Stuff attached itself to computer, help if possible. (game, server, sounds)

[DontCallMeLizzy]

A couple weeks ago, the 17th if Im not mistaken, 'XP Police Antivirus' installed istelf onto my computer. The thing it is was just sudden, nothing had been downloaded or installed manually up to the day XP Police attacked it. When me and my cousin went in and switched it to safe mode and deleted almost everything that came with it, the documents folder is empty and we tried to restore it to a month earlier and it won't at all let us restore to any date. Also, some of the things that attached itself to it are the stupid 'smstrap', 'VPcasino', and a few other things, I tried to see what they were but it's in Safe Mode. I don't think it will let us turn on the computer regularily now, I haven't checked.
So the thing is, how can I fix all of it and make it go back to the way it was?

[NoLoveLost]

This should walk you though how to remove it. Once you remove it then, see if you can get your data back. trying to get it back with a virus on your computer is going to be impossible......

How to Remove XP Police Antivirus (Removal) For XP/Vista

[DontCallMeLizzy]

Thank you! I'll work with this later on tonight and see how it goes.

[NoLoveLost]

Originally Posted by DontCallMeLizzy

Thank you! I'll work with this later on tonight and see how it goes.

Good luck!

[visualevo]

Becareful with this part:
Remove XP Police Antivirus Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\run ieupdate


Make sure you get exactly that one.

Other thing in that link... Do NOT, repeating NOT, download spyhunter. It is about as good as the original game spyhunter. 100% worthless.

[Brian.Pearson]

Originally Posted by NoLoveLost

This should walk you though how to remove it. Once you remove it then, see if you can get your data back. trying to get it back with a virus on your computer is going to be impossible......

How to Remove XP Police Antivirus (Removal) For XP/Vista

For some reason that link is not working for me. I tried three browsers. I did find what may be a cached version.

[visualevo]

Originally Posted by Brian.Pearson

For some reason that link is not working for me. I tried three browsers. I did find what may be a cached version.

I assume you tried to actually copy the link itself?

xp-vista.com/spyware-removal/xp-police-antivirus

xp-vista.com is a very nice site for all kinds of things involving XP/Vista.

[NoLoveLost]

Originally Posted by Brian.Pearson

For some reason that link is not working for me. I tried three browsers. I did find what may be a cached version.

I didn't have any trouble, but it may be because I use a Mac ...lol ..just kidding....

Not sure why you couldn't open it.....

[mossomo]

Originally Posted by Brian.Pearson

For some reason that link is not working for me. I tried three browsers.

Your browser is highjacked. You are mostly likely SOL.

You might be able to recover but this is a particulary nasty infection. Call the Department of Justice and report the website and their host. Recently pushed legistation makes it an undeniable crime to purposely push this app to clients via the Internet.

If anyone else has the misfortunes off stumbling into a XP Police enabled website, power your computer down immediately. Unless you're IT and know what you're doing press and hold the power button until your machine cuts off. Do not click start/shutdown nor start/restart. Hold power.

First thing you'll want to try, do a system restore. If you're successful you may be alright. I'd look for similiar symptoms that you previously experienced after it's installation. I'd then look in my program files for xp police folder, if's there double click to see if the folder has any files. It's bad if the folder has files. And if the folders there, the files are probaly there as well.

If you can't do a system restore or find the folder/files. Turn of your system restore. If not, XP Police likes to hide files there and restore itself. Nasty bastard.

I'd search the reg for XP Police and remove all keys/values which reference. Additionally, the link you cant hyperlink says to remove this registry value:
HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\run ieupdate

The link also advises to delete the following files. If you get a mssg that the file is in use, find yourself a delete application that deletes anything and everything. Delete these files:

XPPolice.exe
c:\Program Files\XPPoliceAntivirus
c:\Program Files\XPPoliceAntivirus\AVCoreFn.dll
c:\Program Files\XPPoliceAntivirus\bdconf.cfg
c:\Program Files\XPPoliceAntivirus\Core.dll
c:\Program Files\XPPoliceAntivirus\setup.dat
c:\Program Files\XPPoliceAntivirus\xppolice.exe
c:\Program Files\XPPoliceAntivirus\Plugins
c:\Program Files\XPPoliceAntivirus\Plugins\ceva_dll.cvd
c:\Program Files\XPPoliceAntivirus\sounds
c:\Program Files\XPPoliceAntivirus\sounds\alert.wav
c:\Program Files\XPPoliceAntivirus\Plugins\ceva_emu.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\ceva_vfs.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\ceva_vfs.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\cevakrnl.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\cevakrnl.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\cevakrnl.rvd
c:\Program Files\XPPoliceAntivirus\Plugins\cookie.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\cran.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\cran.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\e_spyw.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\e_spyw.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\emalware.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\gvmscripts.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\hpe.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\java.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\mdx_97.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\mdx_97.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\mdx_w95.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\mdx_x95.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\mdx_xf.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\mobmalware.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\na.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\nelf.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\regarch.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\regscan.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\rup.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\sdx.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\sdx.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\unpack.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\unpack.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\vb0.dat
c:\Program Files\XPPoliceAntivirus\Plugins\vb1.dat
c:\Program Files\XPPoliceAntivirus\Plugins\vb2.dat
c:\Program Files\XPPoliceAntivirus\Plugins\ve.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\ve.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\vedata.cvd
c:\Program Files\XPPoliceAntivirus\sounds\click.wav
c:\Program Files\XPPoliceAntivirus\sounds\fire.wav
%UserProfile%\Desktop\XP Police Antivirus.LNK
%UserProfile%\Start Menu\XP Police Antivirus.LNK


After deleting those files, install, update and scan with my favorite trifecta:
spybot
adaware
avg

Good luck.

[Brian.Pearson]

Originally Posted by visualevo

I assume you tried to actually copy the link itself?

xp-vista.com/spyware-removal/xp-police-antivirus

xp-vista.com is a very nice site for all kinds of things involving XP/Vista.

I just clicked it and got one of these:

Failed to Connect

Firefox can't establish a connection to the server at For XP/Vista....

Then I copied it and pasted it to the URL box -- same result.

I even told FF to make it an allowed site. No dice.