Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Trojan horse PSW.Generic10.BHKG, BHKI, BJKO


  • Please log in to reply

#31
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
Sorry I meant Startup
  • 0

Advertisements


#32
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
Also, I didn't see anything in the Startup tab.
  • 0

#33
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
How about under Services?
  • 0

#34
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
Running diagnostic startup didn't allow me to boot normally. I didn't see anything in the Services tab, either. :(
  • 0

#35
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
Start, Run, cmd, OK

Type with an Enter after each line:

net  start  eabfiltr

(does this give you an error?)

regedit

(This should bring up the registry editor. Navigate to:


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

(Find HKEY_LOCAL_MACHINE\SYSTEM and click on the plus in front of it then
SYSTEM
then CurrentControlSet then Services. Click on the + in front of Services and then look and see if you can find an entry for eabfiltr.

What value does it have for Start in the right pane?
  • 0

#36
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
0x00000001 (1)
  • 0

#37
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
Can you change it to 4 then reboot?
  • 0

#38
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
That did it! It rebooted normally! Yeah! But now there's a screen that says, "Please wait while Windows configures ScanSoft PaperPort 11." I can click Cancel, but I think it's going to do it each time I load Windows.

Where to from here?

As always, thanks for your help!
  • 0

#39
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
The simple way would be to just uninstall it.


Click Start => Control Panel.
Double click the Add or Remove Programs icon.
Click the Change or Remove Programs icon.
Select ScanSoft PaperPort 11 from the list, click the Change or Remove button.

Depends on if it is something you use. Do you have the disk for it?
  • 0

#40
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
No, we don't use it. We don't have a printer, scanner or anything. I'll uninstall it.

Now that I'm in regular mode again, what do I need to do to get rid of that file?
  • 0

Advertisements


#41
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
If you are talking about eabfiltr.sys then you don't really have to do anything. It's only used to make the extra buttons on an HP keyboard work. And the bad file has been moved to C:\_OTL where it can't do anything. If you really want the keyboard buttons to work I suppose you could download the driver from the HP web site.

It probably wouldn't hurt to run an Avast Boot Time scan.

First mute the speakers.
Click on the Avast ball. Then click on Scan Computer, then on
Boot-Time Scan then on Settings. Change the Ask at the bottom to Move to Chest. OK then Schedule Now. Reboot and let it run a scan. (Note the path of aswboot.txt so you can find it again. Usually it's C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\report\aswboot.txt) It may take hours so you might as well get some sleep.
Once it finishes it should load windows. Click on the Avast ball and then on Scan Logs, select the Boot-time scan report then View Results. How many did it find? Copy the text from aswBoot.txt and paste it into a reply.

I'm going to have to go to bed soon.
  • 0

#42
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
Make sure we left msconfig with it set to normal boot. We don't want to still be in diagnostic boot.
  • 0

#43
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
Thank you for all of your help! I'm going run the scan tomorrow since I need to get to bed, too. I'll post an update tomorrow.

I appreciate your fast response tonight! You've helped me so much. :)
  • 0

#44
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
And yes, I changed it to normal boot. :) Good night!
  • 0

#45
soulatomic

soulatomic

    Member

  • Topic Starter
  • Member
  • PipPip
  • 35 posts
I missed the part where you said the scan will take hours. Oops. I just started it now, so I will have an update for you tomorrow.

Also, when I plug in an external hard drive, XP no longer shows an auto play prompt. Do you think one of the programs we've run disabled it?

Thanks again!
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP