Windows Police Pro VIRUS

I read the guide and deleted those files in task manager. I then proceeded to download the malware program and it somehow worked, but then it suddenly turned off and I cant open it anymore. I click on it and it just reads error and gives the file name. I cannot even get into any other program except the internet. Those error messages just keep on popping up. Help please!?

I seemed to have gotten rid of Windows Police Pro, but the Error messages keep on popping up. I am unable to open any programs, files except my internet browser. Sorry I cannot give you the HijackThis Info.

Hello.
What does the error message say?

It says error and in the message it just gives the location of that file


It looks something like this
Error
C:\Program Files\Malwarebytes'Anti-Malware\mbam.exe

bump

Somehow I got HijackThis running after I had to click 3 times on the error box that popped up. I pressed ok on thos error boxes and HijackThis somehow opened up and ran it and all of a sudden after it finished it just disappeared.

You've said HJT disappeared after running. Did you tried opening the same HJT again ?? Check whether you are getting any error message like

"path or device cannot Found, you dont have Permission"

Ive just entered a part of error.. So check whether you are seeing the above mentioned error message when you try to open HJT again

I cannot run it at all now. I probably could run it if I downloaded it from the link again but it will still do the same thing. No I did not get that message at all. I go into task manager and do the first step, but I cannot do anything else because it wont let me. It pops up and says that there is an error and give me the location of the file .exe.

This is the message I get for almost all of the programs. I can open certain programs, but only after I have clicked these kinds of Error boxes that pop up for each program I want to run. I can't change my background because it wont let me open the properties.

https://2img.net/r/ihimizer/img190/5690/11773926.png

Last edited by exchange on 6th September 2009, 3:57 pm; edited 3 times in total (Reason for editing : ...)

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  Code:

  
:filefind
scecli.dll
netlogon.dll
eventlog.dll
cngaudit.dll

  
  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 15:15 on 06/09/2009 by me (Administrator - Elevation successful)

========== filefind ==========

Searching for "scecli.dll"
C:\WINDOWS\$NtServicePackUninstall$\scecli.dll -----c 180224 bytes [21:12 12/09/2008] [07:56 04/08/2004] 0F78E27F563F2AAF74B91A49E2ABF19A
C:\WINDOWS\ServicePackFiles\i386\scecli.dll -----c 181248 bytes [07:56 04/08/2004] [00:12 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084
C:\WINDOWS\system32\scecli.dll --a--- 181248 bytes [18:36 08/03/2004] [00:12 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084

Searching for "netlogon.dll"
C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll -----c 407040 bytes [21:12 12/09/2008] [07:56 04/08/2004] 96353FCECBA774BB8DA74A1C6507015A
C:\WINDOWS\ServicePackFiles\i386\netlogon.dll -----c 407040 bytes [07:56 04/08/2004] [00:12 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550
C:\WINDOWS\system32\netlogon.dll --a--- 407040 bytes [18:36 08/03/2004] [00:12 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550

Searching for "eventlog.dll"
C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll -----c 55808 bytes [21:13 12/09/2008] [07:56 04/08/2004] 82B24CB70E5944E6E34662205A2A5B78
C:\WINDOWS\ServicePackFiles\i386\eventlog.dll -----c 56320 bytes [07:56 04/08/2004] [00:11 14/04/2008] 6D4FEB43EE538FC5428CC7F0565AA656
C:\WINDOWS\system32\eventlog.dll --a--- 62464 bytes [18:36 08/03/2004] [00:11 14/04/2008] (Unable to calculate MD5)

Searching for "cngaudit.dll"
No files found.

-=End Of File=-

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\WINDOWS\system32\eventlog.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

I restarted after Avenger asked me to, but I did not see the black command window or it was too brief for my eyes to see :smile2: . The log file did not open up when my computer came into the desktop, but I had to search for it under the file name that you gave me.

I also searched for the zip files that should have been backed up, but I could not find it. Looks like it did not creata back up files. Here is the avenger.txt. I hope this is the right information.

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Sun Sep 06 19:08:47 2009

19:08:46: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!



//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\eventlog.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Last edited by exchange on 6th September 2009, 11:25 pm; edited 2 times in total (Reason for editing : ...)

Hello.
Download Hijack This from here; see if it works.
http://www.sendspace.com/pro/dl/fpzz64

If it works, do a system scan with logfile, copy/paste the log back here.

Said that the message is too big so here is a link to the file.

http://www.mediafire.com/?sharekey=c9fc36007c545a1790a82c7bb0fad7ade04e75f6e8ebb871

Hello.

Your system is severly infected. Problem with these infections nowadays is, it causes a lot of damage. Even if we clean the malware off your system, I can't guarantee that your system will be clean afterwards, because these infections/bundles leave a lot of leftovers behind that most scanners won't even recognise and logs won't show.
Also, I can't promise you we can repair all the damage it caused... Even after cleaning the malware, you can still get errors afterwards because of the damage. Solving these is not always possible since it will be searching for a needle in a haystack to find the right cause and solution.
So, we can try to clean this up and do what we can, but keep in mind that we can't solve ALL problems this malware already caused.

In light of this it would be wise for you to back up any files and folders that you don't want to lose before we start. Reason I am telling this is because when a system is so terribly infected and we try to clean this up manually, the damage that is already present may interfere with our removal attempts.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
  R3 - URLSearchHook: (no name) - *{dd4dbc8a-427a-4eb2-8279-e32c5da79ded} - (no file)
  F2 - REG:system.ini: Shell=Explorer.exe,
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,cpwlglf.exe
  O2 - BHO: C:\WINDOWS\system32\tajf83ikdmf.dll - {BF56A325-23F2-42AD-F4E4-00AAC39CAA53} - C:\WINDOWS\system32\tajf83ikdmf.dll
  O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
  O4 - HKLM\..\Run: [adduvd] C:\WINDOWS\system32\blydvf.exe reg_run
  O4 - HKLM\..\Run: [net] "C:\WINDOWS\system32\net.net"
  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
  O4 - HKLM\..\Run: [braviax] braviax.exe
  O4 - HKLM\..\Run: [11105314] C:\Documents and Settings\All Users\Application Data\11105314\11105314.exe
  O4 - HKLM\..\Run: [jayuwonezo] Rundll32.exe "C:\WINDOWS\system32\puhafewu.dll",s
  O4 - HKLM\..\Run: [winupdate.exe] C:\WINDOWS\system32\winupdate.exe
  O4 - HKLM\..\Run: [dufafedit] Rundll32.exe "c:\windows\system32\fopihofu.dll",a
  O4 - HKCU\..\Run: [wykvw] C:\WINDOWS\system32\blydvf.exe reg_run
  O4 - HKCU\..\Run: [Monopod] C:\DOCUME~1\MIRZAT~1\LOCALS~1\Temp\f.exe
  O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
  O4 - HKCU\..\Run: [Windows System Recover!] C:\DOCUME~1\MIRZAT~1\LOCALS~1\Temp\notepad.exe
  O4 - HKCU\..\Policies\Explorer\Run: [{3CC0D40C-0AF0-1033-0302-040717200001}] "C:\Program Files\Common Files\{3CC0D40C-0AF0-1033-0302-040717200001}\Update.exe" te-110-12-0000213
  O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
  O20 - AppInit_DLLs: C:\WINDOWS\system32\cru629.dat c:\windows\system32\papororo.dll c:\windows\system32\fopihofu.dll
  O20 - Winlogon Notify: logqcx - logqcx.dll (file missing)
  O21 - SSODL: zefeyuvey - {d7c24666-992a-412d-bb5e-9b388eac7f57} - c:\windows\system32\papororo.dll
  O21 - SSODL: demokopag - {3ae453ff-08e9-4afd-b0ab-dcdf927f09bf} - c:\windows\system32\papororo.dll
  O21 - SSODL: vofilufeb - {42147456-7842-4b60-9864-f7c05640ea9e} - c:\windows\system32\fopihofu.dll
  O22 - SharedTaskScheduler: ghya673gidh87we9inkff - {BF56A325-23F2-42AD-F4E4-00AAC39CAA53} - C:\WINDOWS\system32\tajf83ikdmf.dll
  O22 - SharedTaskScheduler: mujuzedij - {d7c24666-992a-412d-bb5e-9b388eac7f57} - c:\windows\system32\papororo.dll
  O22 - SharedTaskScheduler: mujuzedij - {3ae453ff-08e9-4afd-b0ab-dcdf927f09bf} - c:\windows\system32\papororo.dll
  O22 - SharedTaskScheduler: jugezatag - {42147456-7842-4b60-9864-f7c05640ea9e} - c:\windows\system32\fopihofu.dll
  O23 - Service: AntipyProex (AntipPro2009_100) - Unknown owner - C:\WINDOWS\svchasts.exe
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

After I restarted my computer, I am unable to find my wireless network. It is not coming up at all. I am using my Ipod touch and seem to have wireless connection, but its not coming up on my PC.

I'm not suprised; I did post a warning that such a thing like this could happen. We can try and repair it, but we may also discover an even worse infection.

Right now, we may be heading down the "format" road, infections like this can cause a lot of damage to the OS.

I really do not know why my connection vanished on my PC, but here my wireless network works. I will try to post MBAM log as soon as I figure out my connection issues, unless you guys can help me get it back. Where do we go from now?

For your safety, I would recommend a format, see here:
http://miekiemoes.blogspot.com/2009/02/virut-and-other-file-infectors-throwing.html

Why go through such drastic measures?! I am really having a hard time believing that this is necessary. Why can't a regular anti-virus program detect this virus and delete it? And if there are no other ways in order to get rid of this virus, can I use a Recovery CD instead of formatting and re-installing OS and XP?

An antivirus is only half the job done, you need to do the other half. When installing things, you need to stop and ask yourself where you got it from? the real website or P2P?

If P2P, then did you scan it before running it? what program did you scan it with? was that program updated?

This is why we offer advise on safe surfing at the end of the topics we work on.

I am really having a hard time believing that this is necessary

It's necessary, damage like this either goes 1 of 2 ways. We fix it with lasting problems, or we don't fix it at all. Which is why I recommend a format, it's safer for you if you do any online banking from this machine.

Can you send me microsofts link on how to format and reinstall?

Instructions how to format and reinstall Windows can be found Here