Fun times with Windows Police Pro.

[Asezat]

Hey. First of all, I guess I should apologise for making another thread on this nasty little piece of malware, given that there's a few already on here. But, none of the info in any of them could help me, and I was loath to hijack one of them with my own complaint, so here I am.

I'm running XP, SP2.

I'm writing from my laptop at the moment, as it's virtually shut down my tower PC.

I picked it up a few days ago, and after a good few hours of struggling with it, I've managed to get rid of the annoying popups, and the actual interface is gone too. However, the rootkit and the nasty little trojans that came with it are still on the PC. The task manager no longer shows any programs running that shouldn't be, initially there was "WindowsPolicePro.exe" and "svchast.exe". Having said that, there are two streams of random numbers in there, along the lines of "0.038538587632.exe". These can be closed down by ending the process tree, but doing that seems to have no effect on the computer. To begin with, these were listed as having been started by me, under my user name, but now they're listed as "SYSTEM". I don't know if that means anything or nothing, but it bothers me.

The computer itself has been slowed down by this to such a degree that it's essentially non-functional. It takes almost 10 minutes to boot up. More irritating, however, is that it's now completely unable to open any exe files, at all. Nothing works, Windows just states that I haven't got the permissions to open the file. This includes regedit and msconfig. I can get into My Documents, and My Computer, but I can't open or view any files. Nor can I open my AV, or any anti-spyware. Unfortunately, this also means that I can't provide any logs for HijackThis, or MalwareBytes, for which I apologise. I don't have a flash drive to get them onto the affected PC, either :(.

I also can't get the damn thing into Safe Mode. I don't know if that's down to the virus or not, but as soon as I get into the mode selection screen, my keyboard stops working, and I have to hit the reset button on the front of the tower.

I think that's all the information I can provide, I know it isn't what's mentioned in the sticky at the top of the forum, but I can't conform to that at the moment :(.

I have one more question: As mentioned above, I have no flash drive, but I do have a USB HD that I use to back stuff up from time to time. In the event that I can't fix this, and have to reformat, would it be possible to connect that up and transfer some files onto it before I restart the machine over? Or would the virus just infect the external HD too? I don't even know if it will let me do that in it's current state, but it's worth a try, I guess.

Thank you for reading my long essay. Any help at all would be much, much appreciated. Thanks again!

[R1pperZ]

Hello Asezat and welcome to the thrills and spills that are WPP, unfortunetely I have been in this same position a couple weeks ago. I was able to get my system back to normal and im no computer specialist so don't panic.

The thing is though from the sound of things your system seems to be reacting differently after your malware removel attempts. You might have made things worse since it seems you have removed the anoying pop-ups but the system sounds like its pretty much locked up.

In order for the people here to help you, you will need to explain every step you took to remove the processes so far. The first step is to post logs so we know whats going on but if your unable to gain acces to those we will need to know how to get you back to that state.

Best of luck, -R1p

[PhilliePhan]

The computer itself has been slowed down by this to such a degree that it's essentially non-functional. It takes almost 10 minutes to boot up. More irritating, however, is that it's now completely unable to open any exe files, at all.. . . .

Are you able to access the internet and download files with the ill computer? I know you can'trun programs, but can you download them?

I have no flash drive, but I do have a USB HD that I use to back stuff up from time to time. In the event that I can't fix this, and have to reformat, would it be possible to connect that up and transfer some files onto it before I restart the machine over? Or would the virus just infect the external HD too? I don't even know if it will let me do that in it's current state, but it's worth a try, I guess.

There is a good chance that any re-writable media will get infected.
-- Are you able to burn tools onto a CD if I gave you a list of what we need?
-- Why not purchase a cheap flash drive?
-- If it came to it, we could back up your files to your external drive, but you do run the risk of infecting it.

Let me know where you stand.

If youare able to download to the ill machine, please download FindWPP.zip and RightClick on FindWPP.zip and Extract the FindWPP folder to your Desktop.
-- Inside the folder, you'll see RunThis.bat - DoubleClick it and let it run for as long as it takes.
A log should pop up - please post that for me.

-- I should note that, while we could probably make some progress with tools on a CD, a flash drive would allow us more flexibility. Yes, it runs the risk of getting infected, but we can run some tools from it.......

Cheers :)
PP

[Asezat]

The thing is though from the sound of things your system seems to be reacting differently after your malware removel attempts. You might have made things worse since it seems you have removed the anoying pop-ups but the system sounds like its pretty much locked up.

Hey, I'm glad you managed to sort your comp out, at least it gives me a bit of hope for fixing my own. So far, almost everything I've done was immediately after I was infected, before I rebooted. It's pretty simple stuff, all it was was going into the "Windows Police Pro" file in the program files and deleting the actual program in there. After I'd done that, I rebooted to try and get into safe mode, and that was when the real problems hit me. Prior to the reboot, although the system had immediately slowed right down, I hadn't suffered any exe lockout.Are you able to access the internet and download files with the ill computer? I know you can't run programs, but can you download them?

There is a good chance that any re-writable media will get infected.
-- Are you able to burn tools onto a CD if I gave you a list of what we need?
-- Why not purchase a cheap flash drive?
-- If it came to it, we could back up your files to your external drive, but you do run the risk of infecting it.

Let me know where you stand.

If you are able to download to the ill machine, please download FindWPP.zip and RightClick on FindWPP.zip and Extract the FindWPP folder to your Desktop.
-- Inside the folder, you'll see RunThis.bat - DoubleClick it and let it run for as long as it takes.
A log should pop up - please post that for me.

-- I should note that, while we could probably make some progress with tools on a CD, a flash drive would allow us more flexibility. Yes, it runs the risk of getting infected, but we can run some tools from it.......

Cheers :)
PP

I can't get onto any of my browsers, so unfortunately downloading onto the infected PC directly is out of the question for now. What I can do, though, is burn files from here onto a CD and then try running them on the computer, though I don't know if it will let me. If you can give me a list of what to pick up, I'll get right on it.

I'm not sure how to actually get you logs from my main PC onto here, unless one of the tools is an AV, though.

Regarding a flash drive, I've never needed one until now. If you think it's important I'll get a cheap one on monday (damn sunday trading laws!), but I'm kind of loath to risk infecting it and possibly spreading the infection, if there's a good chance of that. The same goes for my external HD, really. Having said that, I'll do what has to be done.

Thank you both for your responses :).

[PhilliePhan]

Hey, I'm glad you managed to sort your comp out..... After I'd done that, I rebooted to try and get into safe mode, and that was when the real problems hit me. Prior to the reboot, although the system had immediately slowed right down, I hadn't suffered any exe lockout.

This baddie comes in different flavors and different degrees of difficulty. Most often, there is a rootkit component that makes removal a bear.....What I can do, though, is burn files from here onto a CD and then try running them on the computer, though I don't know if it will let me. If you can give me a list of what to pick up, I'll get right on it. Great! We can try that - You'll need three CDs. I'll post the list at the bottom of this post.I'm not sure how to actually get you logs from my main PC onto here, unless one of the tools is an AV, though. That's where the Flash Drive comes into play. Allows give and take from the ill machine. Plus, we can run combofix from the flash drive...Regarding a flash drive, I've never needed one until now. If you think it's important I'll get a cheap one on monday (damn sunday trading laws!), but I'm kind of loath to risk infecting it and possibly spreading the infection, if there's a good chance of that. The same goes for my external HD, really. Having said that, I'll do what has to be done.
Well . . they are inexpensive for a few gigs which is all you'll need.
You'll have to do a little "cost/benefit analysis."

Truth be told, I generally recommend a reformat in these cases. 'Course that depends upon a number of factors, the biggest usually being whether a user has their Windows OS Disk. XXXXXXXXXXXXXXXXXXXXXXXXXXXXX

OK - Here are the tools you'll need - I'm assuming you'll pick up a Flash Drive:

FIRST: Download and Install ImgBurn if you do not already have it on your machine.

THEN: Download the Avira Rescue System.ISO and use ImgBurn to burn the ISO onto a CD.

NEXT: Download Trinity Rescue Kit.ISO and use ImgBurn to burn the ISO to a second CD

FOR THE THIRD CD:
• http://ad13.geekstogo.com/Win32kDiag.exe
• http://swandog46.geekstogo.com/avenger.zip
• http://www.bleepingcomputer.com/combofix/how-to-use-combofix
With combofix, what I want you to do, though, is this:
When you download it and it asks you to "Save File As," rename combofix to Combo-Fix and then download it to working compy and put it on the CD.
• FindWPP.zip
• DDS by sUBs and save it to your Desktop
• http://download.sysinternals.com/Files/Junction.zip
• http://www.raktor.net/exeHelper/exeHelper.com
• http://download.bleepingcomputer.com/sUBs/MiniFixes/Inherit.exe
• SysProt Anti-Rootkit

I know it seems like a lot, but I like to cover all bases..... :)

NEXT: Repeat the step for the third CD and put all those programs on your Flash Drive

Post back when you are all set (or if you have any questions).
I am usually around in the evenings (EST) working on other things but will keep an eye on this thread.

Cheers :)
PP

[PhilliePhan]

NEXT: Download Trinity Rescue Kit.ISO and use ImgBurn to burn the ISO to a second CD

In re-acquainting myslef with TRK, I realize that I should've added that ideally this should be on a Re-Writable CD, if possible.

PP :)

[Asezat]

Ok, well, everything is downloaded, burnt, and I'm ready to go. I believe Trinity is on a re-writable CD/DVD, too.

I do have one slight possible problem, though. I note that both Avira and Trinity say that I might have to go into the BIOS and change the boot order to allow me to boot from the CD. Two and a half to three years back, I had an issue with the PC refusing to start, and a friend advised me to pop the little battery out of the motherboard and then put it back in, which I duly did. It fixed that particular problem, but when I started the PC up again, the start-up sequence had totally changed. It now informs me each time that "BIOS is not installed". It's never been a problem, until now, Windows starts fine, etc, but I'm a little concerned. Will that be an issue?

Thanks!

[PhilliePhan]

Ok, well, everything is downloaded, burnt, and I'm ready to go. I believe Trinity is on a re-writable CD/DVD, too.

Great! - Trinity offers 4 AV scanners, but only Clam is onboard. It needs to update and download and rewrite itself. This is a legit option that uses freeware as opposed to pirated software.
(I wish they would add an option for MBAM or combofix to be downloaded and run...)I do have one slight possible problem, though. I note that both Avira and Trinity say that I might have to go into the BIOS and change the boot order to allow me to boot from the CD. .....Will that be an issue?
I doubt it - that message is not referring to your "system BIOS" - probably looking for a drive controller. Not a big worry at this time.
-- With any luck your compy will detect the CD on startup and offer the option to boot from it. We'll cross that bridge when we come to it.
Those CDs are strictly a last option in the event that nothing else works - Hopefully we'll not have to use them. (they are good to have around, though - hold onto them)

Let's start with the CD with all the tools on it.
-- See if you are able to transferFindWPP to the ill computer.
RightClick on FindWPP.zip and Extract the FindWPP folder to your Desktop. Hopefully you won't be blocked from doing that.
-- Inside the folder, you'll see RunThis.bat - DoubleClick it and let it run for as long as it takes.

If the log pops up, save it to the Desktop and then copy it to Flash Drive and post it for me.

Even if that step does not work, go ahead and try this as well:

Move Win32kDiag.exe from the CD to the Desktop.
-- DoubleClick on Win32kDiag.exe to run it. Let it run for as long as it needs to.
-- When it says Finished – Press any key to exit, do that to exit the program.
-- You should now have a Win32kDiag.txt on your Desktop. Please copy to flash drive and post the entire log for me and we’ll go from there.
Be sure to let it run until is says "Finished" before posting the log!

-- Are you able to get a command prompt on ill computer?
Either START > Run >type cmd > OK
or
START > Run >type command.com > OK

-- I suspect we are in very different timezones which may slow us a bit. I am on Eastern Standard Time (GMT-4) and generally around in the evenings.

Anyhoo, let me know if those tools could be run and about command prompt.

Best Luck :)
PP

[Asezat]

Ok, well, I stuck the thrid CD into the drive and fired it up, and it let me read the CD. Having said that, before I could start actually extracting and running the programs, it froze up, and I had to restart the computer. When I went to try again, to my surprise, the CD was empty. Apparently I used a re-writable CD, and whatever it is that's on the computer is either deleting whatever's on it, or making it appear as though it has. I haven't tried running them from the flash drive because I'm still worried about infecting my laptop, too.

I had no joy with "cmd", but "command.com" does bring up the DOS prompt, which is encouraging.

Regarding timezones, I'm in the UK so I'm on GMT, and your afternoon is my evening. I would normally be around then, but due to work issues I haven't been recently, unfortunately. I should be tonight, though.

Thanks!

[PhilliePhan]

I had no joy with "cmd", but "command.com" does bring up the DOS prompt, which is encouraging.

That should come in handy.

-- Do this: Open a command prompt and typeexactly as I have here in red:
dir /s %windir%\eventlog.dll > "%userprofile%\desktop\logit.txt" & hit ENTER

Logit.txt will be on the desktop - I need to see that, however possible.
I just need the various paths to eventlog.dll and the exact size in bytes for each. You'll not need to copy everything.

-- One of the options I was keeping in reserve in the event that nothing else works (nothing could be transferred to the Desktop of ill compy an then run) is to run Combofix directly from the flash drive.

Perhaps we should go ahead and try that? What do you think?
You won't be able to update it, but it should run and make some progress. Let me know if you want to jump ahead and try that.

But before that, give me the eventlog.dll info.

PP :)

[Asezat]

I copied that exact command into the prompt, twice, and each time it said "The system cannot find the file specified". Logit.txt did appear, but it was empty.

-- One of the options I was keeping in reserve in the event that nothing else works (nothing could be transferred to the Desktop of ill compy an then run) is to run Combofix directly from the flash drive.

Perhaps we should go ahead and try that? What do you think?
You won't be able to update it, but it should run and make some progress. Let me know if you want to jump ahead and try that.

I'll try whatever you think will work.

[PhilliePhan]

I'll try whatever you think will work.

We should probably try burning the tools onto a non-rewritable disk (not the ISOs, just the disk of tools). That way, we can use command line to copy them to desktop. Let me know if that is workable.

I am a little reluctant to try the flash drive just yet - I am fairly certain the malware has replaced the legit eventlog.dll and once we deal with that, we can make some headway with tools on the desktop. We just need to get them on there.

What happens when you type the following command at the prompt:dir /s %windir%\eventlog.dll

Note it is dir /s %windir%\eventlog.dll

If error there, try:
sc stop "eventlog" ENTER

What happens?

If error there, try:
sc config "eventlog" start= disabled ENTER

What happens?

PP :)

[Asezat]

I'm not sure if I have any non-rewritable CD's at the moment. I actually spent the best part of an hour looking earlier on, because I thought I did.

Of the three comands, the first gives the "system cannot find the file" response.

The second gives "[SC] ControlService FAILED 1052: The requested control is not valid for this service."

The third: "[SC] ChangeServiceConfig SUCCESS".

[PhilliePhan]

The third: "[SC] ChangeServiceConfig SUCCESS".

Good - that's what I thought. It can't be stopped, but it can be disabled.

At the prompt, typesc query "eventlog" and tell me what the State is.
If it is still running, we'll need to reboot and then repeat the query to make sure it is not running.
('course, I am assuming this is replaced file - usually it is, but there have been others)

Then, let's try to copy FindWPP and Win32kDiag.exe to the desktop again. If you can't copy and paste, try the copy command.

Assuming external drive is, say, G:\ the command would be:
copy G:\Win32kDiag.exe "%userprofile%\desktop"
copy G:\FindWPP.zip "%userprofile%\desktop"

Obviously, if not G:\ , you'll need to change accordingly.

Let's see how that works.

Sorry about the delay - doing 10 things at once here :)
PP

[Asezat]

The state initially was "4 RUNNING", after a reboot it's "1 STOPPED".

I've just tried to copy the files off the CD normally again, the whole thing froze before I even could get into the CD, this time. When I cleared it, Explorer crashed and forced another reboot.

After that reboot, I tried to copy from the CD using the script, and it just says "Incorrect function."

[PhilliePhan]

After that reboot, I tried to copy from the CD using the script, and it just says "Incorrect function."

Well . . . crap. It's not making things easy, is it?
-- You did change the source directory to the correct letter (probably D or E:\), right? (sorry - gotta check)

Try to copy them from the flash drive.If that does not work, let's go ahead and try to run combofix from the flash drive. You'll not be able to update it, but run it anyway - If it runs, post the log.

PP :)

[Asezat]

I did initially have the wrong source directory letter >.> but I fixed it before I made the post.

I managed to get the files off the flash drive with no apparent problems, but it won't let me run Win32kDiag. Same error, not the required permissions. I haven't touched FindWPP, though.

[PhilliePhan]

I managed to get the files off the flash drive with no apparent problems, but it won't let me run Win32kDiag. Same error, not the required permissions. I haven't touched FindWPP, though.

-- Can you RightClick on it andRun as Administrator?

-- Did you try command prompt?
type %userprofile%\desktop\win32kdiag.exe ENTER

-- Can you RightClick and extract the FindWPP folder from the ZIP to the desktop?

PP :)

[Asezat]

I can run Win32Diag as admin, but it first says that it can't get the desktop directory, and then "error: could not create log file <13>". Then it shuts itself down.

Yep, it let me extract FindWPP.

[PhilliePhan]

Yep, it let me extract FindWPP.

OK - RunRunThis.bat in the FindWPP folder and see if it runs. If the log pops up, save it to the desktop. Put it on the re-writable disc to transfer it, if possible.

PP :)