Windows Police Pro VIRUS

Hello.

Your system is severly infected. Problem with these infections nowadays is, it causes a lot of damage. Even if we clean the malware off your system, I can't guarantee that your system will be clean afterwards, because these infections/bundles leave a lot of leftovers behind that most scanners won't even recognise and logs won't show.
Also, I can't promise you we can repair all the damage it caused... Even after cleaning the malware, you can still get errors afterwards because of the damage. Solving these is not always possible since it will be searching for a needle in a haystack to find the right cause and solution.
So, we can try to clean this up and do what we can, but keep in mind that we can't solve ALL problems this malware already caused.

In light of this it would be wise for you to back up any files and folders that you don't want to lose before we start. Reason I am telling this is because when a system is so terribly infected and we try to clean this up manually, the damage that is already present may interfere with our removal attempts.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
  R3 - URLSearchHook: (no name) - *{dd4dbc8a-427a-4eb2-8279-e32c5da79ded} - (no file)
  F2 - REG:system.ini: Shell=Explorer.exe,
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,cpwlglf.exe
  O2 - BHO: C:\WINDOWS\system32\tajf83ikdmf.dll - {BF56A325-23F2-42AD-F4E4-00AAC39CAA53} - C:\WINDOWS\system32\tajf83ikdmf.dll
  O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
  O4 - HKLM\..\Run: [adduvd] C:\WINDOWS\system32\blydvf.exe reg_run
  O4 - HKLM\..\Run: [net] "C:\WINDOWS\system32\net.net"
  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
  O4 - HKLM\..\Run: [braviax] braviax.exe
  O4 - HKLM\..\Run: [11105314] C:\Documents and Settings\All Users\Application Data\11105314\11105314.exe
  O4 - HKLM\..\Run: [jayuwonezo] Rundll32.exe "C:\WINDOWS\system32\puhafewu.dll",s
  O4 - HKLM\..\Run: [winupdate.exe] C:\WINDOWS\system32\winupdate.exe
  O4 - HKLM\..\Run: [dufafedit] Rundll32.exe "c:\windows\system32\fopihofu.dll",a
  O4 - HKCU\..\Run: [wykvw] C:\WINDOWS\system32\blydvf.exe reg_run
  O4 - HKCU\..\Run: [Monopod] C:\DOCUME~1\MIRZAT~1\LOCALS~1\Temp\f.exe
  O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
  O4 - HKCU\..\Run: [Windows System Recover!] C:\DOCUME~1\MIRZAT~1\LOCALS~1\Temp\notepad.exe
  O4 - HKCU\..\Policies\Explorer\Run: [{3CC0D40C-0AF0-1033-0302-040717200001}] "C:\Program Files\Common Files\{3CC0D40C-0AF0-1033-0302-040717200001}\Update.exe" te-110-12-0000213
  O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
  O20 - AppInit_DLLs: C:\WINDOWS\system32\cru629.dat c:\windows\system32\papororo.dll c:\windows\system32\fopihofu.dll
  O20 - Winlogon Notify: logqcx - logqcx.dll (file missing)
  O21 - SSODL: zefeyuvey - {d7c24666-992a-412d-bb5e-9b388eac7f57} - c:\windows\system32\papororo.dll
  O21 - SSODL: demokopag - {3ae453ff-08e9-4afd-b0ab-dcdf927f09bf} - c:\windows\system32\papororo.dll
  O21 - SSODL: vofilufeb - {42147456-7842-4b60-9864-f7c05640ea9e} - c:\windows\system32\fopihofu.dll
  O22 - SharedTaskScheduler: ghya673gidh87we9inkff - {BF56A325-23F2-42AD-F4E4-00AAC39CAA53} - C:\WINDOWS\system32\tajf83ikdmf.dll
  O22 - SharedTaskScheduler: mujuzedij - {d7c24666-992a-412d-bb5e-9b388eac7f57} - c:\windows\system32\papororo.dll
  O22 - SharedTaskScheduler: mujuzedij - {3ae453ff-08e9-4afd-b0ab-dcdf927f09bf} - c:\windows\system32\papororo.dll
  O22 - SharedTaskScheduler: jugezatag - {42147456-7842-4b60-9864-f7c05640ea9e} - c:\windows\system32\fopihofu.dll
  O23 - Service: AntipyProex (AntipPro2009_100) - Unknown owner - C:\WINDOWS\svchasts.exe
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

After I restarted my computer, I am unable to find my wireless network. It is not coming up at all. I am using my Ipod touch and seem to have wireless connection, but its not coming up on my PC.

I'm not suprised; I did post a warning that such a thing like this could happen. We can try and repair it, but we may also discover an even worse infection.

Right now, we may be heading down the "format" road, infections like this can cause a lot of damage to the OS.

I really do not know why my connection vanished on my PC, but here my wireless network works. I will try to post MBAM log as soon as I figure out my connection issues, unless you guys can help me get it back. Where do we go from now?

For your safety, I would recommend a format, see here:
http://miekiemoes.blogspot.com/2009/02/virut-and-other-file-infectors-throwing.html

Why go through such drastic measures?! I am really having a hard time believing that this is necessary. Why can't a regular anti-virus program detect this virus and delete it? And if there are no other ways in order to get rid of this virus, can I use a Recovery CD instead of formatting and re-installing OS and XP?

An antivirus is only half the job done, you need to do the other half. When installing things, you need to stop and ask yourself where you got it from? the real website or P2P?

If P2P, then did you scan it before running it? what program did you scan it with? was that program updated?

This is why we offer advise on safe surfing at the end of the topics we work on.

I am really having a hard time believing that this is necessary

It's necessary, damage like this either goes 1 of 2 ways. We fix it with lasting problems, or we don't fix it at all. Which is why I recommend a format, it's safer for you if you do any online banking from this machine.

Can you send me microsofts link on how to format and reinstall?

Instructions how to format and reinstall Windows can be found Here