How to Manually Remove the Police Virus Using Another User on the Same PC
This procedure will function on a Windows 7 when another user on that computer is still not-virused and it is an Administrator user. , Start or switch using the non-infected user's name. , Start Registry Editor : C:\Windows\Regedit.exe , In...
Step-by-Step Guide
-
Step 1: This procedure will function on a Windows 7 when another user on that computer is still not-virused and it is an Administrator user.
You can use anything you want but maybe the safest is the infected user's name ,, The full name of the folder should be something like "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
The complete filename there should include something like "C:\Documents and Settings\username\desktop\Bleah.exe"
At the end my filename was "Skype.exe" instead of "Bleah.exe" .
You can find any name of an important file or program.
It is a FAKE name! , You will see a dialog box the value data.
In my case: "C:\Documents and Settings\username\Desktop\Skype.exe"
, In my case it was "Skype.exe".
Make sure that Keys, Values and Data are ALL checked in the options. , When you find one right-click the name and use Delete. , Restart the computer normally or in the Safe Mode.
It will work OK. , Go to the folder containing the files.
You have it wrote on paper (in my case: "C:\Documents and Settings\username\desktop") You should find there one or several files with the fake name.
In my case I found 2 files: "Skype.exe" and "Skype.dat"
I choose to rename them to "___Skype___.exe" and "___Skype___.dat"
In my case: "___Skype___.exe" and "___Skype___.dat" -
Step 2: Start or switch using the non-infected user's name.
-
Step 3: Start Registry Editor : C:\Windows\Regedit.exe
-
Step 4: In Regedit : highlight the HKEY_USERS key and go to menu File.Load Hive
-
Step 5: Go to : C:\Users\<user>\ where <user> is the name of the infected user
-
Step 6: Open the "ntuser.dat" or "ntuser.dat.bhv" file (usually a hidden file)
-
Step 7: You'll be asked for a "Key Name" .
-
Step 8: Expand the Hive you just loaded
-
Step 9: Find a folder named "Winlogon" in the left list .
-
Step 10: on the right list find a registry key named "Shell" .
-
Step 11: Write down on a paper the EXACT file name.
-
Step 12: Right-click the word "Shell" and select Modify.
-
Step 13: Modify this value to "Explorer.exe" instead of anything it is already there.
-
Step 14: Go to Edit.Find menu and type the virus info you wrote down.
-
Step 15: Hit Find Next to find all the registry keys containing the virus info.
-
Step 16: Brutally shutdown the computer by holding down the Power Off button on the keyboard.
-
Step 17: Delete the virus files.
-
Step 18: Rename or delete the files.
-
Step 19: After everything is checked and OK you should completely delete the virus files.
Detailed Guide
You can use anything you want but maybe the safest is the infected user's name ,, The full name of the folder should be something like "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
The complete filename there should include something like "C:\Documents and Settings\username\desktop\Bleah.exe"
At the end my filename was "Skype.exe" instead of "Bleah.exe" .
You can find any name of an important file or program.
It is a FAKE name! , You will see a dialog box the value data.
In my case: "C:\Documents and Settings\username\Desktop\Skype.exe"
, In my case it was "Skype.exe".
Make sure that Keys, Values and Data are ALL checked in the options. , When you find one right-click the name and use Delete. , Restart the computer normally or in the Safe Mode.
It will work OK. , Go to the folder containing the files.
You have it wrote on paper (in my case: "C:\Documents and Settings\username\desktop") You should find there one or several files with the fake name.
In my case I found 2 files: "Skype.exe" and "Skype.dat"
I choose to rename them to "___Skype___.exe" and "___Skype___.dat"
In my case: "___Skype___.exe" and "___Skype___.dat"
About the Author
Frances Morales
Writer and educator with a focus on practical creative arts knowledge.
Rate This Guide
How helpful was this guide? Click to rate: