XP Police Antivirus Descriptions:
XP Police Antivirus, or simply known as XP Police, is created by some bad people who try to ruin the integrity of our computing experience. XP Police is not what we normally see in our life where policemen are the protection to our daily life. In reality, the opposite is true. XP Police is the culprits. It is ironic to see this happens again and again, without much intervention from the government. Guess we are living in an usual world and nothing really surprises us anymore. Generally, XP Police Antivirus usually comes up after you installed a video codec that come with Trojan, malware and virus. XP Police Antivirus normally generates fake and misleading system popup error messages such as “Trojan Detected! A piece of malicious code was found in your system which can replicate itself if no action is taken. Click here to have your system cleaned by XP Police Antivirus.” What this does is to trick the innocent people like you to spend money and purchase XP Police Antivirus, which is the real spyware itself. Don’t fall into the trap!
It is more important that ever to remove all the components of of the XP Police Antivirus, and all the malware and trojans that it might have come bundle with (such as zlob.trojan, trojan.vundo and Trojan.Downloader). We don’t want someone spying on our digital life, do we? To effectively and safely remove XP Police Antivirus, we have created a manual removal instructions. Be sure to back the data up before proceeding. Good luck!
Download SpyHunter* Spyware Detection Utility
Manual XP Police Antivirus Removal Instructions:
Stop XP Police Antivirus Processes:
(Learn how to do this)
XPPolice.exe
Find and Delete these XP Police Antivirus Files:
(Learn how to do this)
XPPolice.exe
c:\Program Files\XPPoliceAntivirus
c:\Program Files\XPPoliceAntivirus\AVCoreFn.dll
c:\Program Files\XPPoliceAntivirus\bdconf.cfg
c:\Program Files\XPPoliceAntivirus\Core.dll
c:\Program Files\XPPoliceAntivirus\setup.dat
c:\Program Files\XPPoliceAntivirus\xppolice.exe
c:\Program Files\XPPoliceAntivirus\Plugins
c:\Program Files\XPPoliceAntivirus\Plugins\ceva_dll.cvd
c:\Program Files\XPPoliceAntivirus\sounds
c:\Program Files\XPPoliceAntivirus\sounds\alert.wav
c:\Program Files\XPPoliceAntivirus\Plugins\ceva_emu.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\ceva_vfs.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\ceva_vfs.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\cevakrnl.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\cevakrnl.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\cevakrnl.rvd
c:\Program Files\XPPoliceAntivirus\Plugins\cookie.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\cran.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\cran.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\e_spyw.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\e_spyw.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\emalware.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\gvmscripts.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\hpe.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\java.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\mdx_97.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\mdx_97.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\mdx_w95.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\mdx_x95.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\mdx_xf.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\mobmalware.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\na.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\nelf.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\regarch.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\regscan.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\rup.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\sdx.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\sdx.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\unpack.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\unpack.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\vb0.dat
c:\Program Files\XPPoliceAntivirus\Plugins\vb1.dat
c:\Program Files\XPPoliceAntivirus\Plugins\vb2.dat
c:\Program Files\XPPoliceAntivirus\Plugins\ve.cvd
c:\Program Files\XPPoliceAntivirus\Plugins\ve.ivd
c:\Program Files\XPPoliceAntivirus\Plugins\vedata.cvd
c:\Program Files\XPPoliceAntivirus\sounds\click.wav
c:\Program Files\XPPoliceAntivirus\sounds\fire.wav
%UserProfile%\Desktop\XP Police Antivirus.LNK
%UserProfile%\Start Menu\XP Police Antivirus.LNK
Remove XP Police Antivirus Registry Values:
(Learn how to do this)
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run ieupdate
Hi. I had just got my broadband fixed and was suddenty struck by this f*kng XP police. Needless to say it was too naked to be recognised as a patrolman besides I had a few windows which were actually askng me to screw my system and make it available for the trojans. Its surprising that such viruses continue to screw our happiness and nothing can be done. I had quick heal installed luckily. I had to reboot my system and when the system started to load Quick Heal confirmed a few exe file to be trojans and hence quarantined them. I was reading the entire blog while going out to dine with my family today on Valentines day. Thank you every one for helping me get the XP Police out. I wish I could hang those bastards!!!!
A few files I had to delete they were amvo.exe and cogad.exe from my processes. I hope I have cleaned everything.
I have three User accounts on the laptop:
Admin
User 1
User 2
User 1 and User 2 were non-admin, but I changed them to admin so Thunderbird would update properly.
It was while they were admin that XP Police was allowed to be installed.
Question:
Would XP Police have been able to install itself if the user accounts (as opposed to the Admin account) had been non-Admin instead of Admin?
The only way I was able to recover was because I logged off the infected user account and re-logged on as Admin. That allowed me to delete XP Police and also allowed Task Manager to run.
If you are having trouble deleting the “Disable Task Manager” registry entries, it might be because that account is not set as admin.
I had to set the account as admin, then regedit allowed me to delete the various registry entries mentioned above:
1) (Hattip: thequicknessinc, Feb 10)
Go to Run:
Type: regedit
click on: HKEY_CURRENT_USER
then on: software
then you see xp police 2009. delete that entire registry.
2: (Hattip Jack, Feb 5)
Start Reg.-Editor and see HKEY_Curent_User/Software/Microsoft/CurrentVersion/Policies/System†and delete for the two entries saying “DisableRegistryTools†and “disableTaskMgrâ€.
3) (Hattip: thequicknessinc, Feb10)
Found one more registry entry that needs to be deleted.
Go to Run:
type: regedit
click on: HKEY_CURRENT_USER
then on: software
then on: microsoft
then on: windows
then on: CurrentVersion
then click on: Run
there should be a registry entry called “policeavâ€, delete that too.
I highly recommend you create user accounts (Control Panel: User accounts) while you are logged in as the admin, but click the “limited” button for the other user accounts so you can always bail back to the main admin account and regain control of your computer.
If you have only one account, and it’s an Admin account, these viruses leave you little wiggle room when they take over.
When i try to kill the process via description
Go to Run:
Type: taskkill /f /fi /XPPolice.exe
I get the message Windows can’t find taskkill; I then opened a cmd file and typed it in again and it tells me taskkill is not reognised as an internal or exernal command
- am I doing something dumb?
Oh man. System Restore worked for me!! You may have to do the task kill process listed above first, which I did, but definitely try system restore. Just go to control panel and search for system restore and go through the wizard. Good luck
Done. Thanks for helping!
i can’t find XPPolice.exe in processes. please help i’m gonna end up throwing my laptop out of my window in a few hours.
whoever created virus doctor should go to hell!
first, thanks everyone for all your input. I have one question. I have removed all the references to xp police that i know of, but when surfing the internet using explorer, randomly i get diverted to the xp police website. if i hit refresh or the back button it allows me to view the website i’ve requested. any advice??
thanks
Basically i juss want to get rid of this damn thing
…. My task bar is gone, the uninstaller is gone, Idk how to do this, I did the search thing and found all the XP police on the computer, I tried to delete them, and I tried to rename them, I cannot do anything! I use this computer mainly for school! Please help me!
NeNe
spy hunter finished scanning , it says i need to register and pay to remove , how can i remove without paying
I am going to take down these bastards who puts xp police antivirus craps on my computer. it’s so annoying. I could no longer play games!
I’m a Mac user who is bewildered by the whole PC process. Please, please, someone help me…
1) I have gone to “Run” and entered the taskkill line which it doesn’t recognize.
2) I have gone into “reged” and found the XPPolice file but do not know how to delete it – it won’t drag to the recycle bin, and won’t disappear when I hit the delete button. Is there another way to delete on a PC that I don’t know about?
3) I have gone to Run “cmd” and typed in the taskkill line and it says ERROR: The search filter cannot be recognized.
Can anyone give me some more suggestions to someone who is especially clueless to how to do anything on a PC?
THANKS YOU SO MUCH!!
Amy
UPDATE: Never mind! I just figured out how to delete on a PC, it was under EDIT! Ok I think I’ve gotten rid of it, except the part about:
Run
HKEY_CURRENT_USER
Software
“internet explorer” – I have no internet explorere listed under software – is that ok?
Amy
Thanks for the intel on that last folder. Maybe those *******s will leave my internet browser alone.
Hello,
I don’t use internet explorer… i use firefox so how would i go about deleting it?
#
By thequicknessinc on Feb 12, 2009 | Reply
Click on Run off of your start menu
type: regedit
click on: HKEY_CURRENT_USER
then click: software
then click: microsoft
then click: Internet Explorer
highlight Main, scroll down to Start Page on the right hand side: If its changed change it back to google.com or whatever you want.
go back to the left hand side and look a few more folders down for TypedURLs. Highlight it and in the right hand side find any XPPolice urls and just delete them.
This xp-police thing installed itself on my PC and I found the folder in Program Files and deleted it (after re-naming the folder). I still have a residual effect from it while browsing the net. Sometimes when I try to load a new page this “security warning” thing will pop up. I can usually just back out of it and re-load the new page, but its annoying and I’m not sure how to get rid of it. I didn’t find anything in the registry.
I think everyone has a different way of getting this bull off. I tried by using anna step.
Start menu
Click: run
type: regedit
click: HKEY-CURRENT-USER
click: software
thats when I found xp antipolice
right click on antipolice/ then was asked did I want to delete program and subkeys
Click: yes
program was gone at least from taskbar
Went to back to start menu and deleted shortcuts
so far so good
I have never seen anything like this and I am a techsupport agent
You, sir, are a genius.
Thank you very much for the useful advice.
I don;t think taskkill is an option on all machines. Not everyone has it installed…
In any case, I didn’t need to kill the process in safe mode.
Sorry. I was replying to “thequicknessinc”.
Many thanks!
What do you do if your virus scan has you reboot after everything was quarantined..and when the computer comes back on it’s asking the owner to log on. I’m completely locked out of that computer..can’t even get on. HELP!! Nobody has mentioned any of this happening to them yet.
im seriously so frustrated. i want to grab my lappy and toss it out the effing window. the stupid little windows pop up things wont stop coming! every screwing second man!
and its really pissing me off how it keeps reminding me to register for a lifetime of xp police antivirus contract something.
and im like WTF?! and i cant get it off! i got rid off the “hkey user” thing or whatever.
but it wont let me access my task manager, even if i tried what you guys did. HELP ME PLEASE!
You should be given a medal thequicknessinc.
Thank you very much.
Holy crap man this thing is brutal. Been dicking with it for around 6 hours now trying to mop it up and its still kicking my ass.
Heres what ive got so far. Ive tried pretty much everything listed above. Some thigns are sucessfull, some arent. Its almost like this fucking thing is evolving with a mind of its own.
By going through the registry i was finally able to get my task mgr back. Running the taskill by cmd wouldnt work.
I booted up in safemode and tracked down all the files i could through the registry and removed everything listed here. Atleast to the best of my ability. For whatever reason i wasnt able to take the exact paths in my registry to certain files listed here. Guess everyones computer is different. I searched for anything “police” “xppolice” etc related while in the registry and nuked anything relative.
However i clearly havnt got everything. Im still getting the “Infiltration” popup as well as another and my searches are still be redirected. Though it is better than it was.
Question: Does anyone know what the names of the processes are under task mgr? I mean i looked for the obvious but nothing is jumping out as malacious but obvioulsy theres something still running.
Thanks too all the input everyones provided.
thequicknessinc you are the best person ever! Just one question though, I’ve followed all your previous instruction and it’s done wonders so far but when I click on Start and go to my All Programs, the XP Police Antivirus bar is still there highlighted in orange. When I try to right click to delete it, nothing shows up. Please help. ^^;;
Thanks for the help. The only problem I have left now is that when I do a search and click on a link half the time it goes to some random site. Also, it won’t diplay my hotmail inbox and every page loads with errors. Any ideas on what else I have to delete?
I followed the procedures and I think I have removed the XP Police virus itself. I can get back into task manager now (YEAH!!) and my internet browser does not look as weird. I know there is something still on there from that virus though, because I went to download a Security Suite (antivirus, spyware, etc) provided free of charge from my cable/internet company and I can get onto the website — cox.com — I can login and I can click on the security suite. But as soon as I hit the “Download” button it keeps shutting down my internet. I have to reopen the internet application and try again — but it still doesn’t work! I’m getting so frustrated! I have tried it with both internet explorer and with mozilla — neither work. Any ideas how I can get some anti virus/spyware loaded on my computer without getting kicked out of the internet broswer page?
thequicknessinc,
Thank you! You are a very good person, and as long as XP Police is around you have your “good deed daily” in the bag!
Have a nice day!
I had the same problem, and I went into the program folder and renamed the exe. file, then when you restart it wont start up, and then you can start removing it.
hey so this thing downloaded on my computer this morning but i didnt realize what it was til about two hours ago when i googled it and ive been working on getting rid of it ever since butttt, whenever i go to run> and try any of the task kill stuff it says THE SEARCH FILTER CANNOT BE RECOGNIZED. but this police SH** is fu**ing PI**ING ME OFF.
help!!
god that shit was scary, wouldn’t let me open task manager, said administrator took away my privledge, thanks for tellin me how to do that shit
i have tried everything you said! do you think you could give a step by step again please thequicknessinc?? please dude.
why do you say speed is the key? i am not dumb but it took me a few hours to start and try to solve the prob and cant get it please help me!
Thanks for all the great information on how to remove this ugly virus. It nice to know there are people like you all out there …. it makes up for the one idiot that creates crap like this.
You guys rock. Came home and found this xp police crap all over the screen. tried McAfee to no help. after 10 minutes with your suggestions, it’s clean. Bless you!
My version of this parasite blocked my access to taskmanager. I ran this from Start>Run to get it back.
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
ok this xp police thing is pissing me off. i cant find it and when i open the internet it says Insecure Internet activity. Threat of virus attack. and the stupid xp police thing comes up. can someyone tell me how to fix it.
Thanks for the fix it worked. However my Internet Explorer and Firefox in XP won’t work even in safemode. I get a message from both during startup that says it encountered an error and needs to close. iexplore.exe gets a referenced memory error and so does Firefox. Firefox gets XPCOM:EventReceiver: firefox.exe-Application Error The instruction at “0x9f71517c” referenced memory at “0x9f71517c”. The memory could not be “read”. Any ideas how to fix would be greatly appreciated, and thanks again for your help!
Thanks sooooo much!
Hey umm i have a few questions and hopefully one can give me help by emailing me or something.
I have deleted all the xp police file in C:\Program Files but Xp police isnt uninstalled..
It keeps interfering with my internet. is there a way to uninstall it completely??
email: mahutahs@yahoo.co.nz
I am having a problem also with this xp police antivirus I can’t get it uninstalled from my computer. It keeps coming up and interupts everything. Help PLEASE.
THANK YOU SO MUCH!!!!!!!!!!
the quicknessinc !! thank you!!
you are awesome and deleting those files felt great.
thank you.
thequicknessinc…. you have now achieved ” LEGEND ” status !! thanks soooooo much
I have a differant problem. I am on an admin account yet it wont let me edit the registry. It says it is disabled by the admin though. What should I do and thanx in advance?
Ps I forgot to mention that the process is killed and I have deleated the folder already
Hey guys, i had this virus too, dunno if it is the same pne that has caused other issues but i did notice that the Folder Options had been hidden. I checked in msconfig and aload of startup software was listed by referencing hidden files in the %temp% folder. Someone mentioned that this thing seems to manipulate and i agree, that is unless it’s downloading other viruses as it goes. I had some pathetic AV installed and now i cannot run a new one, the splash screen comes up but the process gets killed. The guys who have wrote this unfortunately know their stuff
I have a system that I am working with that got this virus. I did the manual uninstall and have scoured the registry and see no sign of it, but when I try to download a new AV program or execute programs such as HijackThis or Spybot, nothing happens…acts as if I never started the program…some it lets me install then kills when I try to start the task any ideas?
I have been through all of the steps on this page but i still get redirected to some creap website when I use any search engine on internet explorer. I also am still unable to run any spyware that I download. Obviously I have not gottem everything. Anyone have any suggestions?
There are many versions of this “anti-virus” scam. I have removed it on more machines than I can remember, all I can hope is the people responsible die a slow and painfull death. Only after watching ther entire family suffer the same fate.