Trojan horse PSW.Generic10.BHKG, BHKI, BJKO
Posted 23 January 2013 - 01:28 AM
Posted 23 January 2013 - 01:34 AM
If this works, (Start), right click on My Computer and select Manage then Device Manager. View, Show Hidden devices. Find the eabfiltr entry (probably has a yellow mark next to it) and right click on it. If there is an option to rollback the driver, take it, otherwise try to uninstall it. Then reboot. This is just for the HP Quick Launch Buttons so shouldn't be that important.
Posted 23 January 2013 - 01:42 AM
Posted 23 January 2013 - 01:48 AM
with the file here:
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\RollBackDr\eabfiltr.sys
Let's try a different file
See if you can copy
C:\Program Files\HPQ\Quick Launch Buttons\eabfiltr.sys
(overwrite the old one) then reboot and see if it will boot into regular mode.
Posted 23 January 2013 - 01:54 AM
Posted 23 January 2013 - 01:59 AM
:files C:\WINDOWS\system32\drivers\eabfiltr.sys|C:\Program Files\HPQ\Quick Launch Buttons\eabfiltr.sys| /replace :Commands [Reboot]
I want to make sure I'm doing it right. THANKS!
Posted 23 January 2013 - 02:04 AM
You had it backwards so I have done an edit on your post to make it right.
Posted 23 January 2013 - 02:08 AM
What do I do after I (hopefully) reboot? Should I try to run OTL again with the code from your most recent OTL post?
Posted 23 January 2013 - 02:10 AM
00:15:32.0718 3248 [ 81B7808D3B5892388F33273119C2DC31 ] eabfiltr C:\WINDOWS\system32\drivers\EABFiltr.sys
00:15:32.0718 3248 Suspicious file (Forged): C:\WINDOWS\system32\drivers\EABFiltr.sys. Real md5: 81B7808D3B5892388F33273119C2DC31, Fake md5: 76722EA1FF4837C4EFB509B38A7236AB
00:15:32.0718 3248 eabfiltr ( ForgedFile.Multi.Generic ) - warning
00:15:32.0718 3248 eabfiltr - detected ForgedFile.Multi.Generic (1)
Posted 23 January 2013 - 02:13 AM
Thanks again for your help throughout this.
Posted 23 January 2013 - 02:20 AM
That should bring up a System Configuration screen. Click on the Run tab and look for any reference to Quick Launch Buttons or HP Quick Launch Buttons. If you find it uncheck it. Now check the Startup tab and see if there is an entry there. If you find it uncheck it.
If you found an entry then Apply, OK and reboot. If you didn't find an entry then go back to the first tab and check Diagnostic Startup then apply and OK and reboot. Does it boot normally?
Posted 23 January 2013 - 02:23 AM
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users