Click on screenshot to zoom
Danger level 9
Type: Malware
Common infection symptoms:
  • Block exe files from running
  • Installs itself without permissions
  • Connects to the internet without permission
  • Normal system programs crash immediatelly
  • Slow internet connection
  • System crashes
  • Slow Computer

Abu Dhabi Police GHQ virus

Abu Dhabi Police GHQ virus is a ransomware infection which addresses computer users who speak Arabic. It is known to be spread by Urausy Trojan which is a dangerous threat that is able to stop various processes, create and download new dangerous files. Abu Dhabi Police GHQ virus locks the system down and instead of your desktop, you see a bogus warning whenever the system loads.  The aim of the infection is to make you pay a ransom which is either 100 U.S. dollars, 100 Euros or 500 Dirhams. Unlike in other versions of the Trojan, the money has to be transferred via CashU which is a legal prepaid online payment method widely used in the Middle East and North Africa.

However, if you do not want to lose your money, remove the virus from the system. The heading in the warning suggests that you are dealing with Abu Dhabi Police which, in fact, has nothing to do with the situation you have just encountered. Moreover, pay no attention to the logos on the left side of the warning implying that you have been identified as a criminal by Interpol.

If you were to look at other instances of the Trojan, such as POLITIE Belgique Police Federale Virus and some others, you would see that those fictitious warnings contains the credentials of various legal institutions. All of them deal with crime or cyber crime, so if the user of the infected computer knows something about the institution or looks for information about it, he or she starts to think that the case is real.

We ensure you that there is no need to worry about this warning as it is a scam. Its creators are probably a group of hackers, so if you are not willing to boost their profit, remove the infection right now.

In order to get rid of the warning, you should install an anti-spyware program which is powerful enough to terminate the threat. We recommend that you install SpyHunter as this tool has been already used to terminate other variants of the Trojan and distinct computer infections, too. Below you will find instructions which will help you install the program properly so that it is not blocked by the threat.

Policía Nacional de Uruguay Virus Removal

Windows XP

  1. Reboot the computer.
  2. Once the BIOS startup screen showing the information on your hardware loads, tap the F8 key.
  3. Use the arrow keys to select Safe Mode with Networking.
  4. Press Enter.
  5. Click Yes.
  6. Go to the Start menu and launch Run.
  7. Type msconfig in the Open box and press OK.
  8. On the Startup tab, click Disable All and then click Apply.
  9. Download SpyHunter.
  10. Reboot the computer.
  11. Run the installer of the application and run a scan afterwards.

Windows Vista and Windows 7

  1. Restart the computer.
  2. Tap the F8 key as soon as the BIOS screen loads.
  3. Highlight Safe Mode with Networking using the arrow keys and press Enter.
  4. Open a browser.
  5. Go to http://www.pchreat.com/download-sph to download the spyware removal tool.
  6. Install the program and remove the virus.

Windows 8

  1. Press the Windows key.
  2. Click Internet Explorer.
  3. Type http://www.pcthreat.com/download-sph and press Enter.
  4. Download and install the program and scan the PC afterwards.
Download Spyware Removal Tool to Remove* Abu Dhabi Police GHQ virus
  • Quick & tested solution for Abu Dhabi Police GHQ virus removal.
  • 100% Free Scan for Windows
disclaimer

How to manually remove Abu Dhabi Police GHQ virus

Files associated with Abu Dhabi Police GHQ virus infection:

wahneaqa.exe
dqnbdq7.dss
secproc_isv.exe
wlsidten.dll
crack.exe
uenovfiu.exe
dyjdl.exe
50E1.exe
msavfit.exe
ssntvs.exe
87b2cb3916261d5c807bf44262755cb0.exe
xctqakcqbeo.dll
96dddda4.dll
administration.exe
魔法桌面第三方主题破解补丁V1.1.exe
ex3b.dll
%SystemDrive%\????????????
bzsbkotiu.exe
JfCqQ5JC.exe
wgsdgsdgdsgsd.exe
xlqbteeb.exe
oygqyunapnp.exe
pmstcdjwz.exe
m2PythonLoader.exe
xmlfilter.exe
hwj3ba6j.dss
setex.exe
00b5d693.exe
dtkmujvo.exe
00qbipeq.exe
ieudator.dll
%APPDATA%\Task Scheduler
Task Scheduler.exe
NTServiceManager.exe
msdtmsrd.exe
aPr0hY9.exe
audipbrd.exe
najeoxtt.exe
rool0_pk.exe
jsdhlexdqkllnbcxgai.bfg
Q3d38543.exe
videotwisterSA.exe
systemcpl.exe
bvhylsviw.exe
%ALLUSERSPROFILE%
obvwo.exe
UpdatePriv.exe
%APPDATA%\system
bf8h8d02hf.exe
WinSyncMetastore.exe
scvhost.exe
2084473.dll
skype.dat
acuvzomo.exe
Other.res
%UserProfile%
SyncHostps.exe
svchost.exe
questscan.dll
idiokbbrv.exe
ifgxpers.exe
Updating.exe
OmaSG21e.exe
TimeDateMUICallback.exe
iner.exe
wjthvwjb.dss
ACEIEAddOn.dll
sqlncli.exe
install_0_msi.exe
wpbt0.dll
{097444e7-2d87-ba3c-2efe-9f54812d824a}.exe
csrsss.exe
%APPDATA%\updates
msn.exe
%WINDIR%\Temp
%AppData%
p1.exe
mplayer2.exe
xaZYOVJW.exe
b34btbztdb0vavaw.exe
DLL321.dll
comeo.exe
3511172082012Build.exe
Nbt.exe
MusicCollector.exe
WINDED6.exe
n.
wlsidten.exe
Piranha.exe
rvcbcyks.exe
%LOCALAPPDATA%\Temp
brenasa.exe
%LOCALAPPDATA%\lollipop
yaiiwockc.dll
%WINDIR%\system32
taskhost.exe.exe
gcrwcoak.exe
pYunY8m4VL3qLc.exe
%CommonProgramFiles%
UpgradeHelper.exe
securitywindrv.exe
Firewallservice.exe
ubvhynpxh.exe
%TEMP%
cf6640a77ed4926a4c6be661ab93def9d13408753dd07e8d02836996a2f247b6.exe
ctfmon.exe
msshell.exe
DA0B.exe
msnmsgrr.exe
VaultSysUi.exe
puozlkmyj.dll
zqmkrehUkpoKfsafsaZg.exe
C87C.exe
%ALLUSERSPROFILE%\Application Data

Abu Dhabi Police GHQ virus DLL's to remove:

2084473.dll
ACEIEAddOn.dll
yaiiwockc.dll
puozlkmyj.dll
xctqakcqbeo.dll
wlsidten.dll
ieudator.dll
DLL321.dll
questscan.dll
ex3b.dll
96dddda4.dll
wpbt0.dll

Abu Dhabi Police GHQ virus processes to kill:

setex.exe
comeo.exe
Updating.exe
MusicCollector.exe
csrsss.exe
UpgradeHelper.exe
wahneaqa.exe
brenasa.exe
msn.exe
ubvhynpxh.exe
iner.exe
50E1.exe
Task Scheduler.exe
cf6640a77ed4926a4c6be661ab93def9d13408753dd07e8d02836996a2f247b6.exe
taskhost.exe.exe
svchost.exe
DA0B.exe
administration.exe
xmlfilter.exe
xaZYOVJW.exe
zqmkrehUkpoKfsafsaZg.exe
bf8h8d02hf.exe
dtkmujvo.exe
msnmsgrr.exe
TimeDateMUICallback.exe
audipbrd.exe
videotwisterSA.exe
msshell.exe
najeoxtt.exe
WINDED6.exe
ctfmon.exe
NTServiceManager.exe
mplayer2.exe
bvhylsviw.exe
87b2cb3916261d5c807bf44262755cb0.exe
OmaSG21e.exe
pYunY8m4VL3qLc.exe
dyjdl.exe
JfCqQ5JC.exe
gcrwcoak.exe
p1.exe
VaultSysUi.exe
C87C.exe
3511172082012Build.exe
ssntvs.exe
rool0_pk.exe
00qbipeq.exe
rvcbcyks.exe
b34btbztdb0vavaw.exe
idiokbbrv.exe
scvhost.exe
00b5d693.exe
SyncHostps.exe
msdtmsrd.exe
wlsidten.exe
xlqbteeb.exe
securitywindrv.exe
UpdatePriv.exe
{097444e7-2d87-ba3c-2efe-9f54812d824a}.exe
sqlncli.exe
wgsdgsdgdsgsd.exe
aPr0hY9.exe
ifgxpers.exe
systemcpl.exe
m2PythonLoader.exe
Piranha.exe
Nbt.exe
WinSyncMetastore.exe
Q3d38543.exe
install_0_msi.exe
pmstcdjwz.exe
obvwo.exe
secproc_isv.exe
crack.exe
Firewallservice.exe
msavfit.exe
oygqyunapnp.exe
acuvzomo.exe
bzsbkotiu.exe
魔法桌面第三方主题破解补丁V1.1.exe
uenovfiu.exe
Disclaimer

Comments

  1. costar Apr 23, 2013

    When I startup windows in safe mode it restarts automatically as soon as desktop screen pops,,I think format is the only option,,I reported this issue to ad police and they are aware of it already,,I bet many users have added to that hackers profit

  2. Pcthreat Apr 24, 2013

    You should try SAFE MODE with command prompt.
    After windows loads up, and shows a black window, type explorer.exe

  3. sad Oct 5, 2013

    Even safe mode with command prompt not working

  4. Vivek Oct 14, 2013

    ANSWER

    1 Just boot with any HBCD
    2.go to that user profile and open AppData folder-->local folder and delete one folder or rename 2 file.
    3.Folder like "3cghj256312" something like this.

    and restart and will get cmd promt and type explorer
    4.In Registry Editor Look for the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell-->der it will be cmd.exe change to explorer.exe dats all..

Post comment — WE NEED YOUR OPINION!

Comment:
Name:
Please enter security code:
This is a captcha-picture. It is used to prevent mass-access by robots.