Multiple XP problems from malware

I run Windows XP with SP3 and McAfee spyware protection. Nevertheless, I got
hit with the malware "Windows Police Pro" and accidentally installed its
"Protection System" software today (I should have known better). I was able
to eliminate both programs and their associated folders and files, as far as
I can tell. However, the process involved cleaning up the registry, where I
tried my best to be careful. Although the buffer overload from the malware is
now gone, I am left with the following symptoms:

- Sometimes during bootup, the screen would lock into full black with just
the pointer showing. I can only consistently bootup in the safe mode.
- In any bootup mode, I get a rundll32.exe error when bootup is completed.
- In any bootup mode, I cannot run EXE files (including regedit and
msconfig) and always get the "Open with.." window. However, in the safe mode,
I can run regedit by running command.com and going the DOS route.
- In regular bootup mode, I get an error message when I try to run IE. In
safe mode, I simple get the "Internet Explorer cannot display the webpage"
webpage.
- Surprisingly, there doesn't seem to be a problem opening Word files.

I am not sure if any part of my cleanup cause the problems. I was careful to
delete items is the registry that specifically said "Police Pro" and
"Protection System" or had other names that other forums identified. Is their
any way to easily fixed this without having to buy more anti-spyware software?

Thanks,
Slam

Slam wrote:
I run Windows XP with SP3 and McAfee spyware protection. Nevertheless, I got
hit with the malware "Windows Police Pro" and accidentally installed its
"Protection System" software today (I should have known better). I was able
to eliminate both programs and their associated folders and files, as far as
I can tell. However, the process involved cleaning up the registry, where I
tried my best to be careful. Although the buffer overload from the malware is
now gone, I am left with the following symptoms:

- Sometimes during bootup, the screen would lock into full black with just
the pointer showing. I can only consistently bootup in the safe mode.
- In any bootup mode, I get a rundll32.exe error when bootup is completed.
- In any bootup mode, I cannot run EXE files (including regedit and
msconfig) and always get the "Open with.." window. However, in the safe mode,
I can run regedit by running command.com and going the DOS route.
- In regular bootup mode, I get an error message when I try to run IE. In
safe mode, I simple get the "Internet Explorer cannot display the webpage"
webpage.
- Surprisingly, there doesn't seem to be a problem opening Word files.

I am not sure if any part of my cleanup cause the problems. I was careful to
delete items is the registry that specifically said "Police Pro" and
"Protection System" or had other names that other forums identified. Is their
any way to easily fixed this without having to buy more anti-spyware software?

Thanks,
Slam

Try the following freewa

MBAM: http://www.malwarebytes.org/ Use in "Normal Mode"
SAS: http://www.superantispyware.com/ Use in "Safe Mode"

Post a reply to this thread with your progress.

--
1PW

Before going to those freeware sites, I was able to fix the rundll32 and the
"Open with..." EXE problem by fixing the EXE association in the registry (EXE
files were associate with "desoto.exe", one of the malware files I had
already deleted). Now I am able to consistently perform a regular boot with
no rundll32 error. However, I still have the following problems:
- Once I am in windows XP after a regular boot, everything locks up
including the cursor.
- In safe mode, nothing happens when I try to start MalwareBytes's
Anti-Malware software which I installed before the rundll32 error was fixed.
I had downloaded it as a .COM file instead of .EXE file.
- In safe mode, nothing happens when I try to install SUPERantispyware, as
both EXE and COM files.
- Still can't get on internet in safe mode.
Any suggestions? Thanks!

--
Regards,
Slam


"1PW" wrote:

Slam wrote:
I run Windows XP with SP3 and McAfee spyware protection. Nevertheless, I got
hit with the malware "Windows Police Pro" and accidentally installed its
"Protection System" software today (I should have known better). I was able
to eliminate both programs and their associated folders and files, as far as
I can tell. However, the process involved cleaning up the registry, where I
tried my best to be careful. Although the buffer overload from the malware is
now gone, I am left with the following symptoms:

- Sometimes during bootup, the screen would lock into full black with just
the pointer showing. I can only consistently bootup in the safe mode.
- In any bootup mode, I get a rundll32.exe error when bootup is completed.
- In any bootup mode, I cannot run EXE files (including regedit and
msconfig) and always get the "Open with.." window. However, in the safe mode,
I can run regedit by running command.com and going the DOS route.
- In regular bootup mode, I get an error message when I try to run IE. In
safe mode, I simple get the "Internet Explorer cannot display the webpage"
webpage.
- Surprisingly, there doesn't seem to be a problem opening Word files.

I am not sure if any part of my cleanup cause the problems. I was careful to
delete items is the registry that specifically said "Police Pro" and
"Protection System" or had other names that other forums identified. Is their
any way to easily fixed this without having to buy more anti-spyware software?

Thanks,
Slam

Try the following freewa

MBAM: http://www.malwarebytes.org/ Use in "Normal Mode"
SAS: http://www.superantispyware.com/ Use in "Safe Mode"

Post a reply to this thread with your progress.

--
1PW

You stated "the process involved cleaning up the registry."

Which particular process are you talking about? Please post a link to
the instructions, if possible.

FYI, this guide is fairly comprehensive:

http://www.bleepingcomputer.com/viru...ows-police-pro

Sometimes it is necessary to rename programs after being hit with
malware for them to work. For instance, you might need to rename
mbam.exe to slam.exe .

Also, in your other post, you stated:

"I had downloaded it as a .COM file instead of .EXE file."

What exactly do you mean by that? Where did you download it
(mbam-setup.exe, presumably) from and do you mean you renamed it before
you clicked on Save? Did you use *another* PC to download the
installation file? If not, that's what you should do and copy it to a CD
or external hard drive (flash drive is okay) and copy it again to your
infected PC in Safe Mode.


Slam wrote:
I run Windows XP with SP3 and McAfee spyware protection.
Nevertheless, I got hit with the malware "Windows Police Pro" and
accidentally installed its "Protection System" software today (I
should have known better). I was able to eliminate both programs and
their associated folders and files, as far as I can tell. However,
the process involved cleaning up the registry, where I tried my best
to be careful. Although the buffer overload from the malware is now
gone, I am left with the following symptoms:

- Sometimes during bootup, the screen would lock into full black with
just the pointer showing. I can only consistently bootup in the safe
mode.
- In any bootup mode, I get a rundll32.exe error when bootup is
completed.
- In any bootup mode, I cannot run EXE files (including regedit and
msconfig) and always get the "Open with.." window. However, in the
safe mode, I can run regedit by running command.com and going the DOS
route. - In regular bootup mode, I get an error message when I try to
run IE. In safe mode, I simple get the "Internet Explorer cannot
display the webpage" webpage.
- Surprisingly, there doesn't seem to be a problem opening Word files.

I am not sure if any part of my cleanup cause the problems. I was
careful to delete items is the registry that specifically said
"Police Pro" and "Protection System" or had other names that other
forums identified. Is their any way to easily fixed this without
having to buy more anti-spyware software?

Thanks,
Slam

I'm having ALL of the exact same problems as the Original Poster but the
problem is that I am NOT AT ALL technologically inclined. I have a hard time
reading responses to these things because I don't know what things are like
"able to fix the "open with..." exe problem by fixing the EXE association in
the registry"

I have no clue what that means so I have no chance of fixing MY problem.


I'm running Windows XP. I got hit with the Windows Police Pro malware along
with a couple of others all at once (pro antivirus remover, total security,
etc.) but when I tried to fix it myself (I know, I know, big mistake) I just
deleted ALL exe files created on that specific date. I thought surely nothing
important would have been created on that day...so I deleted them all and now
I get the Rndll32 error when I start up windows. Also, it won't let me open
add/remove programs (application not found) and every time I click on an icon
on my desktop to open things like firefox or Chrome...skype, limewire, etc.
It gives me the "Open With..." menu and I have to go through and find the
program that it needs


Anyways, any help you could give me at all would be greatly appreciated. I'm
a college student and my laptop is my lifeline. If I can't get it working I'm
royally screwed.


Best Wishes,

Ashley

By your own admission, you are in no position to repair your computer
from a malware attack. If someone on campus can't fix it for you, you'll
have to bring your computer to a professional.
---
Leonard Grey
Errare humanum est

Knight wrote:
I'm having ALL of the exact same problems as the Original Poster but the
problem is that I am NOT AT ALL technologically inclined. I have a hard time
reading responses to these things because I don't know what things are like
"able to fix the "open with..." exe problem by fixing the EXE association in
the registry"

I have no clue what that means so I have no chance of fixing MY problem.


I'm running Windows XP. I got hit with the Windows Police Pro malware along
with a couple of others all at once (pro antivirus remover, total security,
etc.) but when I tried to fix it myself (I know, I know, big mistake) I just
deleted ALL exe files created on that specific date. I thought surely nothing
important would have been created on that day...so I deleted them all and now
I get the Rndll32 error when I start up windows. Also, it won't let me open
add/remove programs (application not found) and every time I click on an icon
on my desktop to open things like firefox or Chrome...skype, limewire, etc.
It gives me the "Open With..." menu and I have to go through and find the
program that it needs


Anyways, any help you could give me at all would be greatly appreciated. I'm
a college student and my laptop is my lifeline. If I can't get it working I'm
royally screwed.


Best Wishes,

Ashley

On Wed, 30 Sep 2009 13:10:02 -0700, Knight
wrote:


I'm running Windows XP. I got hit with the Windows Police Pro malware along
with a couple of others all at once (pro antivirus remover, total security,
etc.) but when I tried to fix it myself (I know, I know, big mistake) I just
deleted ALL exe files created on that specific date. I thought surely nothing
important would have been created on that day...so I deleted them all and now
I get the Rndll32 error when I start up windows. Also, it won't let me open
add/remove programs (application not found) and every time I click on an icon
on my desktop to open things like firefox or Chrome...skype, limewire, etc.
It gives me the "Open With..." menu and I have to go through and find the
program that it needs


Anyways, any help you could give me at all would be greatly appreciated. I'm
a college student and my laptop is my lifeline. If I can't get it working I'm
royally screwed.


Sorry to tell you that there's a very good chance you're royally
screwed. You say that you "got hit with the Windows Police Pro malware
along with a couple of others all at once." Any time you have multiple
malware infections at once there's an excellent chance that the only
solution is a clean reinstallation of Windows.


--
Ken Blake, Microsoft MVP (Windows Desktop Experience) since 2003
Please Reply to the Newsgroup