Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Trojan horse PSW.Generic10.BHKG, BHKI, BJKO


  • Please log in to reply

#16
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
Uh oh. I can't start Windows properly. I select "start Windows normally" but it keeps kicking me back to that same screen.
  • 0

Advertisements


#17
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Reboot and when you see the maker's logo, hear a beep or it talks about F8, start tapping the F8 key slowly. Keep tapping until the Safe Mode Menu appears and choose Safe Mode with Networking. Login with your usual login.

If this works, (Start), right click on My Computer and select Manage then Device Manager. View, Show Hidden devices. Find the eabfiltr entry (probably has a yellow mark next to it) and right click on it. If there is an option to rollback the driver, take it, otherwise try to uninstall it. Then reboot. This is just for the HP Quick Launch Buttons so shouldn't be that important.
  • 0

#18
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
I didn’t find the eabfiltr entry, but I did find avast! Network Shield Support with a yellow exclamation point next to it. I didn't disable it before running OTL. I'm sorry. How do I move forward from here?
  • 0

#19
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
I have the option to disable it - should I do that and reboot?
  • 0

#20
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
All we did was replace C:\WINDOWS\system32\drivers\eabfiltr.sys
with the file here:
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\RollBackDr\eabfiltr.sys

Let's try a different file

See if you can copy

C:\Program Files\HPQ\Quick Launch Buttons\eabfiltr.sys

to

C:\WINDOWS\system32\drivers\

(overwrite the old one) then reboot and see if it will boot into regular mode.
  • 0

#21
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Disable which file? Don't worry about the avast one.
  • 0

#22
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
I meant avast. I am wondering if I'm having problems because I forgot to disable avast before running OTL.
  • 0

#23
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
I don't think Avast would be a problem.
  • 0

#24
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
Ok, so do I do this in OTL:

:files
C:\WINDOWS\system32\drivers\eabfiltr.sys|C:\Program Files\HPQ\Quick Launch Buttons\eabfiltr.sys| /replace

:Commands
[Reboot]

I want to make sure I'm doing it right. THANKS!
  • 0

#25
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Actually I thought you could just use Windows Explorer to copy and paste the file but if you want to use OTL you can.

You had it backwards so I have done an edit on your post to make it right.
  • 0

Advertisements


#26
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
Ok, I'm going to do it through OTL (only because I'm more comfortable with it at this point).

What do I do after I (hopefully) reboot? Should I try to run OTL again with the code from your most recent OTL post?
  • 0

#27
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Run otl with the fix in your last post. Then try and reboot into regular mode. If that works then run TDSSKiller again. I'm concerned about this

00:15:32.0718 3248 [ 81B7808D3B5892388F33273119C2DC31 ] eabfiltr C:\WINDOWS\system32\drivers\EABFiltr.sys
00:15:32.0718 3248 Suspicious file (Forged): C:\WINDOWS\system32\drivers\EABFiltr.sys. Real md5: 81B7808D3B5892388F33273119C2DC31, Fake md5: 76722EA1FF4837C4EFB509B38A7236AB
00:15:32.0718 3248 eabfiltr ( ForgedFile.Multi.Generic ) - warning
00:15:32.0718 3248 eabfiltr - detected ForgedFile.Multi.Generic (1)


  • 0

#28
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
I copied the code from my last post and ran OTL, but it didn't boot normally. I'm back in safe mode - networking. Where to from here?

Thanks again for your help throughout this.
  • 0

#29
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Start, Run, msconfig, OK

That should bring up a System Configuration screen. Click on the Run tab and look for any reference to Quick Launch Buttons or HP Quick Launch Buttons. If you find it uncheck it. Now check the Startup tab and see if there is an entry there. If you find it uncheck it.

If you found an entry then Apply, OK and reboot. If you didn't find an entry then go back to the first tab and check Diagnostic Startup then apply and OK and reboot. Does it boot normally?
  • 0

#30
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
I don't see a Run tab. These are the tabs I see:

General
SYSTEM.INI
WIN.INI
BOOT.INI
Services
Startup
Tools
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP