How to remove SWP2009 Demo virus (Uninstall guide)

Don't Copy From This Blog...

An application titled SWP2009 demo is a fake (rogue) program or just simply a virus that displays fake pop-ups stating that your computer is infected. Basically, it's the same thing as Antivirus Live malware. In some cases Antivirus Live opens but it’s named SWP2009 Demo on the Windows bar. The biggest problem with this virus is that it actually blocks legitimate anti-virus software. It disables Task Manager too to protect itself in case you try to end its processes. However, first of all try to download and install one of the following applications:

• SUPERAntispyware
• MalwareBytes Anti-Malware
• Spyware Doctor

If you are lucky and SWP2009 demo didn’t block them you should be able to run a full system scan and remove this virus. Unfortunately, most of the time this malware is a headache, but you can still remove it. Here’s how to do that:

1. Open Task Manager immediately on boot-up. Hit Ctrl+Alt+Del immediately as the computer shows your desktop background. The SWP2009demo malware takes a moment to load so the Task Manager will be blank until the virus loads. Then end this virus when it pops-up. It’s processes: swp2009 demo.exe and [random]sysguard.exe, for example: roxasysguard.exe

2. Search for the “sysguard.exe” file on your computer. Don’t forger to make hidden files visible in order to remove them. If you don’t know how to do that read here: http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/hiddenfiles.mspx

Then delete all files that have “sysguard.exe” in their names. Also look for swp2009 demo.exe. At this point try to download the anti-spyware applications listed above again. There is a great chance that this time you will be able to launch those programs. If not, then reboot your PC in Safe Mode with Networking and do the same again. You can find more useful information about SWP2009 demo here (Google forum): http://groups.google.com/group/microsoft.public.security.virus/browse_thread/thread/9fb27958d73f07e7?pli=1

If you have any questions, don’t hesitate leave a comment.

Share this information with other people: