Windows Police Pro VIRUS

View previous topic View next topic Go down

Windows Police Pro VIRUS

Post by exchange on 5th September 2009, 4:27 pm

I read the guide and deleted those files in task manager. I then proceeded to download the malware program and it somehow worked, but then it suddenly turned off and I cant open it anymore. I click on it and it just reads error and gives the file name. I cannot even get into any other program except the internet. Those error messages just keep on popping up. Help please!?

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 5th September 2009, 7:58 pm

I seemed to have gotten rid of Windows Police Pro, but the Error messages keep on popping up. I am unable to open any programs, files except my internet browser. Sorry I cannot give you the HijackThis Info.

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by Belahzur on 5th September 2009, 8:58 pm

Hello.
What does the error message say?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 5th September 2009, 9:45 pm

It says error and in the message it just gives the location of that file


It looks something like this
Error
C:\Program Files\Malwarebytes'Anti-Malware\mbam.exe

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 6th September 2009, 2:38 pm

bump

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 6th September 2009, 2:46 pm

Somehow I got HijackThis running after I had to click 3 times on the error box that popped up. I pressed ok on thos error boxes and HijackThis somehow opened up and ran it and all of a sudden after it finished it just disappeared.

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by Metalmusk on 6th September 2009, 3:32 pm

You've said HJT disappeared after running. Did you tried opening the same HJT again ?? Check whether you are getting any error message like

"path or device cannot Found, you dont have Permission"

Ive just entered a part of error.. So check whether you are seeing the above mentioned error message when you try to open HJT again Smile

Metalmusk
Novice
Novice

Posts Posts : 43
Joined Joined : 2009-06-21
OS OS : XP
Points Points : 27940
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 6th September 2009, 3:42 pm

I cannot run it at all now. I probably could run it if I downloaded it from the link again but it will still do the same thing. No I did not get that message at all. I go into task manager and do the first step, but I cannot do anything else because it wont let me. It pops up and says that there is an error and give me the location of the file .exe.

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 6th September 2009, 3:46 pm

This is the message I get for almost all of the programs. I can open certain programs, but only after I have clicked these kinds of Error boxes that pop up for each program I want to run. I can't change my background because it wont let me open the properties.

[You must be registered and logged in to see this link.]


Last edited by exchange on 6th September 2009, 3:57 pm; edited 3 times in total (Reason for editing : ...)

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by Belahzur on 6th September 2009, 6:23 pm

Please download SystemLook from one of the links below and save it to your Desktop.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    Code:

    :filefind
    scecli.dll
    netlogon.dll
    eventlog.dll
    cngaudit.dll

  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 6th September 2009, 7:18 pm

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 15:15 on 06/09/2009 by me (Administrator - Elevation successful)

========== filefind ==========

Searching for "scecli.dll"
C:\WINDOWS\$NtServicePackUninstall$\scecli.dll -----c 180224 bytes [21:12 12/09/2008] [07:56 04/08/2004] 0F78E27F563F2AAF74B91A49E2ABF19A
C:\WINDOWS\ServicePackFiles\i386\scecli.dll -----c 181248 bytes [07:56 04/08/2004] [00:12 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084
C:\WINDOWS\system32\scecli.dll --a--- 181248 bytes [18:36 08/03/2004] [00:12 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084

Searching for "netlogon.dll"
C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll -----c 407040 bytes [21:12 12/09/2008] [07:56 04/08/2004] 96353FCECBA774BB8DA74A1C6507015A
C:\WINDOWS\ServicePackFiles\i386\netlogon.dll -----c 407040 bytes [07:56 04/08/2004] [00:12 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550
C:\WINDOWS\system32\netlogon.dll --a--- 407040 bytes [18:36 08/03/2004] [00:12 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550

Searching for "eventlog.dll"
C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll -----c 55808 bytes [21:13 12/09/2008] [07:56 04/08/2004] 82B24CB70E5944E6E34662205A2A5B78
C:\WINDOWS\ServicePackFiles\i386\eventlog.dll -----c 56320 bytes [07:56 04/08/2004] [00:11 14/04/2008] 6D4FEB43EE538FC5428CC7F0565AA656
C:\WINDOWS\system32\eventlog.dll --a--- 62464 bytes [18:36 08/03/2004] [00:11 14/04/2008] (Unable to calculate MD5)

Searching for "cngaudit.dll"
No files found.

-=End Of File=-

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by Origin on 6th September 2009, 10:14 pm

1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.]

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+CCrying


Files to delete:
C:\WINDOWS\system32\eventlog.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


3. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Input script here:", paste in the script from the quote box above.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
4. Please copy/paste the content of c:\avenger.txt into your reply.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31513
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 6th September 2009, 11:23 pm

I restarted after Avenger asked me to, but I did not see the black command window or it was too brief for my eyes to see :smile2: . The log file did not open up when my computer came into the desktop, but I had to search for it under the file name that you gave me.

I also searched for the zip files that should have been backed up, but I could not find it. Looks like it did not creata back up files. Here is the avenger.txt. I hope this is the right information.

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Sun Sep 06 19:08:47 2009

19:08:46: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!



//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\eventlog.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.


Last edited by exchange on 6th September 2009, 11:25 pm; edited 2 times in total (Reason for editing : ...)

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by Belahzur on 7th September 2009, 8:38 pm

Hello.
Download Hijack This from here; see if it works.
[You must be registered and logged in to see this link.]

If it works, do a system scan with logfile, copy/paste the log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 7th September 2009, 11:16 pm

Said that the message is too big so here is a link to the file.

[You must be registered and logged in to see this link.]

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by Belahzur on 7th September 2009, 11:25 pm

Hello.

Your system is severly infected. Problem with these infections nowadays is, it causes a lot of damage. Even if we clean the malware off your system, I can't guarantee that your system will be clean afterwards, because these infections/bundles leave a lot of leftovers behind that most scanners won't even recognise and logs won't show.
Also, I can't promise you we can repair all the damage it caused... Even after cleaning the malware, you can still get errors afterwards because of the damage. Solving these is not always possible since it will be searching for a needle in a haystack to find the right cause and solution.
So, we can try to clean this up and do what we can, but keep in mind that we can't solve ALL problems this malware already caused.

In light of this it would be wise for you to back up any files and folders that you don't want to lose before we start. Reason I am telling this is because when a system is so terribly infected and we try to clean this up manually, the damage that is already present may interfere with our removal attempts.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    R3 - URLSearchHook: (no name) - *{dd4dbc8a-427a-4eb2-8279-e32c5da79ded} - (no file)
    F2 - REG:system.ini: Shell=Explorer.exe,
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,cpwlglf.exe
    O2 - BHO: C:\WINDOWS\system32\tajf83ikdmf.dll - {BF56A325-23F2-42AD-F4E4-00AAC39CAA53} - C:\WINDOWS\system32\tajf83ikdmf.dll
    O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
    O4 - HKLM\..\Run: [adduvd] C:\WINDOWS\system32\blydvf.exe reg_run
    O4 - HKLM\..\Run: [net] "C:\WINDOWS\system32\net.net"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [braviax] braviax.exe
    O4 - HKLM\..\Run: [11105314] C:\Documents and Settings\All Users\Application Data\11105314\11105314.exe
    O4 - HKLM\..\Run: [jayuwonezo] Rundll32.exe "C:\WINDOWS\system32\puhafewu.dll",s
    O4 - HKLM\..\Run: [winupdate.exe] C:\WINDOWS\system32\winupdate.exe
    O4 - HKLM\..\Run: [dufafedit] Rundll32.exe "c:\windows\system32\fopihofu.dll",a
    O4 - HKCU\..\Run: [wykvw] C:\WINDOWS\system32\blydvf.exe reg_run
    O4 - HKCU\..\Run: [Monopod] C:\DOCUME~1\MIRZAT~1\LOCALS~1\Temp\f.exe
    O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
    O4 - HKCU\..\Run: [Windows System Recover!] C:\DOCUME~1\MIRZAT~1\LOCALS~1\Temp\notepad.exe
    O4 - HKCU\..\Policies\Explorer\Run: [{3CC0D40C-0AF0-1033-0302-040717200001}] "C:\Program Files\Common Files\{3CC0D40C-0AF0-1033-0302-040717200001}\Update.exe" te-110-12-0000213
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O20 - AppInit_DLLs: C:\WINDOWS\system32\cru629.dat c:\windows\system32\papororo.dll c:\windows\system32\fopihofu.dll
    O20 - Winlogon Notify: logqcx - logqcx.dll (file missing)
    O21 - SSODL: zefeyuvey - {d7c24666-992a-412d-bb5e-9b388eac7f57} - c:\windows\system32\papororo.dll
    O21 - SSODL: demokopag - {3ae453ff-08e9-4afd-b0ab-dcdf927f09bf} - c:\windows\system32\papororo.dll
    O21 - SSODL: vofilufeb - {42147456-7842-4b60-9864-f7c05640ea9e} - c:\windows\system32\fopihofu.dll
    O22 - SharedTaskScheduler: ghya673gidh87we9inkff - {BF56A325-23F2-42AD-F4E4-00AAC39CAA53} - C:\WINDOWS\system32\tajf83ikdmf.dll
    O22 - SharedTaskScheduler: mujuzedij - {d7c24666-992a-412d-bb5e-9b388eac7f57} - c:\windows\system32\papororo.dll
    O22 - SharedTaskScheduler: mujuzedij - {3ae453ff-08e9-4afd-b0ab-dcdf927f09bf} - c:\windows\system32\papororo.dll
    O22 - SharedTaskScheduler: jugezatag - {42147456-7842-4b60-9864-f7c05640ea9e} - c:\windows\system32\fopihofu.dll
    O23 - Service: AntipyProex (AntipPro2009_100) - Unknown owner - C:\WINDOWS\svchasts.exe


  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 8th September 2009, 12:42 am

After I restarted my computer, I am unable to find my wireless network. It is not coming up at all. I am using my Ipod touch and seem to have wireless connection, but its not coming up on my PC.

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by Belahzur on 8th September 2009, 1:33 am

I'm not suprised; I did post a warning that such a thing like this could happen. We can try and repair it, but we may also discover an even worse infection.

Right now, we may be heading down the "format" road, infections like this can cause a lot of damage to the OS.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 8th September 2009, 2:29 am

I really do not know why my connection vanished on my PC, but here my wireless network works. I will try to post MBAM log as soon as I figure out my connection issues, unless you guys can help me get it back. Where do we go from now?

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by Belahzur on 8th September 2009, 2:38 pm

For your safety, I would recommend a format, see here:
[You must be registered and logged in to see this link.]


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 8th September 2009, 7:28 pm

Why go through such drastic measures?! I am really having a hard time believing that this is necessary. Why can't a regular anti-virus program detect this virus and delete it? And if there are no other ways in order to get rid of this virus, can I use a Recovery CD instead of formatting and re-installing OS and XP?

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by Belahzur on 8th September 2009, 7:55 pm

An antivirus is only half the job done, you need to do the other half. When installing things, you need to stop and ask yourself where you got it from? the real website or P2P?

If P2P, then did you scan it before running it? what program did you scan it with? was that program updated?

This is why we offer advise on safe surfing at the end of the topics we work on.

I am really having a hard time believing that this is necessary

It's necessary, damage like this either goes 1 of 2 ways. We fix it with lasting problems, or we don't fix it at all. Which is why I recommend a format, it's safer for you if you do any online banking from this machine.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by exchange on 8th September 2009, 9:14 pm

Can you send me microsofts link on how to format and reinstall?

exchange
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-09-05
OS OS : XP
Points Points : 26544
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Windows Police Pro VIRUS

Post by Belahzur on 9th September 2009, 12:02 am

Instructions how to format and reinstall Windows can be found [You must be registered and logged in to see this link.]


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum