Windows Police Pro
Windows Police Pro is a rogue anti-spyware program that spreads globally using an illicit Search Engine Optimization practices. Users will be redirected to its fraud website directly from search engine results. This browser hijacking technique can successfully download Windows Police Pro to visitor’s computer by means of script that runs automatically when it senses an entry to its page. This unwanted program infiltrates the system with the help of software weaknesses and security holes, escaping anti-virus detection.
When successfully installed, Windows Police Pro shapes up the registry in such a way that it loads every time Windows starts. Immediately, fake security scan will commence and check up the system for known threats. The rogue application also intervenes with extreme pop-up and alert messages declaring infections and issues isolated on the PC. This deceitful scare tactic is fabricated and requires no attention. It even misinformed victim’s that contamination can be eradicated by obtaining the commercialized full version of Windows Police Pro. Though the program has very convincing endorsement approach, it remains a worthless security product that needs to extract from the system. Deep analysis of computer security experts reveal that Windows Police Pro is incapable of protecting the PC against risks and attacks.
Screen Shot Image:
Technical Details and Additional Information:
Damage Level: Medium
Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7
Added Registry Entries:HKEY_CURRENT_USER\Software\Softimer HKEY_CURRENT_USER\Software\Windows Police Pro HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ANTIPOL HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AntiPol HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WDefend HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "minix32" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "inixs"Associated Files and Folders:
C:\Program Files\Windows Police Pro\ANTI_files.exe C:\Program Files\Windows Police Pro\msvcm80.dll C:\Program Files\Windows Police Pro\windows Police Pro.exe C:\Program Files\Windows Police Pro\tmp\dbsinit.exe C:\Program Files\Windows Police Pro\tmp\wispex.html C:\Windows\svchast.exe C:\Windows\svchasts.exe C:\Windows\svohost.exe C:\WINDOWS\wf3.dat C:\WINDOWS\system32\minix32.exe C:\WINDOWS\system32\dddesot.dll C:\WINDOWS\system32\plugie.dll C:\WINDOWS\system32\pump.exe
How to Remove Windows Police Pro
1. Kill any running process that belongs to Windows Police Pro.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for the following files and click End Task.
windows Police Pro.exe, svchast.exe, svchasts.exe, svohost.exe
2. Delete registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit. This will open registry editor.
- Find and delete the following:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "minix32"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "inixs"
- Close registry editor. Changes made will be save automatically.
3. Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please Update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.
4. Delete all files dropped by Windows Police Pro.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Associated Files and Folders.'
Dan Smith
Aug 31, 2009 @ 10:03:16
I’m seeing a lot of suggestions to run various spyware programs to get rid of this nasty bit of spyware. The problem is that any exe file is blocked from launching by it, so none of these programs can even get started on it. What I’m after, if someone can figure it out, is a way to start up regedit and go from there.
Russell
Aug 31, 2009 @ 22:55:11
The only way I can find into regedit is by right-clicking it and selecting run as administrator. apparently I’m only able open exe’s through the same process but it doesn’t work all he time.
Caution
Sep 01, 2009 @ 20:08:51
I got this virus when trying to upload command.exe & taskmgr.exe to an already infected computer. I wasn’t sure what virus my friend’s PC had, but it would not let me start up the task manager or a command prompt. The virus installed itself onto the flash drive I used and ended up on my computer. It didn’t take me long to find new programs installed on my computer. I had AVG Free, AdAware, & MalwareBytes on my system. AVG picked up Trojan only AFTER I started a full system scan; computer locked up before finishing the scan though. Now, none of my scanning software works. Tried manual deletion didn’t work. Is there another way besides manual & malwarebytes?
David
Sep 01, 2009 @ 22:49:00
Windows Police Pro is blocking all applications on my computer. Not able to download any anti-virus programs or applications period. PLEASE HELP! I beg of you.
Dirk
Sep 02, 2009 @ 10:40:38
When windows is starting up Spam the F8 key. If you see the windows logo, you pressed it too late and need to restart and try again. F8 will bring up a menu in DOS that allows you “repair” your system. Use this route and restore your computer to a previous restore point. I’m doing that as we speak and it seems to be working. Good luck
Dirk Verhoest - Age 19 - Oregon State University Woot Woot!
Sep 02, 2009 @ 11:56:06
Shitty…
Unfortunately my last restore point was after I got the virus… )(*%@ me.
Anyways for those of you in the same boat as me, I’m going to try this idea more manual approach that just kind of came to me.
The original poster listed all the files associated with this virus. I’m doing an advanced search for each of those files on my system. With the advanced search make sure you have the box checked to include hidden and system files. I’ve found most of them and I’m deleting them. Some of them don’t allow you to delete them, but I can effectively disable them by renaming them with a nonexistent file extension.
To do this you need to make sure you can see the file extensions on the files on your computer. You can do this in under Control Panel > Folder options (just search folder option in the search bar once you open control panel). The nice thing about this, is you don’t have to open any exe’s with this approach. That’s the virus’ main weapon. We can hopefully fight it with this approach…moving on though…
So an example of what I’m doing is searching for a file like WindowsPolice.exe and changing it to WindowsPolice.asdfjasiodfj. This way whatever program is executing this file on start-up won’t recognize the file and the virus will fail to initialize.
After you have done this, restart your machine and then do the search over again, but this time delete the files. They won’t be running and you’ll be able to delete them instead of getting the error message that doesn’t allow you to delete them. I hope this helps.
Here are all the files I had to delete or change extension names for:
Window Police Pro Shortcut (deleted)
Windows Police Pro.exe (extension changed)
dddesot.dll (deleted)
desote.exe (extension changed)
svchasts.exe (extension changed)
msvcm80.dll (there A LOT of these I didn’t touch them)
Windows Police Pro Folders (deleted after reboot)
BTW I’m typing this as I’m doing it… rebooting my computer now to see if it worked! (I’m on a second laptop of mine typing this out)
Ok so the virus still started up on reboot but I’m able to delete the files that I changed the extension for. I’m deleting those files. Ok after doing another search for all the I was able to delete every single one. I did not change any of the extension on the msvcm80.dll files or delete any. I’m not 100% sure they are associated with the virus.
AWESOME-NESS! After deleting those files I am now able to run exe’s! I haven’t rebooted yet. I’m going to to download a program called STOPzilla (recommended by VirusRemovalGuru.com for this virus). Once I install and run that program the virus will be off my computer. IF ANYONE FOLLOWS THESE DIRECTION YOU WILL BE ABLE TO BEAT THIS VIRUS! Feel free to send me questions at Dirk_Verhoest @ yahoo.com.
Dirk Verhoest
Sep 02, 2009 @ 12:26:28
Refer to my thread here for A DETAILED guide to removing this virus from someone who got this virus first hand and had to fight it (ME).
Gordon
Sep 02, 2009 @ 21:01:12
I downloaded combofix (only download it from bleepingcomputer.com).
I switched of system restore then ran combofix That fixed the initial problems. I could now install and run MalwareBytes and Spybot Search and Destroy
Steve
Sep 02, 2009 @ 22:11:35
This is how I cleaned it from a thinkpad notebook running XP Pro. start task manager, find windows police pro and right click it and end process, you will have a very short time to run a program, maybe 10 seconds. I ran msconfig (you will get a couple of errors, click okay on them and the program will start. Disable all start-up items and reboot.
Windows police pro will start again, end it in task manager and then run Malwarebytes’ Anti-Malware in the short time that win police pro is not active. You will get a couple of errors again click okay on them and the program should start. Run the scan and it should clean it or quarantine it. After it complete you should delete the Win Police Pro folder. I rebooted and ran the scan a couple of time before i was comfortable that it was clean. You will need to run msconfig again and enable you start-up programs. Good Luck, it worked for me. Steve
Rose
Sep 04, 2009 @ 04:53:02
Thanks Dirk, it worked for me. Stopzilla downloading now.
R
A
Sep 04, 2009 @ 19:26:39
This bug would NOT go away. even after following the directions found on many discussion forums. Based on the dates of the forums I’ve come across, this is a relatively new bug. I ended up taking my laptop to Best Buy and paid $199 to have them remove it. Apparently it was too late because it had already corrupted my operating system. Good luck to everyone trying to exorcise this program! Wish I’d found this thread sooner.
Jim
Sep 05, 2009 @ 03:32:25
Here is a simple fix copy and make a .txt file paste below into it and then change file name to .reg execute 2 files this will let you run all files then do a spy bot clean
REGEDIT4
[HKEY_CLASSES_ROOT\comfile\shell\open\command]
@=”\”%1\” %*”
[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@=”\”%1\” %*”
Reply
coaster
Sep 08, 2009 @ 15:15:58
Dirk, your solution worked like charm!! Thanks. This saved me countless hours.
Kaylee
Sep 08, 2009 @ 21:15:48
Where the heck are all the spyware sales companies with instructions about how to rid oneself of these demonic malwares?
Karma
Sep 09, 2009 @ 22:06:00
To get programs to run without getting an error, right click on the program icon that is on your desktop, go to “Run As…” when the box pops up, unclick the box that says “Protect my computer and data from unauthorized program activity.” This will allow your browser and other programs to open. Then download Malwarebytes anti-malware software and run Quick Scan first, then let it remove what it finds. Then Restart the computer and do a full scan.
Dave
Sep 10, 2009 @ 01:19:08
Hi all,
I used Drews advice & changed the names or deleted those files, but now when I go to run Malware or Spybot I get the Windows box open asking “Choose a program you wish to use to open this file” ? Also, my Windows is stuck in Active Desktop Recovery, and I get an error message saying “Rundll32.exe not found” ?
Help! I’m almost there. Thanks,
Brian
Sep 10, 2009 @ 02:53:04
What do you do if windows doesn’t even properly boot up? I seem to be stuck with no icons or task bar. I’m stuck looking at my desktop wallpaper. I’ve tried booting up in safe mode with no avail and tried starting up from a previous save point. Again to no avail. how can i get this thing to boot up so I can at least try to fix it? Or should I just give up and re-format the thing?
BC
Sep 10, 2009 @ 06:37:40
OK, the easiest way I’ve gotten past this little beast is as follows:
CTRL+SHFT+ESC to bring up your task manager
Select the “Processes” tab
Right click on svchasts.exe & select “End Process Tree”
Right click on Windows Police Pro.exe & select “End Process Tree”
—
You’ll now have about 10 seconds to execute whatever antivirus you want to run or whatever manual steps you want to run through. You may or may not get a couple of errors. If so, just click “OK” and move on. Your program will still execute. For what it’s worth, StopZilla worked without a problem. As an aside, on some systems, I did not need to kill the process tree for Windows Police Pro.exe. Killing svchasts.exe was enough.
—
BC
Sep 10, 2009 @ 06:42:44
Oh yeah, one final note: If you’re going to use software to remove this little nasty, burn it to a CD from a CLEAN PC.
AMT
Sep 10, 2009 @ 16:02:28
Dave I have the same issue as you “Rundll32.exe not found”..Any luck restoring order?
Tricia
Sep 10, 2009 @ 17:55:05
Brian did you find a solution? I also have tried to boot up every which way only to have no start button or icons to do anything being suggested here. I can’t find a solution on the web eithere. Any suggestions?!
Sean
Sep 10, 2009 @ 21:59:09
Thanks for your post Dirk your solution worked
Hey Dave, I had the same problem that you’re having, my exe files didn’t working eithere because desote.exe took control of it. this is the solution i found on another forum
go to start, run, and type command.com
( I DIDN’T FOLLOW THIS LINE) type copy “regedit.exe regedit.com” (with quotes) into the command prompt
it may or may not give you an error.
now (in the command prompt) type regedit.exe
navigate to HKEY_CLASSES_ROOT
\exefile
\shell
\open
\command
In the right pane, double-click the (Default) value. (THE DEFAULT VALUE WILL BE C:WINDOWS\system32\desote.exe “%1″ %* – delete it and replace it with the solution below)
“%1″ %*
Type the above like the following characters:
quote-percent-one-quote-space-percent-asterisk.
restart
Jackie
Sep 11, 2009 @ 01:10:47
So i tried doing Dirk Verhoest’s way but mine didn’t seem to work. My computer keeps showing like this box, then saying “c:\progra~1\symantec\s32evnt1.dll. an installable virtual device driver failed dll initialization. Choose ‘close’ to terminate the application.” It does that for every application or software i try opening. I’m lucky to open Internet from the virus “windows police pro” redirecting me to their site, so yeah. Literally nothing’ll open. So i can’t manually remove it.
So when i tried to do Dirk’s solution, i had all files except for dddesot.dll and svchasts.exe. And the other files i didn’t need to change the extensions. They were able to be deleted. When i rebooted everything, those annoying boxes stopped showing, but still the applications don’t work. A window show up that asks me to “choose the program you want to use to open this file:” then it lists some applications i have, but even when i choose it, it still wont work. PLEASE HELP ME.
Jackie
Sep 11, 2009 @ 01:12:19
Oh and BTW, the svchasts.exe file does show in my processes in the task manager.
DJM
Sep 11, 2009 @ 19:25:30
I had to go into the DOS mode to do my deleting and from C:\ I typed regedit to get into the registry. Glad I leaned DOS before Windows. Anyways, I’m about 90% there but have the same problem as Jackie. No executable file will work or install. I can get windows and outlook now, thankfully. But can’t install or get any spyware program to run, not to mention Mcafee. So I don’t feel particularly secure yet. HELP
CK
Sep 12, 2009 @ 06:40:15
The REGEDIT4 post was the best trick at restoring use of the executable. I’ve been fighting this beast for about 3 days now on many PCs in my shop. This will make the difference being able to get back commands and initiate scans.
Troy
Sep 13, 2009 @ 13:26:08
jiminy christmas!!!! what a pain in the rear. I tried all the solutions posted here. I was able to delete most of the windows police folders without any problems, but it seems some of the remaining portions do a number on the rest of the computer. I was not able to do much until I ran the regedit solution. I am up and running now, pretty unstable, and the spyware programs is running horribly slow, but I think Ive almost got it. This thing is a joke and needs to go away soon!
Molly
Sep 14, 2009 @ 04:53:09
Tried Dirk’s suggestion and it worked- most of it. After deleting & renaming and rebooting, I couldn’t delete some if the folders BUT I was able to run Stopzilla – paid the $10 since the “free” download wouldn’t remove the 140 infected files on my computer. So far so good. Don’t give up you can beat this thing. Thank u Dirk for saving us!
Lorie
Sep 14, 2009 @ 07:56:15
Jackie, I am having the same problem as u. Can’t access any start up files or anything for that matter. I emailed Dirk, waiting for response.
Nikki Suicide
Sep 15, 2009 @ 00:35:20
Get this I logged on one day got tons of pop ups saying “the system file is not suitable for running MS-DOS and Microsoft Windows applications.” I can’t run or download anything! I even get that bloody Windows Police Pro pop up even when I deleted it. I can’t get into control panel or any programs. Someone please help! This crap is giving me a headache. I can’t open any files or download anything so don’t give me links saying “download this it really works!” When I can’t even download.
screaming
Sep 16, 2009 @ 16:43:00
Please help!!! Turned on laptop on 11th and system frozen, with all the advice I was able remove police pro. but had two more programs run after that saying same thing, buy now blah blah , so turned off system to have son finish process and now it is too late, Windows will not start, says I have no operating system, Now what!!!, besides throwing laptop out window, I have tried to start in safe mode — laptop restarts on own again and again. I have all tried all options on F8 command, no luck any suggestions
Michele
Sep 17, 2009 @ 02:18:59
Same issues – several times it let me boot, then after I started reading it would not boot, safe mode just keeps going forever. Tried to boot with Disk – just keeps saying can’t boot in safe mode? Looks like it got the OS – wish I would have read first…. I did find one thread that stated the more you run antivirus the worse it gets.. and it did. So whatever you do read, norton has a fix on their site with the registry files that need to be deleted with the files and a step by step to delete. I did not get to try as my lap top OS got killed first. This thing is nasty.
Rachel
Sep 19, 2009 @ 19:13:04
OH MY! After 4 days/3 nights, at least 100 file searches and regestry searches, 1000 reboots in safe and regular mode, running spyware scanner more times than I can count, I have finally gotten rid of this MF’er.
At the end, I started getting the “choose the program you want to use” message at which time I downloaded the exefix_xp TO MY DESKTOP…the gave it a quick click and 2 seconds later everything was good to go. Thanks everyone for all the help…a combonation of all is what it took.
Gary Granger
Sep 20, 2009 @ 21:32:38
Can I just wipe the hard drive clean and start over?
danvermcnut
Sep 21, 2009 @ 00:56:58
Gary, If you are capable of taking a back-up of your important files then reformatting can be one of the best solution. It will not only remove Windows Police Pro but other virus residing on your computer.
Just dont forget to FDISK before you format your hard drive.
mark
Sep 21, 2009 @ 16:08:37
downloading the exefix to my desktop (http://www.winhelponline.com/exefix_xp.com) was the tool that allowed me to continue untill the WPP was removed. Panic went to shear panic when all my programs stopped exexuting-especially when I couldnt get back to command prompt. The ONLY luck i had was being on line and realizling ‘If I turn this sucker off-she aint coming back’ and so conrtinued.
Be doing some searchingcleaning Im sure…I had downloaded another prgram that found the ugly files but when asked for money to actually fix is when I asked my self why? Spybot didint find it-I hadnt updated in a while, after updating Spybot, it found /fixed most. Still have some registery issues but its all working. I can now clean up the mess-
Sharon
Sep 21, 2009 @ 16:36:43
My computer was infected with windows police after reading various site on what to do. I ended up deleting windows police with IObit Security 360 Scan and remove the deepest malware. Well I rid of the windows police but now I am unable to open any of my programs. The only thing that will open is AOL explorer. Any suggestions?
miked
Sep 21, 2009 @ 16:40:09
thanks to all of the above posts, I was able to rid my machine of windows service pro and personal guard 2009. now I’m left with some issues—-1) it appears the virus changed my admin password, so I can’t repair from my xp disk. 2) I can’t use many of the control panel functions—for example, when I try to open “user accounts” I get a c:\windows\system32\rundll32.exe application not found errorf. the same thing happens when trying to open the System link in control panel. 3) I tried running some of the registry fixes recommended, but every time it gives me a “cannot import…….:error accessing the registry.” error.
I’ve saved my important files to an alternate pc, virus scanned and malware scanned them so they wouldn’t infect the alternate pc.
Now do I have any chance of repairing the problem pc without starting from scratch and reinstalling windows? I’m trying to avoid this if at all possible as I do have several gigs of files/programs that I don’t have enough storage space for and would prefer not to lose them.
thanks for getting this far and thanks in advance for any suggestions.
Scott
Sep 22, 2009 @ 02:52:10
If you can’t run any programs (and cannot open browser to get online to download anti malware software) try doing all this:
If you can get into Task Manager, end the Police Pro processes (try in Safe Mode [press F8 when booting up]). Search for Police Pro files, dddesot.dll and desote.exe and delete them (I was only allowed to actually delete them in Safe Mode.
If .exe files will not run, only giving “choose the program you would like to use to open this bla bla bla” message.
In Start>Run window type: command.com (and Enter), then type: regedit (and Enter)
Look for any of the Police Pro registry items as mentioned in other posts around the net (I could did not find any at this point) but…
I did what Sean said in post above: navigate to HKEY_CLASSES_ROOT\exefile\shell\open\command
In the right pane, double-click the (Default) value. (THE DEFAULT VALUE WILL BE C:WINDOWS\system32\desote.exe “%1? %* – delete it and replace it with the solution below)
“%1? %*
Type the above like the following characters:
quote-percent-one-quote-space-percent-asterisk.
restart
AFTER ALL THIS I COULD LAUNCH FIREFOX TO GET ONLINE TO DOWNLOAD ANTI MALWARE SOFTWARE
John B.
Sep 22, 2009 @ 04:11:51
I was able to get the regedit to work by typing it in the Run box, and then disabling the police pro in the task manager, and then QUICKLY starting the regedit. Once there I found the keys and blasted them. When I couldn’t find anymore keys, I restarted XP in Safemode with no network. Then I was able to navigate to the directory and delete it. Normal boot came back with no police pro, but there was another issue. The Add/Remove software in the Control panel wouldn’t spark the program. It just kinda looked at me. Don’t know if this related or not. I also install IE 8 and the machine seems to be doing better.
Newbie
Sep 22, 2009 @ 12:33:59
I am not knowledgable enough to try these fixes myself so am I am thinking of resorting to take my laptop in to get rid of this virus. Am I reading here that this virus gets worse the longer it is in my system? I am still able to get to AOL/mail which is really all I use my laptop for. Could I lose this ability if I am willing to tolerate clicking off all the PITA pop ups? Any suggestions for big box store (staples,best buy) repair centers? If I pay almost $100 to remove this virus, what is going to prevent it from coming back?
miked
Sep 22, 2009 @ 18:46:19
finally resolved….. After trying to repair with the original windows XP home edition disk several times to no avail, I remembered I had a XP Professional disk from a machine no longer in use. I did an upgrade to XP professional and everything is fine now. machine is now fully up to date. didn’t lose any programs/files. Malware FINALLY doesn’t find any problems. thanks to everyone for their input in the above posts and good luck to anyone else fighting this bug.
Sara
Sep 23, 2009 @ 16:52:52
I got this virus 2 days ago. By the time I figured out what it was, I was not able to get into regedit, the names of the processes were not what I was reading about in forums, and I couldn’t run any programs. I thought my computer was done for.
What I did to get it back, was to look for things in my program files folder and in windows\system32 for things that were created at the time the virus started. It was a very slow process, but I was able to see which were the bad processes. Mine were things called braviax.exe, ~.exe, and wscsvc32. Once I stopped these processes, I was able…again very slowly…to go into explorer and delete these files. Once I did that, I searched for every file that was created the day the virus happened and I went through and systematically deleted every application that was listed. Doing so got my computer to the point where I was able to run my anti-virus scan. After a reboot, I was able to get back on the internet and I downloaded the Malware software. I’ve run three scans with it so far, and it’s finding less and less each time. Hopefully, it will get itself completely clean, but I feel like I at least have control of my computer back. I’m probably going to just take off all of my pics, music, documents etc. and then wipe the drive clean and start over. Just take your time, it will let you delete the files, it just may take a while.
Robert
Sep 25, 2009 @ 06:03:22
I deleted a number of WPP files in safe mode. I still could not run malwarebytes. Used Sean’s command prompt technique and got malwarebytes running. The wife and daughter managed to gathere many infections. I deleted those and the last “desote” and I am back to normal. I am typing this on my computer which I do not allow them to use.
Repeat of Sean’s contribution
go to start, run, and type command.com
( I DIDN’T FOLLOW THIS LINE) type copy “regedit.exe regedit.com” (with quotes) into the command prompt
it may or may not give you an error.
now (in the command prompt) type regedit.exe
navigate to HKEY_CLASSES_ROOT
\exefile
\shell
\open
\command
In the right pane, double-click the (Default) value. (THE DEFAULT VALUE WILL BE C:WINDOWS\system32\desote.exe “%1? %* – delete it and replace it with the solution below)
“%1? %*
Type the above like the following characters:
quote-percent-one-quote-space-percent-asterisk.
restart
Jack
Sep 25, 2009 @ 20:28:14
1) Get PrevX or other malware remover – probably have to DL on another machine and xfer on disk or memory stick.
2) Reboot in safe mode with network assist.
3) Install malware remover.
GONE
Jody
Sep 26, 2009 @ 05:54:35
I have a system running XP-x64 (64 bit XP) and I was infected. I have XP on another drive in this machine, so I am able to read posts and check email on the other drive. I downloaded malwarebytes and it removed the files, but I cant run all of my programs. It will no longer connect to the internet, though it says I am connected to the network from that drive. When I try to open most programs, it says it can’t find ws2_32.dll the file is in it’s correct location but has been corrupted. Any suggestions???
janet
Sep 27, 2009 @ 00:17:30
i was able to remove this virus by keeping the task manager open, and continuously hitting end task on the police pro, as i opened system restore, thru window help and support. after restoring the system, i was able to download and install mallwarebytes, and run it! virus gone!
justin
Sep 28, 2009 @ 20:27:16
For everyone wondering how to get rid of windows police pro this is how I did it. It actually took me 2 days to figure out but here it is. First boot up in safe mode with command prompts. Type in c:\windows\system32\restore\rstrui.exe this will allow you to do a system restore, restore your system to the earliest date possible. Once restored you should have your desktop icons back and your bottom toolbar. Now you can open task manager, end the processes called Windows Police Pro.exe and svchasts.exe. Then go to search for files and folders and search for any file with police in it and delete them. Next you need to delete these registry files HKEY_CURRENT_USER\Software\Microsoft\Win… “Windows Police PRO”
HKEY_CURRENT_USER\Software\Windows Police PRO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\… Police PRO
To delete registry files go to run and type in regedit. Now most of the police pro virus should be gone but you won’t be able to run any anti-malware or spyware programs because you will be left with a very nasty rootkit called max++. The only way to get rid of this rootkit is to download Combofix. Run Combofix and the rootkit should be gone. Now you can download Malwarebytes and run that program to clean up anything else left by the virus. Any questions don’t hesitate to ask.
ANge
Oct 01, 2009 @ 23:10:15
What should I do if none of my safe-modes actually work? I cannot get into task manager, it doesn’t work when I enter regedit into RUN, I can’t restore it to a safer mode, I can’t delete the WPP files because it says that it is running. I can’t get into my add or delete files folder. This is my boyfriends computer…and I think I RUINED it!
John
Oct 03, 2009 @ 15:14:10
In XP PRO when you gp to start, then Run, type in msconfig and hit enter. The very last tab is TOOLS click on that and you can start Regedit, add remove and several other programs that are blocked
Dyllan
Oct 06, 2009 @ 01:05:41
Ok I’m F$%ing PI$$ed At this Rogue Well I have already had Malaware installed but trying to open it sucks bc you get Blocked. So i click ” Run As ” There is 2 options Default and run as someone different, Well i just UNCHECKED! The Box and Malaware popped up and now im Doing a Full Scan, This Worked On Anti Virus System Pro, And Anti Virus System Pro 2009, So i’m sure it will work,
Larry
Oct 07, 2009 @ 19:23:56
There will be special place in hell for the turds that devise this crap.
That said this is my experience with Police Pro and what appears to be a successful effort to rid my computer of it.
Similar to other posts, once infected, Safe Mode was disabled and XP Pro would boot to a blank desk top with no task bar and the Police Pro windows persistently exhorting me to take action.
Unlike other posters, I discovered that CTL-ALT-DEL would bring up a functional task manager.
Fortunately I had access to my wife’s uninfected laptop. I discovered comprehensive removal instructions at the following address:
hxxp://www.bleepingcomputer.com/virus-removal/remove-windows-police-pro
In preparation for attacking my computer, I did the following:
1. I downloaded the Malware Bytes Anti-Malware set-up file onto my flash drive.
2. I ran the set-up on both my wife’s laptop and on my flash drive.
3. I ran Anti-Malware on my wife’s computer to see how it worked.
4. I ran it on my flash drive to verify that it was clean.
5. I downloaded both of the executable files from bleepingcomputer onto my flash drive.
6. I booted the infected computer and brought up the task manager.
7. I then started to follow the bleepingcomputer instructions.
8. In my case, the killed tasks stayed killed. Police Pro didn’t rear it’s ugly head again.
9. I used the run command in task manager to run both of the executables.
10. I then tried to run Anti-Malware from my flash drive. It didn’t work. I believe there were some error messages.
11. I then ran the Anti-Malware set-up. It did work and successfully installed on my computer.
12. The last thing it asks is if you want to run it. I erroneously ran the full scan. It took a little over an hour, found over 90 files that were subsequently quarantined (not all of which were Police Pro).
13. I re-booted and had a restored desk top and seemingly no problems.
14. I ran Anti-Malware again on quick scan and picked up another five files.
All of this has seemed to have worked. There are recommendations that users employ at least two different ant-malware programs. Their algorithms are usually different and they can turn up infections the other misses.
Hope this helps. I feel your pain.
Jim
Oct 08, 2009 @ 17:16:40
I have been fighting this thing for hours and finally used Larry’s approach. downloaded Anti-Malware from an uninfected computer to a flash drive and then opened the flash drive on the infected computer. It seems to have worked. Thanks Larry!!
Paradise
Oct 10, 2009 @ 02:03:11
Ok, I am digging all the post; however, I just can’t seem to get the right direction in this frustrating Police Virus/Malware. When I boot up the computer, all I get is a blank desktop, when I do a control alt delete to bring up task manage I get “Task Manager cannot be run it has been disabled by the Administrator”. I have removed the drive and run all the above mentioned virus/malware scans on it and cleaned it all up. But with the same results.
Could someone please point me in the right direction. At this point I am stuck because I have nothing but BLANK. I can’t even hit F1 to get a screen to navigate through the system.
Thank you everyone!!!
new
Oct 12, 2009 @ 15:11:00
ok now that im reading all these comments after its to late for me i read into this virus and bought the police program. now what do i do? How do i get my money back?
Steve
Oct 13, 2009 @ 20:29:04
COMBO FIX did it removed rootkit. after I opened controle panel and searched
for Windows Police renamed it and downloaded Combo Fix
all is well now
Pualei
Oct 15, 2009 @ 23:46:06
First, open up your Task Manager (control, alt & delete), then end the Windows Police Pro process. Also end the svchast.exe process. Then go to RUN, and type regedit to edit your registry. Do edit find Windows Police Pro and delete those entries. Then you should be able to access the AVG or StopZilla websites, download and install their programs, do a scan and remove the infection.
THis WORKS!!!! but it’s really hard to do you have to keep trying to do this, the virus won’t just give in. Keep closing pop-ups in task manager (PROCESSES AND APPLICATIONS) repetitively. Keep trying to run regedit!!! ( in the run task in the start menu). Search for police pro. Keep closing pop ups and keep searching for files until Stopzilla allows you to download it. ( Stopzilla.com). If it won’t download keep going into regedit and keep searching for police pro. Then wipe it out!!!!!! This is the 8th way I tried and it finally worked!! I’m soooooo happy!!!!! October 15th 2009
Sigmundd and Pasmar
Oct 18, 2009 @ 22:59:45
Thank you I solved! :)
KontrA
Oct 20, 2009 @ 09:52:44
same problem, only i am no unable to even get to windows, i am stuck in a constant loop, that no matter what i choose (safe/normal, etc.) it just immediately restarts & gets to the choices again, setup is supposed to boot from cd rom first, however it will not. as i have my respawn cd in the drive, and it does not boot first…
im fine with reformatting at this point, i’d rathere have a blank computer than none at all… please for the love of all that is holy, help! >.<
Doug
Oct 20, 2009 @ 16:36:29
Sorry – accidently posted some html tags.
My wife somehow picked up this virus last night. It would not let me run any apps (even in safe mode, although I could get regedit by running safe mode with command prompt), but I was able to access task manager (ctrl-alt-del). I noticed the process SVOHOST.EXE (not SVCHAST.EXE) – once I killed that and WindowsPolice.exe I was able to run a system restore to the previous day and got rid of it.
mikey
Oct 21, 2009 @ 15:31:12
Ugh-none of these suggestions in this or other forums have worked. I can’t work in safe mode, can’t access task manager, can’t access i-explorer, anti malware, spyware, virus apps. won’t run from a flash drive. I can’t delete all files manually (only some even after renaming), can’t get regedit or msconfig to work – the thing’s totally handcuffed me. I’m giving up after trying everything for hours on end. How do you wipe the HD clean again ? I’m sort of an amateur and haven’t used MS-DOS cmds in years…
lynn
Dec 23, 2009 @ 18:02:52
I’ve found that if u re-start your comp and select the virus scanner as soon as it reboots it gives u a minute window for the scanner to open and start before the virus starts blocking all software, i’ve also found its the only time i can get the task manager to open is when the computer initially boots.