Windows Police Pro
Windows Police Pro is a fake antivirus program that displays false scan reports informing you that your computer is infected with various forms of malware. This misleading software will tell the user that he or she needs to purchase the full version of the software to remove these threats.
Methods of infection/variants
This fraudulent program is promoted through dangerous Trojans, hijacked browsers, and from anti-malware scanners. It is fairly easy to determine that you have the virus, because you will be shown the warning pop-ups.
Symptoms of infection
Windows Police Pro gives unrealistic warnings from the Windows Security Center when downloaded onto the computer so that the user believes that the software is real and that their computer is legitimately infected with malware. This rogue program prevents any access to real antivirus programs, which can lead to the worsening of the state of the computer system; and can also dramatically delay the speed of the computer. Windows Police Pro also hijacks your web browser. Windows police pro gives you several warnings and alerts such as :
"Your computer continues to be infected with harmful viruses. In order to prevent permanent loss of your information and credit card data theft please activate your antivirus software. Click here to enable protection."
"svchost.exe has encountered a problem and needs to close. We are sorry for the inconvenience."
"Your computer is being attacked by an Internet Virus. It could be password-stealing attack, a trojan-dropper or similar."
Windows Police Pro Registry Entries
HKEY_CURRENT_USER\Software\Softimer
HKEY_CURRENT_USER\Software\Windows Police Pro
HKEY_CLASSES_ROOT\CLSID\{425882B0-B0BF-11CE-B59F-00AA006CB37D}
HKEY_CLASSES_ROOT\CLSID\{77DC0B63-1535-4ba9-8BE8-D59EB676FA02}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects {77DC0B63-1535-4ba9-8BE8-D59EB676FA02}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ANTIPOL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AntiPol
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WDefend
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AntipPro2009_100
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "minix32"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "inixs"
Windows Police Pro files
c:\Program Files\Windows Police Pro\ANTI_files.exe
c:\Program Files\Windows Police Pro\msvcm80.dll
c:\Program Files\Windows Police Pro\svcm80.dll
c:\Program Files\Windows Police Pro\msvcp80.dll
c:\Program Files\Windows Police Pro\msvcr80.dll
c:\Program Files\Windows Police Pro\windows Police Pro.exe
c:\Program Files\Windows Police Pro\tmp\
c:\Program Files\Windows Police Pro\tmp\dbsinit.exe
c:\Program Files\Windows Police Pro\tmp\wispex.html
c:\Program Files\Windows Police Pro\tmp\images\
c:\Program Files\Windows Police Pro\tmp\images\i1.gif
c:\Program Files\Windows Police Pro\tmp\images\i2.gif
c:\Program Files\Windows Police Pro\tmp\images\i3.gif
c:\Program Files\Windows Police Pro\tmp\images\j1.gif
c:\Program Files\Windows Police Pro\tmp\images\j2.gif
c:\Program Files\Windows Police Pro\tmp\images\j3.gif
c:\Program Files\Windows Police Pro\tmp\images\jj1.gif
c:\Program Files\Windows Police Pro\tmp\images\jj2.gif
c:\Program Files\Windows Police Pro\tmp\images\jj3.gif
c:\Program Files\Windows Police Pro\tmp\images\l1.gif
c:\Program Files\Windows Police Pro\tmp\images\l2.gif
c:\Program Files\Windows Police Pro\tmp\images\l3.gif
c:\Program Files\Windows Police Pro\tmp\images\pix.gif
c:\Program Files\Windows Police Pro\tmp\images\t1.gif
c:\Program Files\Windows Police Pro\tmp\images\t2.gif
c:\Program Files\Windows Police Pro\tmp\images\up1.gif
c:\Program Files\Windows Police Pro\tmp\images\up2.gif
c:\Program Files\Windows Police Pro\tmp\images\w11.gif
c:\Program Files\Windows Police Pro\tmp\images\w2.gif
c:\Program Files\Windows Police Pro\tmp\images\w3.gif
c:\Program Files\Windows Police Pro\tmp\images\w3.jpg
c:\Program Files\Windows Police Pro\tmp\images\wt1.gif
c:\Program Files\Windows Police Pro\tmp\images\wt2.gif
c:\Program Files\Windows Police Pro\tmp\images\wt3.gif
C:\Windows\svchast.exe
C:\Windows\svchasts.exe
C:\Windows\svohost.exe
c:\WINDOWS\wf3.dat
c:\WINDOWS\wf4.dat
c:\WINDOWS\system32\minix32.exe
C:\WINDOWS\system32\dddesot.dll
c:\WINDOWS\system32\nuar.old
c:\WINDOWS\system32\plugie.dll
c:\WINDOWS\system32\pump.exe
c:\WINDOWS\system32\skynet.dat