in the pen drive
• Adds some malicious temporary files in the system.
Solution:
1. Boot the computer in the Safe Mode.
2. Open the task manager and kill the processes with names DriveGuard.exe/FlashGuard.exe/DriveMonitor.exe
3. Open My Computer and search for the same virus names but don’t forget to check all the boxes in the ‘More Advanced Options’ of search. Delete all the files.
4. Now search for .tmp.exe and delete DriveGuard.tmp.exe and gHmpg.tmp.exe files, if any.
5. Open the msconfig, now go to startup processes and uncheck the FlashGuard process to remove it from the startup list.
6. Open Regedit and navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\FlashGuard.
7. Click on FlashGuard and delete the key.
The virus would have been removed.
