Folder AVG Forums » Other topics » Virus Removal, Tools for Removing » [SOLVED] Trojan Horse BHO.WPO Keeps Coming Back!
Page 2 of 3 ‹‹123››
June 14, 2013 18:11 Re: Trojan Horse BHO.WPO Keeps Coming Back! #230281
Top
itsmequi

Avatar

Novice
Join Date: 11.6.2013
Posts: 12
confused Hi Pokornyz

I realized my error. I was not including a space after typing "fdisk", so I went back to the previous step and deleted the partition as instructed. When trying to reboot I get an Windows recovery error which leads me to start up repair. Then I get an error stating start up could not be repaired automatically. Once again not sure how to proceed. I've attached some screen shots also.

Thank you again for your help.
20130614_132140_resized.jpg20130614_134119(0)_resized.jpg20130614_135037_resized.jpg
June 15, 2013 10:15 Re: Trojan Horse BHO.WPO Keeps Coming Back! #230298
Top
Pokornyz

Avatar

Administrator
Join Date: 29.11.2010
Posts: 8233
Hello itsmequi,

So after deleting empty partition you don't receive "multiple active partitions" anymore?

If you choose boot normally are you able to boot or is there any error message?
You can also try booting into Windows safe mode.

Thanks



AVG Team
How-To articles | FAQ | Free Support
June 15, 2013 17:35 Re: Trojan Horse BHO.WPO Keeps Coming Back! #230307
Top
itsmequi

Avatar

Novice
Join Date: 11.6.2013
Posts: 12
Hi Pokornyz,

No, I'm not getting the multiple active partitions error anymore. I did try to boot normally but it keeps rebooting and brings me back to that 3rd screenshot I provided. I think I see a flash of the blue screen but it happens very quickly. I tried to boot in safe mode and get the same result.

Thanks
June 15, 2013 17:41 Re: Trojan Horse BHO.WPO Keeps Coming Back! #230308
Top
Pokornyz

Avatar

Administrator
Join Date: 29.11.2010
Posts: 8233
June 16, 2013 19:10 Re: Trojan Horse BHO.WPO Keeps Coming Back! #230319
Top
itsmequi

Avatar

Novice
Join Date: 11.6.2013
Posts: 12
Hi Pokornyz

I tried to follow the instructions but unfortunately I can not find HKEY_LOCAL_MACHINE. I used the search feature and got no results for userinit. When searching for winlogon I did get a few hits similar to the path provide but none included userinit.

No going back to when I first ran the scan with the rescue CD I'm thinking now that I may have deleted all those files. Was that what I was supposed to do or is that what the problem is now?

Thanks again
June 17, 2013 07:45 Re: Trojan Horse BHO.WPO Keeps Coming Back! #230329
Top
Pokornyz

Avatar

Administrator
Join Date: 29.11.2010
Posts: 8233
Hello itsmequi,

HKEY_LOCAL_MACHINE can be also written as HKLM.

No going back to when I first ran the scan with the rescue CD I'm thinking now that I may have deleted all those files. Was that what I was supposed to do or is that what the problem is now?

You can check if C:\Windows\System32\userinit.exe still exists, default action on Rescue CD is renaming not deletion.

Thank you



AVG Team
How-To articles | FAQ | Free Support
1Q7RKdk[1].png
June 17, 2013 17:12 Re: Trojan Horse BHO.WPO Keeps Coming Back! #230370
Top
itsmequi

Avatar

Novice
Join Date: 11.6.2013
Posts: 12
Hi Pokornyz,

I'm almost certain that I deleted the files instead of renaming, because I can remember not being sure and thinking during the other scans I usually delete. disappointed
But I do see the userinit.exe file when using the File Manager.

But, unfortunately, I'm still unable to navigate to it using the Registry Editor. I can go to HKLM -> SOFTWARE -> Microsoft -> Windows (not Windows NT) -> CurrentVersion
The only option after that is Uninstall, there is no winlogon.

What can I do next?

Thank You
June 18, 2013 07:21 Re: Trojan Horse BHO.WPO Keeps Coming Back! #230393
Top
Pokornyz

Avatar

Administrator
Join Date: 29.11.2010
Posts: 8233
Hello itsmequi,

It has to be Windows NT not just Windows see this article.

Thank you



AVG Team
How-To articles | FAQ | Free Support
June 18, 2013 17:04 Re: Trojan Horse BHO.WPO Keeps Coming Back! #230420
Top
itsmequi

Avatar

Novice
Join Date: 11.6.2013
Posts: 12
Hi Pokornyz,

I'm still unable to find userinit under HKLM. When I search for winlogon I get a few results but none have userinit. I've attached a screenshot of the results. Is there anything else I can do?

I really don't want to reinstall Windows as I'm afraid I've lost the product key for MS Office and others when I moved. I do have an external hard drive if I need to copy the files but I'm also unsure of how to do that. That is ultimately my last resort, but are there any other options available to me at this point?

Thanks
20130618_114618.jpg
June 19, 2013 07:35 Re: Trojan Horse BHO.WPO Keeps Coming Back! #230430
Top
Pokornyz

Avatar

Administrator
Join Date: 29.11.2010
Posts: 8233
Hello itsmequi,

Unfortunately it seems like infection damaged your system.

For help on your issue please try to run your PC in Last Known Good Configuration.

If it doesn't help you can try to restore your computer using System restore from installation disk or perform repair installation.

Thank you



AVG Team
How-To articles | FAQ | Free Support
Page 2 of 3 ‹‹123››