Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


removed files now won't login

  • This topic is locked This topic is locked
2 replies to this topic

#1 mejutty


  • Members
  • 26 posts
  • Local time:07:13 AM

Posted 30 August 2010 - 01:57 PM

Ran malwarebytes on a pc due to fake av malwarebytes removed infection but now when I boot he pc and click the username to login flashes logging in then goes straight to logging out.

I have been able to get to the registry from another pc and have checked the hklm\software\microsoft\winnt\curentversion\winnt\userinit value and it is correct I have also used recovery console to replace the userinit file with one of the winxp sp3 cd but still no luck.

here is the malwarebytes log of what it did. would really appreciate some help in being able to get back into this machine.

Malwarebytes' Anti-Malware 1.46

Database version: 4504

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

30/08/2010 02:37:28 PM
mbam-log-2010-08-30 (14-37-28).txt

Scan type: Quick scan
Objects scanned: 19271
Time elapsed: 5 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\owsmdex.dll (Trojan.Hiloti.Gen) -> Delete on reboot.

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\evebiso (Trojan.Hiloti.Gen) -> Delete on reboot.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\owsmdex.dll (Trojan.Hiloti.Gen) -> Delete on reboot.
C:\WINDOWS\system32\hlps.exe (Spyware.Passwords.XGen) -> Delete on reboot.

BC AdBot (Login to Remove)


#2 mejutty

  • Topic Starter

  • Members
  • 26 posts
  • Local time:07:13 AM

Posted 30 August 2010 - 02:41 PM

ok bit more playing around and found another reg key that referrenced one of the files. there was a key in winnt\image file execution options that listed the hlps.exe as a debugger for the userinit.exe removed the debugger ref to hlps.exe and all OK

#3 Budapest


    Bleepin' Cynic

  • Moderator
  • 23,579 posts
  • Gender:Male
  • Local time:09:13 AM

Posted 30 August 2010 - 04:11 PM

As this issue appears to be resolved I am closing the topic. Please send me (or any other Moderator) a Personal Message (PM) if you would like the topic re-opened.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users