Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Hijack this log 03 07 09

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Hijack this log 03 07 09

Unread postby btw9052 » March 6th, 2009, 11:31 am

Please help with this trend micro log. I have been getting alot of unresponsive programs, and internet explorer pops open for no reason. Scans by spybot cannot complete. Thanks for your help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:52:16 AM, on 3/6/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {810238db-0ad4-4123-962a-14d8c803c961} - C:\WINDOWS\system32\satukivu.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [809d5726] rundll32.exe "C:\WINDOWS\system32\yubiwojo.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [jsf8j34rgfght] C:\DOCUME~1\Blaine\LOCALS~1\Temp\winloggn.exe
O4 - HKCU\..\Run: [ranejubiva] Rundll32.exe "C:\WINDOWS\system32\ripagupa.dll",s
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\DOCUME~1\Blaine\LOCALS~1\Temp\fymvah.dll",run
O4 - HKCU\..\Run: [CPM83ae64ba] Rundll32.exe "C:\WINDOWS\system32\mizuyoha.dll",a
O4 - Startup: LaunchU3.exe.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/ ... leId=21871
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = BGI.net
O17 - HKLM\Software\..\Telephony: DomainName = BGI.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{99FE86B7-DD98-4EA3-831F-70CAEA8716E4}: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = BGI.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = BGI.net
O23 - Service: Primavera Background Agent (PrmBackAgent) - Unknown owner - C:\Program Files\Common Files\Primavera Common\BackgroundAgent\PrmBackgroundAgent.exe
O23 - Service: Xerox® scanner service (Slave) - Xerox® - C:\WINDOWS\Slave.exe
O23 - Service: VNC Server (winvnc) - TightVNC Group - C:\Program Files\TightVNC\WinVNC.exe

End of file - 4007 bytes
Active Member
Posts: 1
Joined: March 6th, 2009, 11:26 am
Register to Remove

Re: Hijack this log 03 07 09

Unread postby MikeSwim07 » March 7th, 2009, 10:34 am

Hello, and Image to the Malware Removal forums.
My name is Michael I'll be glad to help you with your computer problems.

HijackThis logs can take some time to research, so please be patient with me. I know that you need
your computer working as quickly as possible, and I will work hard to help see that happen.

Please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • If after 5 days you have not responded to this topic, it will be closed, and you will need to start a new one.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • All of my posts need to be checked by a teacher, so please be patient while I attempt to remove your malware.

Make an uninstall list using HijackThis
To access the Uninstall Manager you would do the following:
  • Start HijackThis
  • Click on the Config button
  • Click on the Misc Tools button
  • Click on the Open Uninstall Manager button.
  • Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Save the file to your desktop.

Please post this log on your next reply.

Thanks, Michael
Regular Member
Posts: 4215
Joined: August 27th, 2007, 9:44 am
Location: Gone

Re: Hijack this log 03 07 09

Unread postby MikeSwim07 » March 11th, 2009, 7:16 pm

Hello btw9052,

Is this a business computer? Do you know what the domain BGI.net is?

Heavily Infected

Your computer is heavily infected. Although we have many tools available to help clean computers of infections, your computer is so heavily infected that it is impossible for me to be sure that there are not any infections left lurking around at the end of the cleaning process. Even if we get all of the infections off of your computer, it may never run as well as it did before. Malware can sometimes mess up many windows settings and can cause some programs to not work properly.

You also have signs of some very dangerous backdoor infections which can steal personal information. If indeed this is a business computer, your whole network could be infected. I am not offering you the choice to clean this computer because there are some very serious infections on this computer.

Therefor, you need to reformat and reinstall your computer. You may be thinking about how your files will be lost. This is not necessarily the case. Free backup software is available so that you can burn your files to disks so that you can restore them once you reinstall your operating system. You can also buy a backup hard-drive or a portable hard-drive to store your backups.

I recommend that you read the following website,

When Should I Format, How Should I Reinstall

You can also read this link about free backup software. Even if you don't want to reformat, it is always important that you keep backups.

Best Free Backup Software

It is also very important that you install an Anti-Virus once you reformat and reinstall your computer (or the entire network). I notice that in your previous log, you did not have an Anti-Virus installed. This is very dangerous. Without this protection you may not know if you are infected.

Here are some free Anti-Virus software.

AVG Free

Please note: Most of these free Anti-Virus programs are for personal use only. So if you are on a network, this would be illegal to use them.
Regular Member
Posts: 4215
Joined: August 27th, 2007, 9:44 am
Location: Gone

Re: Hijack this log 03 07 09

Unread postby MikeSwim07 » March 15th, 2009, 7:56 am

Do you still need help?
Regular Member
Posts: 4215
Joined: August 27th, 2007, 9:44 am
Location: Gone

Re: Hijack this log 03 07 09

Unread postby NonSuch » March 18th, 2009, 4:13 pm

Due to a lack of response, this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.
User avatar
Posts: 27780
Joined: February 23rd, 2005, 7:08 am
Location: California
Register to Remove

  • Similar Topics
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!

Who is online

Users browsing this forum: No registered users and 81 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware