twolfcorner2009 0 Newbie Poster

Just wanted to post where/how I figured out my gf got this on her computer. After stopping the svchasts.exe and windows police pro processes in task manager; I used file assassin to delete all of the files in the program folder. I then restarted the computer, which it popped up a bunch of error dialogue boxes stating the directory of all of the executable files that start during boot and blocked them; however all of the pop ups associated with the program were non existent anymore, obviously meaning the reg keys were still there. I then ran MBAM and it found 7 reg keys and backdoor trojans that I removed. It prompted me to restart the computer, however, instead of doing it immediately I wanted to get Avira Anti Virus onto her computer so that once it rebooted, if it were still on the network it would have some sort of defense. I opened Internet Explorer on her computer, and that seemed to trigger a new opening of the Windows Police Pro pop up. She was using an outdated version, IE 7. It looks like she got it through one of the many security issues in Internet Explorer and it lodged itself somewhere in either the Temp Internet Files or the program file itself. Just a heads up to anyone still using IE, I'd def recommend using Firefox or Google Chrome or installing new windows updates (which my gf often neglected to do). Hopefully this helps someone out there! (For all of my programs I installed onto her computer, I downloaded the .exe files onto a flash drive on a separate computer and then ran them off of that and installed them to her computer that way. Downloaded all the files at www.download.com).

In short, her computer is Windows Police Pro and other malware free, hope this helps someone with this problem!

Dani AI

Generated

Good work by — removing running executables is only half the battle. Rogue “scareware” commonly installs persistence in multiple places (startup keys, scheduled tasks, fake services, drivers, browser plugins) and can leave a backdoor behind. The checklist below fills gaps that often lead to reinfection after an apparent cleanup.

  • Work offline and, if possible, boot into Safe Mode before modifying startup items.
  • Enumerate every startup location with Sysinternals Autoruns. Uncheck suspicious entries, then use “Jump to” to inspect the Registry value before deleting.
  • Inspect Task Scheduler, Services (services.msc) and drivers for unfamiliar names; examine the hosts file and the NIC DNS settings for unauthorized changes.
  • Reset browsers to defaults, remove unknown extensions, and clear temporary Internet/cache files and profiles.
  • Before editing the Registry, export a backup of the key or create a system image so you can roll back if needed.

Validate the system and repair Windows components from an elevated command prompt:

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

Follow those with an offline/rootkit-capable scan (bootable rescue media) if available. If a remote-access backdoor or hidden persistence cannot be confidently removed, image user data and perform a clean install — that is the most reliable way to ensure the machine is safe.

Prevention notes: keep the OS and browser patched, run daily work from a non-admin account, use a modern browser with script/ad blocking, and maintain regular backups. The technique of installing tools from a known-clean machine is sound; add a persistence sweep and system-file validation to avoid surprises after the first apparent cleanup.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.