[Closed] Malware that shuts down my system when I run the command

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:26:56 PM, on 3/4/2008
Platform: Windows XP SP2 (WinNT

5.01.2600)
MSIE: Internet Explorer v7.00

(7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.e

xe
C:\Program Files\Common Files\Microsoft

Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alcohol Soft\Alcohol

120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VMware\VMware

Server\vmware-authd.exe
C:\Program Files\Common

Files\VMware\VMware Virtual Image

Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program

Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program

Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Common

Files\Real\Update_OB\realsched.exe
C:\Program

Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w3

2x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP

Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common

Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\BricoPacks\Vista Inspirat

2\RocketDock\RocketDock.exe
C:\Program Files\VMware\VMware

Server\vmserverdWin32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOO

M~1.EXE
C:\Program Files\Mozilla

Firefox\firefox.exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend

Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Search Bar =

http://us.rd.yahoo.com/customize/ie/defa

ults/sb/msgr8/*http://www.yahoo.com/e

xt/search/search.html
R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Search Page =

http://us.rd.yahoo.com/customize/ie/defa

ults/sp/msgr8/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://google.bitcomet.com/
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=6

9157
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=5

4896
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Search Bar =

http://us.rd.yahoo.com/customize/ie/defa

ults/sb/msgr8/*http://www.yahoo.com/e

xt/search/search.html
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=5

4896
R0 - HKLM\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=6

9157
R1 - HKCU\Software\Microsoft\Internet

Explorer\SearchURL,(Default) =

http://us.rd.yahoo.com/customize/ie/defa

ults/su/msgr8/*http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar -

{EF99BD32-C1FB-11D2-892F-0090271D4F8

8} -

C:\PROGRA~1\Yahoo!\Companion\Installs

\cpn\yt.dll
F2 - REG:system.ini:

UserInit=userinit.exe,bar311.exe
O2 - BHO: btorbit.com -

{000123B4-9B42-4900-B3F7-F4B073EFC21

4} - C:\Program

Files\Orbitdownloader\orbitcth.dll
O2 - BHO: &Yahoo! Toolbar Helper -

{02478D38-C3F9-4efb-9B51-7695ECA0567

0} -

C:\PROGRA~1\Yahoo!\Companion\Installs

\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0

B3} - C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEHelpe

r.dll
O2 - BHO: RealPlayer Download and Record

Plugin for Internet Explorer -

{3049C3E9-B461-4BC5-8870-4C09146192C

A} - C:\Program

Files\Real\RealPlayer\rpbrowserrecordplu

gin.dll
O2 - BHO: BitComet ClickCapture -

{39F7E362-828A-4B5A-BCAF-5B79BFDFEA6

0} - C:\Program

Files\BitComet\tools\BitCometBHO_1.1.9.2

4.dll
O2 - BHO: Yahoo! IE Services Button -

{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A78

97} - C:\Program

Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class -

{761497BB-D6F0-462C-B6EB-D4DAF1D92D

43} - C:\Program

Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar -

{EF99BD32-C1FB-11D2-892F-0090271D4F8

8} -

C:\PROGRA~1\Yahoo!\Companion\Installs

\cpn\yt.dll
O4 - HKLM\..\Run: [AzMixerSel]

C:\Program

Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [LManager]

C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program

Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvCplDaemon]

RUNDLL32.EXE

C:\WINDOWS\system32\NvCpl.dll,NvStart

up
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched]

"C:\Program

Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter]

RUNDLL32.EXE

C:\WINDOWS\system32\NvMcTray.dll,NvT

askbarInit
O4 - HKLM\..\Run: [WindowNT]

c:\WINDOWS\system32\exiplorer.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program

Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TkBellExe]

"C:\Program Files\Common

Files\Real\Update_OB\realsched.exe"

-osboot
O4 - HKLM\..\Run: [HP Component

Manager] "C:\Program

Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]

C:\WINDOWS\system32\spool\drivers\w3

2x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update]

"C:\Program Files\Hewlett-Packard\HP

Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed

Launcher] "C:\Program

Files\Adobe\Reader

8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [svchosts]

D:\svchosts.exe
O4 - HKCU\..\Run: [ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run:

[BgMonitor_{79662E04-7C6C-4d9f-84C7-88

D8A56B10AA}] "C:\Program Files\Common

Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Yahoo! Pager]

"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOO

M~1.EXE" -quiet
O4 - Startup: RocketDock.lnk =

C:\WINDOWS\BricoPacks\Vista Inspirat

2\RocketDock\RocketDock.exe
O8 - Extra context menu item: &D&ownload

&with BitComet - res://C:\Program

Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload

all video with BitComet - res://C:\Program

Files\BitComet\BitComet.exe/AddVideo.ht

m
O8 - Extra context menu item: &D&ownload

all with BitComet - res://C:\Program

Files\BitComet\BitComet.exe/AddAllLink.ht

m
O8 - Extra context menu item: &Download

by Orbit - res://C:\Program

Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video

by Orbit - res://C:\Program

Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload

selected by Orbit - res://C:\Program

Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load

all by Orbit - res://C:\Program

Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to

Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11

\EXCEL.EXE/3000
O8 - Extra context menu item: Send to

&Bluetooth Device… - C:\Program

Files\WIDCOMM\Bluetooth

Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C60850

1} - C:\Program

Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java

Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C60850

1} - C:\Program

Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search -

{461CC20B-FB6E-4f16-8FE8-C29359DB100

E} - C:\Program

Files\BitComet\tools\BitCometBHO_1.1.9.2

4.dll
O9 - Extra button: Yahoo! Services -

{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A78

97} - C:\Program

Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research -

{92780B25-18CC-41C8-B9BE-3C9C571A826

3} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFI

EBAR.DLL
O9 - Extra button: @btrez.dll,-4015 -

{CCA281CA-C863-46ef-9331-5C8D4460577

F} - C:\Program

Files\WIDCOMM\Bluetooth

Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem:

@btrez.dll,-12650 -

{CCA281CA-C863-46ef-9331-5C8D4460577

F} - C:\Program

Files\WIDCOMM\Bluetooth

Software\btsendto_ie.htm
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F79568

3} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows

Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F79568

3} - C:\Program

Files\Messenger\msmsgs.exe
O16 - DPF:

{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}

(Installation Support) - C:\Program

Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: Kaspersky Anti-Virus 6.0

(AVP) - Kaspersky Lab - C:\Program

Files\Kaspersky Lab\Kaspersky Anti-Virus

6.0\avp.exe
O23 - Service: Bluetooth Service (btwdins) -

Broadcom Corporation. - C:\Program

Files\WIDCOMM\Bluetooth

Software\bin\btwdins.exe
O23 - Service: HRLFKC - Sysinternals -

www.sysinternals.com -

C:\DOCUME~1\CONFUL~1\LOCALS~1\Tem

p\HRLFKC.exe
O23 - Service: InstallDriver Table Manager

(IDriverT) - Macrovision Corporation -

C:\Program Files\Common

Files\InstallShield\Driver\1050\Intel

32\IDriverT.exe
O23 - Service: iPodService - Apple

Computer, Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: Maya 7.0 Documentation

Server (maya70docserver) - Unknown

owner - C:\Program

Files\Alias\Maya7.0\docs\wrapper.exe
O23 - Service: NOD32 Kernel Service

(NOD32krn) - Eset - C:\Program

Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver

Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. -

C:\Program Files\Common

Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: StarWind iSCSI Service

(StarWindService) - Rocket Division

Software - C:\Program Files\Alcohol

Soft\Alcohol

120\StarWind\StarWindService.exe
O23 - Service: TZCU - Sysinternals -

www.sysinternals.com -

C:\DOCUME~1\CONFUL~1\LOCALS~1\Tem

p\TZCU.exe
O23 - Service: VMware Authorization

Service (VMAuthdService) - VMware, Inc. -

C:\Program Files\VMware\VMware

Server\vmware-authd.exe
O23 - Service: VMware DHCP Service

(VMnetDHCP) - VMware, Inc. -

C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount

Manager Extended (vmount2) - VMware,

Inc. - C:\Program Files\Common

Files\VMware\VMware Virtual Image

Editing\vmount2.exe
O23 - Service: VMware Registration Service

(vmserverdWin32) - VMware, Inc. -

C:\Program Files\VMware\VMware

Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service -

VMware, Inc. -

C:\WINDOWS\system32\vmnat.exe

–
End of file - 10190 bytes


Guys, please help me.. I'm not oriented on removing malwares manually, most of the time when I encountered a Malware that is hard to remove or even cant be remove I always end up on formatting my system. In this time I concluded that I was wasting a lot of time doing that, thats why I decided to study and gather information about removing malwares.. please guys, I need a lot of help.. thanks..