Malware bytes Hiloti trojan - cant boot computer

[jez oh no]

Hi there,

I recently ran a scan with MB and found a few problems. I wasnt really paying attention to what they were but clicked something like Fix Checked and then was prompted to Restart. On reboot the computer does not pass the windows splash page with the loading bar (about 5 seconds hang here) and then flashes a blue screen (for less than a second) and reboots. This cycle continues over and over ahhhhh!!! I cant catch whats written on the blue screen but will try and post.

I have tried the following:

1. Boot in safe mode/networking - same result.

2. Boot with lastworking config - same result.

I downloaded Secured2k's boot disk and have been able to access a temporary platform, however my internet connection is a wireless USB drive and it doesnt recognise it. I was able to access the malware bytes log and it looks like a regestry value was deleted. My details are as follows, please please help:

LOG

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5604

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

28/01/2011 4:08:51 PM

mbam-log-2011-01-28 (16-08-51).txt

Scan type: Quick scan

Objects scanned: 162336

Time elapsed: 6 minute(s), 11 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 2

Registry Keys Infected: 0

Registry Values Infected: 2

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 8

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

c:\WINDOWS\saplmp.dll (Trojan.Hiloti) -> Delete on reboot.

c:\WINDOWS\ukujocif.dll (Trojan.Hiloti) -> Delete on reboot.

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jvayonutulivih (Trojan.Hiloti) -> Value: Jvayonutulivih -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ggidiziresox (Trojan.Hiloti) -> Value: Ggidiziresox -> Delete on reboot.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\saplmp.dll (Trojan.Hiloti) -> Delete on reboot.

c:\WINDOWS\ukujocif.dll (Trojan.Hiloti) -> Delete on reboot.

c:\documents and settings\Computer\local settings\Temp\0.6918481915312358.exe (Rogue.SecurityShield) -> Quarantined and deleted successfully.

c:\documents and settings\Computer\application data\Adobe\plugs\kb190414609.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\Computer\application data\Adobe\plugs\kb190430125.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\Computer\application data\Adobe\plugs\kb190433718.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\Computer\local settings\Temp\0.4784454880955621.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\Computer\local settings\Temp\0.6897203760381174.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

[daledoc1]

Hello and welcome, jez oh no:

Sorry to hear that your system is infected.

Alas, we do not work on malware removal in this particular forum.

Instructions on how to proceed are posted in the 2nd Important Topic pinned at the top of this forum: "I Am Infected What Do I Do Now?".

To summarize:

Free, expert assistance can be found at the malware removal-HJT forum.

Please go to this page, print out, read and follow as many instructions as you can, skipping any you are unable to complete:

http://forums.malwarebytes.org/index.php?showtopic=69723

Then please post your logs by starting a new thread here:

http://forums.malwarebytes.org/index.php?showforum=7

One of the trained experts will then assist you as soon as possible.

When you post, please be sure to select Track This Topic & choose one of the email options, so that you will be notified when someone responds; allow 24-48 hours before bumping your thread.

Alternatively, as a paying customer, you may wish to start a support ticket by contacting support at: support@malwarebytes.org, or by using one of the other support options here:

http://www.malwarebytes.org/premium-support.php

Also, please use the "Add Reply" button when replying here & at the other boards, so that it will be easier for everyone to follow the thread.

Thank you very much,

daledoc1

PS FYI, once you are cleaned up, you will need to update your MS Internet Explorer -- running older, insecure versions poses a security risk to your system and may have contributed to your current problem.