Sorry to be so long-winded here but I am looking for assistance with the removal of Windows Police Pro after trying to complete a few steps on my own first. Computer belongs to a friend of mine and is currently running Win. XP. Computer is also running AVG anti-virus which was set to update automatically and as of a couple weeks ago, it had updated versions of MalwareBytes, Spybot S&D and Adaware loaded although the owner is very inconsistent with updating and running these utilities that I have loaded for his protection and allows several of his small children to use this machine. They are prone to clicking on any banner that flashes or moves on the screen when they are playing kids games online so there is no telling what else we may encounter here. Could likely be multiple issues.
When I received the machine and took a look at it, the Window Police Pro window appeared upon start-up showing it's fake virus scan window followed by a message saying that the computer was infected with 30+ viruses along with at least a dozen error messages. The first significant hurdle that I discovered after getting into it was that this infection seems to prevent the user from opening & running all of the above mentioned utilities. Actually Spybot shows up in the taskbar indicating that it loaded at start-up but it will not allow you to run a scan. When trying to open and run MalwareBytes, I obtained the following error message:
"Windows cannot access the specified device, path or file. You may not have the appropriate permission to access the item."
I tried uninstalling Malwarebytes, and then re-loading a fresh copy from a USB storage device since I don't have this machine hooked up to an internet connection to download it. It let me re-install it but with no connectivity I couldn't update it. As soon as I tried to run it after the install though, it started up normally but then within about five seconds of the scan beginning, it disappeared and the scan window and program seemed to close all by itself. When I tried to run it again, I received the same error message above about not having the appropriate permission. Then it thawrted my attempt at renaming the malwarebytes mbam.exe file as well. When i tried to rename it, it told me that the file could not be re-named.
Surprisingly, I soon discovered that it would allow me to at least get to windows task manager and stop it's process from running. Within a few seconds to upwards of a minute though, it would restart automatically and the Windows Police Pro window would come back again. After a few repetitive tries, I was finally able to stop it and get SuperAntispyware downloaded. The only way that I could get it started was to rename it by changing the .exe to .com After the scan, it came back with the following results:
I also found another suspicious program running in taskmngr named Desote.exe. I ended that program and after a quick search I found this program located in the system32 folder and deleted it manually.
After the requested restart by SuperAntispyware, the Windows Police Pro window is gone. I'm now left with two RunDLL errors that appear now. The message indicates that there was an error loading the following two items and the specified modules could not be found:
& also something called tapi.nfo
Since none of the other installed utilities would run even after this scan, I tried to run SuperAntispyware again. It will start it's scan and it quickly indicates that Rootkit.Agent/Gen-Skynet is still alive and well. If I let this program run for more than about 4-5 minutes as it continues looking for problems, it will eventually quit all by itself and just disappear before finishing the scan. I tried running it again and stopping it right AFTER it located the Rootkit.Agent/Gen-Skynet but BEFORE it was finished so it wouldn't get forced closed again. I allowed the program to remove this item and did the restart but it came right back again.
I successfully installed hijack this and upon running it to try and obtain a log for reference purposes, it closed all by itself as well and there appears to be no log that was stored. Now it won't let me run it again.
This thing has kicked my butt. Without the ability to use any of these utilities that I have I am at a loss for what to do next. Hopefully someone with more experience can help me get rid of this problem. I will say this upfront...the owner of this machine recently moved and has been unable to locate the Windows XP back-up disc that came with the machine when they purchased it new several years ago so i'm not sure that reformatting is an option. Also, I don't really have a way to connect the problem pc to the internet as it is sitting on my dining room table while I try to repair it. Therefore, I will have to download any repair programs to it via the USB storage device that I am using.
I apologize again for the long explanation here. I just want to provide any potential helpers with as much info as possible upfront especially since I have made several attempts to fix this problem. Thanks for reading and thanks in advance for any help that may be offered.