Trojan horse PSW.Generic10.BHKG, BHKI, BJKO
Started by
soulatomic
, Jan 22 2013 09:20 PM
#31
Posted 23 January 2013 - 02:23 AM
#32
Posted 23 January 2013 - 02:24 AM
Also, I didn't see anything in the Startup tab.
#33
Posted 23 January 2013 - 02:25 AM
How about under Services?
#34
Posted 23 January 2013 - 02:38 AM
Running diagnostic startup didn't allow me to boot normally. I didn't see anything in the Services tab, either.
#35
Posted 23 January 2013 - 02:47 AM
Start, Run, cmd, OK
Type with an Enter after each line:
(does this give you an error?)
regedit
(This should bring up the registry editor. Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
(Find HKEY_LOCAL_MACHINE\SYSTEM and click on the plus in front of it then
SYSTEM
then CurrentControlSet then Services. Click on the + in front of Services and then look and see if you can find an entry for eabfiltr.
What value does it have for Start in the right pane?
Type with an Enter after each line:
net start eabfiltr
(does this give you an error?)
regedit
(This should bring up the registry editor. Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
(Find HKEY_LOCAL_MACHINE\SYSTEM and click on the plus in front of it then
SYSTEM
then CurrentControlSet then Services. Click on the + in front of Services and then look and see if you can find an entry for eabfiltr.
What value does it have for Start in the right pane?
#36
Posted 23 January 2013 - 02:52 AM
0x00000001 (1)
#37
Posted 23 January 2013 - 02:53 AM
Can you change it to 4 then reboot?
#38
Posted 23 January 2013 - 03:04 AM
That did it! It rebooted normally! Yeah! But now there's a screen that says, "Please wait while Windows configures ScanSoft PaperPort 11." I can click Cancel, but I think it's going to do it each time I load Windows.
Where to from here?
As always, thanks for your help!
Where to from here?
As always, thanks for your help!
#39
Posted 23 January 2013 - 03:08 AM
The simple way would be to just uninstall it.
Click Start => Control Panel.
Double click the Add or Remove Programs icon.
Click the Change or Remove Programs icon.
Select ScanSoft PaperPort 11 from the list, click the Change or Remove button.
Depends on if it is something you use. Do you have the disk for it?
Click Start => Control Panel.
Double click the Add or Remove Programs icon.
Click the Change or Remove Programs icon.
Select ScanSoft PaperPort 11 from the list, click the Change or Remove button.
Depends on if it is something you use. Do you have the disk for it?
#40
Posted 23 January 2013 - 03:09 AM
No, we don't use it. We don't have a printer, scanner or anything. I'll uninstall it.
Now that I'm in regular mode again, what do I need to do to get rid of that file?
Now that I'm in regular mode again, what do I need to do to get rid of that file?
#41
Posted 23 January 2013 - 03:18 AM
If you are talking about eabfiltr.sys then you don't really have to do anything. It's only used to make the extra buttons on an HP keyboard work. And the bad file has been moved to C:\_OTL where it can't do anything. If you really want the keyboard buttons to work I suppose you could download the driver from the HP web site.
It probably wouldn't hurt to run an Avast Boot Time scan.
First mute the speakers.
Click on the Avast ball. Then click on Scan Computer, then on
Boot-Time Scan then on Settings. Change the Ask at the bottom to Move to Chest. OK then Schedule Now. Reboot and let it run a scan. (Note the path of aswboot.txt so you can find it again. Usually it's C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\report\aswboot.txt) It may take hours so you might as well get some sleep.
Once it finishes it should load windows. Click on the Avast ball and then on Scan Logs, select the Boot-time scan report then View Results. How many did it find? Copy the text from aswBoot.txt and paste it into a reply.
I'm going to have to go to bed soon.
It probably wouldn't hurt to run an Avast Boot Time scan.
First mute the speakers.
Click on the Avast ball. Then click on Scan Computer, then on
Boot-Time Scan then on Settings. Change the Ask at the bottom to Move to Chest. OK then Schedule Now. Reboot and let it run a scan. (Note the path of aswboot.txt so you can find it again. Usually it's C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\report\aswboot.txt) It may take hours so you might as well get some sleep.
Once it finishes it should load windows. Click on the Avast ball and then on Scan Logs, select the Boot-time scan report then View Results. How many did it find? Copy the text from aswBoot.txt and paste it into a reply.
I'm going to have to go to bed soon.
#42
Posted 23 January 2013 - 03:21 AM
Make sure we left msconfig with it set to normal boot. We don't want to still be in diagnostic boot.
#43
Posted 23 January 2013 - 03:21 AM
Thank you for all of your help! I'm going run the scan tomorrow since I need to get to bed, too. I'll post an update tomorrow.
I appreciate your fast response tonight! You've helped me so much.
I appreciate your fast response tonight! You've helped me so much.
#44
Posted 23 January 2013 - 03:23 AM
And yes, I changed it to normal boot. Good night!
#45
Posted 23 January 2013 - 10:20 PM
I missed the part where you said the scan will take hours. Oops. I just started it now, so I will have an update for you tomorrow.
Also, when I plug in an external hard drive, XP no longer shows an auto play prompt. Do you think one of the programs we've run disabled it?
Thanks again!
Also, when I plug in an external hard drive, XP no longer shows an auto play prompt. Do you think one of the programs we've run disabled it?
Thanks again!
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users