Trojan.SafeGuard

Short bio
Trojan.SafeGuard is Malwarebytes’ detection name for a Trojanthat is marketed as a false anti-malware scanner.
Type and source of the infection
Trojan.SafeGuard performs a LSP hijackon infected machines.Trojan.SafeGuard is usually installed by the users themselves as part of a bundleror as a result of aggressive marketing.
Protection

Malwarebytes blocks Trojan.SafeGuard
Home remediation
Malwarebytes can detect and remove Trojan.SafeGuard without further user interaction.
- Please download Malwarebytesto your desktop.
- Double-click MBSetup.exeand follow the prompts to install the program.
- When your Malwarebytes for Windowsinstallation completes, the program opens to the Welcome to Malwarebytes screen.
- Click on the Get startedbutton.
- Click Scan to start a Threat Scan.
- Click Quarantineto remove the found threats.
- Reboot the system if prompted to complete the removal process.
The user should be prompted to reboot at least once, because of the needed reset of the Winsock. Without a reboot, the user could potentially lose their Internet connection.
Business remediation
How to remove Trojan.SafeGuard with the Malwarebytes Nebula console
You can use the Malwarebytes Anti-Malware Nebula console to scan endpoints.

Nebula endpoint tasks menu
Choose the Scan + Quarantine option. Afterwards you can check the Detections pageto see which threats were found.

On the Quarantine pageyou can see which threats were quarantined and restore them if necessary.
