Microsoft Police Pro

View previous topic View next topic Go down

Microsoft Police Pro

Post by j21850 on Sat Sep 26, 2009 7:57 pm

Please help with Microsoft Police Pro, i can't get rid of it, very nerve-racking

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sat Sep 26, 2009 8:00 pm

i can't get anywhere in my computer to be able to uninstall/delete. i just want it gone please

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sat Sep 26, 2009 8:02 pm

btw, luv ur commercial

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Sat Sep 26, 2009 8:13 pm

Please download the current version of HijackThis from [You must be registered and logged in to see this link.]

  • Double click and run the installer.
  • It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  • After installing, you should get the user agreement, press accept and Hijack This will run.
  • Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

what do i open it with (the hjt)?

Post by j21850 on Sat Sep 26, 2009 8:17 pm

it is asking what should i use to open hjt with

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Sat Sep 26, 2009 8:22 pm

Hello.

Please download [You must be registered and logged in to see this link.]

  • Double-click on exeHelper.com to run the fix.
  • A black window should pop up, press any key to close once the fix is completed.
  • Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sat Sep 26, 2009 8:36 pm

access is denied on exehelper

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Sat Sep 26, 2009 8:38 pm

Hello.

Please download [You must be registered and logged in to see this link.] file.

Download it to your Desktop.
Double click it to run it; select yes to the registry merge prompt.

Can you run Hijack This now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sat Sep 26, 2009 8:42 pm

i tried to hijack this again -- message: windows cannot access the specified device, path or file. You may not have the appropriate permissions to access them.

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sat Sep 26, 2009 8:54 pm

my computer shuts itself down, i keep getting the police pro pop ups, soo frustrating

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sat Sep 26, 2009 9:04 pm

is there not any hope?

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Sat Sep 26, 2009 10:13 pm

Hello.
There is hope. Smile

Please download SystemLook from one of the links below and save it to your Desktop.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    Code:

    :filefind
    scecli.dll
    netlogon.dll
    eventlog.dll
    cngaudit.dll

  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sun Sep 27, 2009 6:00 pm

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 10:51 on 27/09/2009 by Compaq_Administrator (Administrator - Elevation successful)

========== filefind ==========

Searching for "scecli.dll"
C:\WINDOWS\$NtServicePackUninstall$\scecli.dll -----c 180224 bytes [15:25 03/04/2009] [04:00 10/08/2004] 0F78E27F563F2AAF74B91A49E2ABF19A
C:\WINDOWS\ServicePackFiles\i386\scecli.dll ------ 181248 bytes [03:48 08/12/2008] [00:12 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084
C:\WINDOWS\system32\scecli.dll --a--- 181248 bytes [04:00 10/08/2004] [00:12 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084

Searching for "netlogon.dll"
C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll -----c 407040 bytes [15:25 03/04/2009] [04:00 10/08/2004] 96353FCECBA774BB8DA74A1C6507015A
C:\WINDOWS\ServicePackFiles\i386\netlogon.dll ------ 407040 bytes [03:48 08/12/2008] [00:12 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550
C:\WINDOWS\system32\netlogon.dll --a--- 407040 bytes [04:00 10/08/2004] [00:12 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550

Searching for "eventlog.dll"
C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll -----c 55808 bytes [15:25 03/04/2009] [04:00 10/08/2004] 82B24CB70E5944E6E34662205A2A5B78
C:\WINDOWS\ServicePackFiles\i386\eventlog.dll ------ 56320 bytes [03:46 08/12/2008] [00:11 14/04/2008] 6D4FEB43EE538FC5428CC7F0565AA656
C:\WINDOWS\system32\eventlog.dll --a--- 61952 bytes [04:00 10/08/2004] [00:11 14/04/2008] (Unable to calculate MD5)

Searching for "cngaudit.dll"
No files found.

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Sun Sep 27, 2009 6:37 pm

1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.]

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+CCrying


Files to delete:
C:\WINDOWS\system32\eventlog.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


3. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Input script here:", paste in the script from the quote box above.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
4. Please copy/paste the content of c:\avenger.txt into your reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sun Sep 27, 2009 6:59 pm

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\eventlog.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Sun Sep 27, 2009 7:03 pm

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sun Sep 27, 2009 7:14 pm

message: windows cannot access the specified device, path, or file. you may not have the appropriate permissions to access them

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Sun Sep 27, 2009 7:21 pm

Did you already have MBAM? if so, you need to delete it and re-download it, because it's corrupted.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sun Sep 27, 2009 7:30 pm

the only mbam i had on my computer is the one i just downloaded, i deleted it, then deleted it from recycle bin. i downloaded it again and it is giving me the same message

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Sun Sep 27, 2009 7:35 pm

1. Download Win32kDiag from any of the following locations and save it to your Desktop.
[You must be registered and logged in to see this link.]
2. Double-click Win32kDiag.exe to run it and and let it finish.
3. When it states Finished! Press any key to exit..., press any key to close the program.
4. It will save a Win32kDiag.txt file to your desktop automatically. Attach this log file to your next message.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sun Sep 27, 2009 7:38 pm

i tried to double click win32kdiag, same message as before

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Sun Sep 27, 2009 7:41 pm

Hello.
Can you run the SystemLook script again? I want to see if that infected file is back.

Make sure you post the NEW log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sun Sep 27, 2009 9:03 pm

now i cant even open system look -- either one of them -- same message

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Sun Sep 27, 2009 9:21 pm

Delete SystemLook and download it again. Same error message? I'm gonna talk to someone about this, I think you might have a new version of it.

Will avenger work either?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sun Sep 27, 2009 9:27 pm

i will try avenger again, but just to let you know something else -- my computer rebooted itself again -when it came back on i got a message saying rundll32.exe another program is currently using this file -- will that help you figure this out?

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sun Sep 27, 2009 9:29 pm

nope cant get into avenger now -- same message

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sun Sep 27, 2009 9:34 pm

it seems like everytime we get close to killing this thing, it recognizes it and doesnt' allow us to fix it--it is pathetic to think that someone is soooo desperate to want to sell their software that they dupe people into such an annoying, waste of time, i cant even get work done from this computer.
I do appreciate all this time you have spent trying to figure out a mistake my mother made. She panicked when it said at first there was something attacking the computer and she said "YES" to do u want us to help. Thank you again for all your patience with me!

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Sun Sep 27, 2009 9:36 pm

Hello.
I have messaged someone about this issue. He knows a bit more about this than I do.
Hold tight.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by j21850 on Sun Sep 27, 2009 9:39 pm

thank you belahzur, greatly appreciated

j21850
Novice
Novice

Status :
Online
Offline

Posts : 19
Joined : 2009-09-26
OS : xp

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Mon Sep 28, 2009 6:07 pm

Hello.
I'm back.

Let try throwing a knife straight at this thing and see if we can make a dent into it.

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Microsoft Police Pro

Post by Belahzur on Mon Sep 28, 2009 6:07 pm

Hello.
I'm back.

Let try throwing a knife straight at this thing and see if we can make a dent into it.

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum