I am so happy to have found this site. Out of nowhere, "windows police pro" appeared on my computer this morning and I have no idea how to get rid of it. I checked several sites, learning that it was a rogue, and I really don't understand the instructions given. I hope that someone with some patience can help me. I am running windows xp and I currently use Avast. I have tried to start the computer in safe mode but I have no idea what to do once I get there. Oh please help. Oh thank you.
Please download exeHelper to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com) Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).
NEXT
Please save Win32kDiag to your desktop.
Double-click on it to run a scan.
When it's finished, there will be a log called Win32kDiag.txt on your desktop.
Please open it with notepad and post the contents here.
exeHelper by Raktor - 09
Build 20090916
Run at 09:27:55 on 09/21/09
Now searching…
Checking for numerical processes…
Checking for bad processes…
Killed process svchast.exe
Killed process windows Police Pro.exe
Checking for bad files…
Found file C:\WINDOWS\system32\desot.exe
Deleting file C:\WINDOWS\system32\desot.exe
Found file C:\Program Files\Windows Police Pro\Windows Police Pro.exe
Deleting file C:\Program Files\Windows Police Pro\Windows Police Pro.exe
Found file C:\WINDOWS\system32\dddesot.dll
Deleting file C:\WINDOWS\system32\dddesot.dll
Found file C:\WINDOWS\ppp3.dat
Deleting file C:\WINDOWS\ppp3.dat
Found file C:\WINDOWS\ppp4.dat
Deleting file C:\WINDOWS\ppp4.dat
Found file C:\WINDOWS\system32\sysnet.dat
Deleting file C:\WINDOWS\system32\sysnet.dat
Resetting filetype association for .exe
Resetting filetype association for .com
–Finished–
is this what I needed to post?
In the right panel, you will see several boxes that have been checked. Uncheck the following …
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-07-30.01)
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 2/19/2009 7:25:09 PM
System Uptime: 9/21/2009 7:59:06 AM (3 hours ago)
Motherboard: ASUSTek Computer INC. | | Guppy
Processor: Intel® Celeron® CPU 3.06GHz | PGA 478 | 3066/133mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 142 GiB total, 125.054 GiB free.
D: is FIXED (FAT32) - 7 GiB total, 1.252 GiB free.
E: is CDROM ()
G: is Removable
H: is Removable
I: is Removable
J: is Removable
==== Disabled Device Manager Items =============
Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}
Description: Camera
Device ID: USB\VID_046D&PID_092F\5&5D907CC&0&2
Manufacturer:
Name: Camera
PNP Device ID: USB\VID_046D&PID_092F\5&5D907CC&0&2
Service:
==== System Restore Points ===================
RP152: 9/21/2009 5:59:18 AM - System Checkpoint
RP153: 9/21/2009 5:59:18 AM - System Checkpoint
RP154: 9/21/2009 5:59:18 AM - System Checkpoint
RP155: 9/21/2009 5:59:19 AM - System Checkpoint
RP156: 9/21/2009 5:59:20 AM - System Checkpoint
RP157: 9/21/2009 5:59:20 AM - System Checkpoint
RP158: 9/21/2009 5:59:20 AM - System Checkpoint
RP159: 9/21/2009 5:59:21 AM - System Checkpoint
RP160: 9/21/2009 5:59:21 AM - System Checkpoint
RP161: 9/21/2009 5:59:22 AM - System Checkpoint
RP162: 9/21/2009 5:59:22 AM - System Checkpoint
RP163: 9/21/2009 5:59:23 AM - System Checkpoint
RP164: 9/21/2009 5:59:23 AM - System Checkpoint
RP165: 9/21/2009 5:59:23 AM - System Checkpoint
RP166: 9/21/2009 5:59:24 AM - System Checkpoint
RP167: 9/21/2009 5:59:25 AM - System Checkpoint
RP168: 9/21/2009 5:59:25 AM - System Checkpoint
RP169: 9/21/2009 5:59:25 AM - System Checkpoint
RP170: 9/21/2009 5:59:26 AM - System Checkpoint
RP171: 9/21/2009 5:59:26 AM - System Checkpoint
RP172: 9/21/2009 5:59:26 AM - System Checkpoint
RP173: 9/21/2009 5:59:27 AM - System Checkpoint
RP174: 9/21/2009 5:59:27 AM - Software Distribution Service 3.0
RP175: 9/21/2009 5:59:27 AM - System Checkpoint
RP176: 9/21/2009 5:59:27 AM - System Checkpoint
RP177: 9/21/2009 5:59:27 AM - System Checkpoint
RP178: 9/21/2009 5:59:27 AM - Removed LEGO Star Wars II
RP179: 9/21/2009 5:59:28 AM - System Checkpoint
RP180: 9/21/2009 5:59:28 AM - System Checkpoint
RP181: 9/21/2009 5:59:28 AM - System Checkpoint
RP182: 9/21/2009 5:59:28 AM - System Checkpoint
RP183: 9/21/2009 5:59:28 AM - System Checkpoint
RP184: 9/21/2009 5:59:29 AM - System Checkpoint
RP185: 9/21/2009 5:59:29 AM - System Checkpoint
RP186: 9/21/2009 5:59:30 AM - System Checkpoint
RP187: 9/21/2009 5:59:30 AM - System Checkpoint
RP188: 9/21/2009 5:59:30 AM - Software Distribution Service 3.0
RP189: 9/21/2009 5:59:30 AM - System Checkpoint
RP190: 9/21/2009 5:59:31 AM - System Checkpoint
RP191: 9/21/2009 5:59:31 AM - System Checkpoint
RP192: 9/21/2009 5:59:32 AM - System Checkpoint
RP193: 9/21/2009 5:59:32 AM - System Checkpoint
RP194: 9/21/2009 5:59:32 AM - System Checkpoint
RP195: 9/21/2009 5:59:33 AM - System Checkpoint
RP196: 9/21/2009 5:59:33 AM - System Checkpoint
RP197: 9/21/2009 5:59:33 AM - System Checkpoint
RP198: 9/21/2009 5:59:34 AM - System Checkpoint
RP199: 9/21/2009 5:59:34 AM - System Checkpoint
RP200: 9/21/2009 5:59:34 AM - System Checkpoint
RP201: 9/21/2009 5:59:35 AM - System Checkpoint
RP202: 9/21/2009 5:59:37 AM - Software Distribution Service 3.0
RP203: 9/21/2009 5:59:39 AM - System Checkpoint
RP204: 9/21/2009 5:59:39 AM - System Checkpoint
RP205: 9/21/2009 5:59:39 AM - System Checkpoint
RP206: 9/21/2009 5:59:39 AM - Software Distribution Service 3.0
RP207: 9/21/2009 5:59:40 AM - Installed Java™ 6 Update 15
RP208: 9/21/2009 5:59:42 AM - System Checkpoint
RP209: 9/21/2009 5:59:43 AM - System Checkpoint
RP210: 9/21/2009 5:59:43 AM - System Checkpoint
RP211: 9/21/2009 5:59:44 AM - System Checkpoint
RP212: 9/21/2009 5:59:44 AM - System Checkpoint
RP213: 9/21/2009 5:59:45 AM - System Checkpoint
RP214: 9/21/2009 5:59:45 AM - System Checkpoint
RP215: 9/21/2009 5:59:46 AM - System Checkpoint
RP216: 9/21/2009 5:59:47 AM - System Checkpoint
RP217: 9/21/2009 5:59:48 AM - Software Distribution Service 3.0
RP218: 9/21/2009 5:59:49 AM - System Checkpoint
RP219: 9/21/2009 5:59:51 AM - System Checkpoint
RP220: 9/21/2009 5:59:52 AM - System Checkpoint
RP221: 9/21/2009 5:59:54 AM - System Checkpoint
RP222: 9/21/2009 5:59:54 AM - System Checkpoint
RP223: 9/21/2009 5:59:56 AM - System Checkpoint
RP224: 9/21/2009 5:59:57 AM - System Checkpoint
RP225: 9/21/2009 5:59:59 AM - System Checkpoint
RP226: 9/21/2009 6:00:01 AM - System Checkpoint
RP227: 9/21/2009 6:00:05 AM - System Checkpoint
RP228: 9/21/2009 6:00:09 AM - System Checkpoint
RP229: 9/21/2009 6:00:11 AM - System Checkpoint
RP230: 9/21/2009 6:00:15 AM - System Checkpoint
RP231: 9/21/2009 6:00:18 AM - Software Distribution Service 3.0
RP232: 9/21/2009 6:00:20 AM - System Checkpoint
RP233: 9/21/2009 6:00:21 AM - System Checkpoint
RP234: 9/21/2009 6:00:23 AM - System Checkpoint
RP235: 9/21/2009 6:00:24 AM - System Checkpoint
RP236: 9/21/2009 6:00:27 AM - System Checkpoint
RP237: 9/21/2009 6:00:30 AM - System Checkpoint
RP238: 9/21/2009 6:00:31 AM - System Checkpoint
RP239: 9/21/2009 6:00:33 AM - System Checkpoint
RP240: 9/21/2009 6:00:37 AM - System Checkpoint
RP241: 9/21/2009 6:00:39 AM - System Checkpoint
RP242: 9/21/2009 6:00:42 AM - System Checkpoint
==== Installed Programs ======================
Adobe Acrobat - Reader 6.0.2 Update
Adobe AIR
Adobe Anchor Service CS4
Adobe Bridge CS4
Adobe CMaps CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Drive CS4
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Illustrator CS4
Adobe Linguistics CS4
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Reader 6.0.1
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Type Support CS4
Adobe Update Manager CS4
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
Agere Systems PCI Soft Modem
avast! Antivirus
BufferChm
Connect
Copy
Cortona3D Viewer
CP_AtenaShokunin1Config
cp_dwSharkTaleAlbums1
cp_dwSharkTaleCards1
cp_dwShrek2Albums1
cp_dwShrek2Cards1
CP_PLSBusinessFlyers
CreativeProjects
CreativeProjectsTemplates
CueTour
Destinations
Director
DocProc
DocumentViewer
Google Toolbar for Internet Explorer
Help and Support Additions
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
HP Boot Optimizer
HP Help and Support 4.0
HP Image Zone 4.8.6
HP Software Update
HpSdpAppCoreApp
HPSystemDiagnostics
InstantShare
Intel® Extreme Graphics Driver
IntelliMover Data Transfer Demo
J2SE Runtime Environment 5.0
Java™ 6 Update 15
KBD
kuler
LEGO Star Wars II
Lexmark Supplies Monitor
Lexmark Z23-Z33
LS_HSI
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mozilla Firefox (3.5.3)
MSXML 4.0 SP2 (KB954430)
muvee autoProducer 4.0
PanoStandAlone
PC-Doctor for Windows
PDF Settings CS4
PhotoGallery
Photoshop Camera Raw
PrintScreen
PS2
QFolder
QuickProjects
QuickTime
ScannerCopy
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SkinsHP1
Suite Shared Configuration CS4
TrayApp
Unload
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
WebFldrs XP
WebReg
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3
==== Event Viewer Messages From Past Week ========
9/21/2009 9:27:58 AM, error: Service Control Manager [7034] - The AntiPol service terminated unexpectedly. It has done this 1 time(s).
9/21/2009 6:58:25 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 AFD aswSP aswTdi Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
9/21/2009 6:58:25 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
9/21/2009 6:58:25 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
9/21/2009 6:58:25 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
9/21/2009 6:58:25 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
9/21/2009 6:57:41 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
9/21/2009 6:57:38 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
9/17/2009 4:01:00 AM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
==== End Of File ===========================
OK I have GMER opened, I unchecked Sections, IAT/EAT, and show all. I don't see Drives/Partition other than Systemdrive, I see "files", C is checked, D is not, is that what I am looking for?
never mind I see it
![[external image: Posted Image]](http://i266.photobucket.com/albums/ii277/sUBs_/Gmer_initScan.gif){kind=link}