Manual removal of malwares [sftav, sysguard, aabxam, and avscan

Disable LAN

1. If possible, kill the following processes in Task Manager:

a. [RANDOM CHARACTERS]sysguard.exe, for example ghrtsysguard.exe

b. [RANDOM CHARACTERS]sftav.exe

1. Remove These Registry entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "[random characters]"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run "[random charaters]"

HKCU \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = "1"

HKCU \Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyServer" = "http=127.0.0.1:5555"

HKCU \Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = ".exe"

HKCU\Software\Microsoft\Internet Explorer\Download "RunInvalidSignatures" = "1"

HKCU \Software\Microsoft\Windows\CurrentVersion\Internet Settings "ProxyOverride" = ""

HKCU \Software\AvScan

1. Search and Remove These Files

%UserProfile%\Local Settings\Application Data\[random characters]\

%UserProfile%\Local Settings\Application Data\[random characters]\[random characters]sysguard.exe

%UserProfile%\Local Settings\Application Data\[random characters]\[random characters]sftav.exe

1. Search registry for the following keywords (Note: You must use wildcards)
   1. *sftav*
   2. *sysguard*
   3. *aabxam*
   4. *avscan*
2. Search computer for the following keywords
   1. *sftav*
   2. *sysguard*
   3. *aabxam*
   4. *avscan*
3. Go to Internet Options à Connections tab à LAN Settings à Uncheck “Use proxy settings for your LAN…”

Thanks for the info RP!