Windows Police Pro VIRUS

I read the guide and deleted those files in task manager. I then proceeded to download the malware program and it somehow worked, but then it suddenly turned off and I cant open it anymore. I click on it and it just reads error and gives the file name. I cannot even get into any other program except the internet. Those error messages just keep on popping up. Help please!?

I seemed to have gotten rid of Windows Police Pro, but the Error messages keep on popping up. I am unable to open any programs, files except my internet browser. Sorry I cannot give you the HijackThis Info.

Hello.
What does the error message say?

It says error and in the message it just gives the location of that file


It looks something like this
Error
C:\Program Files\Malwarebytes'Anti-Malware\mbam.exe

bump

Somehow I got HijackThis running after I had to click 3 times on the error box that popped up. I pressed ok on thos error boxes and HijackThis somehow opened up and ran it and all of a sudden after it finished it just disappeared.

You've said HJT disappeared after running. Did you tried opening the same HJT again ?? Check whether you are getting any error message like

"path or device cannot Found, you dont have Permission"

Ive just entered a part of error.. So check whether you are seeing the above mentioned error message when you try to open HJT again

I cannot run it at all now. I probably could run it if I downloaded it from the link again but it will still do the same thing. No I did not get that message at all. I go into task manager and do the first step, but I cannot do anything else because it wont let me. It pops up and says that there is an error and give me the location of the file .exe.

This is the message I get for almost all of the programs. I can open certain programs, but only after I have clicked these kinds of Error boxes that pop up for each program I want to run. I can't change my background because it wont let me open the properties.

https://2img.net/r/ihimizer/img190/5690/11773926.png

Last edited by exchange on 6th September 2009, 3:57 pm; edited 3 times in total (Reason for editing : ...)

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  Code:

  
:filefind
scecli.dll
netlogon.dll
eventlog.dll
cngaudit.dll

  
  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 15:15 on 06/09/2009 by me (Administrator - Elevation successful)

========== filefind ==========

Searching for "scecli.dll"
C:\WINDOWS\$NtServicePackUninstall$\scecli.dll -----c 180224 bytes [21:12 12/09/2008] [07:56 04/08/2004] 0F78E27F563F2AAF74B91A49E2ABF19A
C:\WINDOWS\ServicePackFiles\i386\scecli.dll -----c 181248 bytes [07:56 04/08/2004] [00:12 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084
C:\WINDOWS\system32\scecli.dll --a--- 181248 bytes [18:36 08/03/2004] [00:12 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084

Searching for "netlogon.dll"
C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll -----c 407040 bytes [21:12 12/09/2008] [07:56 04/08/2004] 96353FCECBA774BB8DA74A1C6507015A
C:\WINDOWS\ServicePackFiles\i386\netlogon.dll -----c 407040 bytes [07:56 04/08/2004] [00:12 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550
C:\WINDOWS\system32\netlogon.dll --a--- 407040 bytes [18:36 08/03/2004] [00:12 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550

Searching for "eventlog.dll"
C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll -----c 55808 bytes [21:13 12/09/2008] [07:56 04/08/2004] 82B24CB70E5944E6E34662205A2A5B78
C:\WINDOWS\ServicePackFiles\i386\eventlog.dll -----c 56320 bytes [07:56 04/08/2004] [00:11 14/04/2008] 6D4FEB43EE538FC5428CC7F0565AA656
C:\WINDOWS\system32\eventlog.dll --a--- 62464 bytes [18:36 08/03/2004] [00:11 14/04/2008] (Unable to calculate MD5)

Searching for "cngaudit.dll"
No files found.

-=End Of File=-

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\WINDOWS\system32\eventlog.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

I restarted after Avenger asked me to, but I did not see the black command window or it was too brief for my eyes to see :smile2: . The log file did not open up when my computer came into the desktop, but I had to search for it under the file name that you gave me.

I also searched for the zip files that should have been backed up, but I could not find it. Looks like it did not creata back up files. Here is the avenger.txt. I hope this is the right information.

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Sun Sep 06 19:08:47 2009

19:08:46: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!



//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\eventlog.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Last edited by exchange on 6th September 2009, 11:25 pm; edited 2 times in total (Reason for editing : ...)

Hello.
Download Hijack This from here; see if it works.
http://www.sendspace.com/pro/dl/fpzz64

If it works, do a system scan with logfile, copy/paste the log back here.

Said that the message is too big so here is a link to the file.

http://www.mediafire.com/?sharekey=c9fc36007c545a1790a82c7bb0fad7ade04e75f6e8ebb871