Malicious Progarm - WinSpywareProtect sysguard.exe

Windows Security Tutorials - Herong's Tutorial Examples

∟Malicious Progarm - WinSpywareProtect sysguard.exe

This section provides some notes on Antivirus System PRO program sysguard.exe detected and terminated by Spybot - Search & Destroy as the WinSpywareProtect virus threat.

More notes on what Antivirus System PRO did and what I did to remove it.

10. A moment later, the "Spybot - Search & Destroy" virus protection program displays an alert message. See the picture below:

Spybot - Search & Destroy has encountered and
terminated a process that is listed as part of a 
malicious software.

Process ID: 1648
Filename: sysguard.exe
Found in: C:\WINDOWS\
Identified as: WinSpywareProtect

If Spybot - Search & Destroy encounters this process again...
[x] Inform me again.
[ ] Automatically kill this process.
[ ] Allow this process to run (NOT RECOMMENDED).

[X] Delete the associated file.

11. Clicking the OK button to let Spybot - Search & Destroy to delete the virus program file sysguard.exe.

12. The Antivirus System PRO task bar icon is gone.

Some quick conclusions:

The Antivirus System PRO task bar icon is resulted from the running process, sysguard.exe.
The antivirus program installed on the system, Spybot - Search & Destroy, did a good job to detect and remove the sysguard.exe process as a virus threat.
But it would be much better, if Spybot - Search & Destroy could detect and stop sysguard.exe being stored to the hard disk or detect and stop being launched into a running process.