I have hopes in being able to clean my system i already got my World of Warcraft account stolen but was able to recover it now everything runs so slow. If ANYONE can help me it would be very greatly appreciated. >.<
DDS (Ver_09-03-16.01) - NTFSx86
Run by Owner at 16:56:29.96 on Mon 04/20/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.895.347 [GMT -7:00]
AV: Norton AntiVirus *On-access scanning enabled* (Outdated)
AV: avast! antivirus 4.8.1335 [VPS 090420-0] *On-access scanning enabled* (Updated)
FW: Norton AntiVirus *enabled*
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\lxcjcoms.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Lexmark 8300 Series\ezprint.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\DNA\btdna.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner.YOUR-D3D3F0FEB8\Desktop\dds.scr
============== Pseudo HJT Report ===============
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mDefault_Page_URL = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT5220
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page =
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_11\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [updateMgr] c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe AcRdB7_1_0
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [ccleaner] "c:\program files\ccleaner\CCleaner.exe" /AUTO
mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] "nwiz.exe" /install
mRun: [NvMediaCenter] "RUNDLL32.EXE" c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe"
mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe"
mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe
mRun: [LXCJCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCJtime.dll,_RunDLLEntry@16
mRun: [lxcjmon.exe] "c:\program files\lexmark 8300 series\lxcjmon.exe"
mRun: [EzPrint] "c:\program files\lexmark 8300 series\ezprint.exe"
mRun: [BearShare] "c:\program files\bearshare\BearShare.exe" /pause
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall
mRun: [Cleanup] c:\docume~1\owner~1.you\locals~1\temp\2009420163812_mcappins.exe /v=3 /cleanup
mRun: [msci] c:\docume~1\owner~1.you\locals~1\temp\200942016384_mcinfo.exe /insfin
mExplorerRun: [user32.dll] c:\program files\video access activex object\isamntr.exe
StartupFolder: c:\docume~1\owner~1.you\startm~1\programs\startup\ubisof~1.lnk - c:\program files\ubi soft\register\schedule.exe
StartupFolder: c:\docume~1\owner~1.you\startm~1\programs\startup\xfire.lnk - c:\program files\xfire\Xfire.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_11\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {049A470D-F818-4E34-B14D-E4E237DADCF8} - hxxp://www.shockwave.com/content/fashiondash/sis/fashiondashweb.1.0.0.21.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586-jc.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
SSODL: eitheror - {2016a466-91a2-43c6-97d8-2fd380f065ef} - c:\windows\system32\higehsg.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
STS: eitheror: {2016a466-91a2-43c6-97d8-2fd380f065ef} - c:\windows\system32\higehsg.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\owner~1.you\applic~1\mozilla\firefox\profiles\h7e2mu4t.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-offrhap&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://youtube.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-offrhap&p=
FF - plugin: c:\program files\java\jre1.5.0_11\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_11\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_11\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_11\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_11\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_11\bin\NPJPI150_11.dll
FF - plugin: c:\program files\java\jre1.5.0_11\bin\NPOJI610.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npijjiFFPlugin1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
============= SERVICES / DRIVERS ===============
R0 $sys$cor;$sys$cor;c:\windows\system32\drivers\$sys$cor.sys [2005-6-21 10368]
R1 $sys$crater;$sys$crater;c:\windows\system32\$sys$filesystem\crater.sys [2005-6-21 11904]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-4-18 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-4-18 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-4-18 138680]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-4-18 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-4-18 352920]
R3 NaiAvFilter1;NaiAvFilter1;c:\windows\system32\drivers\naiavf5x.sys --> c:\windows\system32\drivers\naiavf5x.sys [?]
S4 $sys$DRMServer;Plug and Play Device Manager;c:\windows\system32\$sys$filesystem\$sys$DRMServer.exe [2005-6-21 307200]
S4 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2006-9-2 108648]
S4 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2006-9-2 108648]
S4 CD_Proxy;XCP CD Proxy;c:\windows\CDProxyServ.exe [2005-6-21 167936]
S4 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2007-3-2 1252232]
=============== Created Last 30 ================
2009-04-18 17:22 <DIR> --d----- c:\program files\DNA
2009-04-18 17:22 <DIR> --d----- c:\docume~1\owner~1.you\applic~1\DNA
2009-04-17 00:22 <DIR> --d----- c:\docume~1\owner~1.you\applic~1\Xfire
2009-04-17 00:22 <DIR> --ds---- c:\program files\Xfire
2009-04-17 00:11 <DIR> --d----- c:\program files\THQ
2009-04-17 00:11 73,728 a------- c:\windows\system32\ISUSPM.cpl
2009-04-16 22:17 <DIR> --d----- c:\program files\Cat Daddy Games
2009-04-16 22:04 <DIR> --d----- C:\DOW
2009-04-15 17:16 268 a---h--- C:\sqmdata19.sqm
2009-04-15 17:16 244 a---h--- C:\sqmnoopt19.sqm
2009-04-15 17:08 268 a---h--- C:\sqmdata18.sqm
2009-04-15 17:08 244 a---h--- C:\sqmnoopt18.sqm
2009-04-15 16:55 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll
2009-04-15 16:54 715,264 -c------ c:\windows\system32\dllcache\ntdll.dll
2009-04-15 16:12 268 a---h--- C:\sqmdata17.sqm
2009-04-15 16:12 244 a---h--- C:\sqmnoopt17.sqm
2009-04-15 14:04 268 a---h--- C:\sqmdata16.sqm
2009-04-15 14:04 244 a---h--- C:\sqmnoopt16.sqm
2009-04-15 13:14 268 a---h--- C:\sqmdata15.sqm
2009-04-15 13:14 244 a---h--- C:\sqmnoopt15.sqm
2009-04-12 19:16 268 a---h--- C:\sqmdata14.sqm
2009-04-12 19:16 244 a---h--- C:\sqmnoopt14.sqm
2009-04-07 11:21 268 a---h--- C:\sqmdata13.sqm
2009-04-07 11:21 244 a---h--- C:\sqmnoopt13.sqm
2009-04-05 09:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Azureus
2009-04-05 09:40 <DIR> --d----- c:\docume~1\owner~1.you\applic~1\Azureus
2009-04-05 09:39 <DIR> --d----- c:\program files\Vuze(2)
2009-04-02 12:05 268 a---h--- C:\sqmdata12.sqm
2009-04-02 12:05 244 a---h--- C:\sqmnoopt12.sqm
2009-03-30 13:06 <DIR> --d----- c:\program files\Trymedia
2009-03-30 13:04 <DIR> --d----- c:\program files\GlobalStar Software
2009-03-28 21:18 268 a---h--- C:\sqmdata11.sqm
2009-03-28 21:18 244 a---h--- C:\sqmnoopt11.sqm
2009-03-28 13:40 268 a---h--- C:\sqmdata10.sqm
2009-03-28 13:40 244 a---h--- C:\sqmnoopt10.sqm
2009-03-28 08:31 <DIR> --d----- c:\docume~1\owner~1.you\applic~1\OpenOffice.org
2009-03-28 08:26 <DIR> --d----- c:\program files\OpenOffice.org 3
2009-03-26 18:53 268 a---h--- C:\sqmdata09.sqm
2009-03-26 18:53 244 a---h--- C:\sqmnoopt09.sqm
2009-03-24 18:01 268 a---h--- C:\sqmdata08.sqm
2009-03-24 18:01 244 a---h--- C:\sqmnoopt08.sqm
==================== Find3M ====================
2009-03-06 07:00 284,160 a------- c:\windows\system32\pdh.dll
2009-03-02 17:18 826,368 a------- c:\windows\system32\wininet.dll
2009-02-20 11:09 78,336 a------- c:\windows\system32\ieencode.dll
2009-02-09 03:19 1,846,272 a------- c:\windows\system32\win32k.sys
2009-02-09 03:01 728,576 a------- c:\windows\system32\lsasrv.dll
2009-02-09 03:01 617,984 a------- c:\windows\system32\advapi32.dll
2009-02-09 03:01 401,408 a------- c:\windows\system32\rpcss.dll
2009-02-09 03:01 715,264 a------- c:\windows\system32\ntdll.dll
2009-02-06 03:29 2,142,720 a------- c:\windows\system32\ntoskrnl.exe
2009-02-06 03:22 110,592 a------- c:\windows\system32\services.exe
2009-02-06 02:54 35,328 a------- c:\windows\system32\sc.exe
2009-02-06 02:49 2,020,864 a------- c:\windows\system32\ntkrnlpa.exe
2009-02-03 13:08 55,808 a------- c:\windows\system32\secur32.dll
2008-02-11 17:00 206,176 a------- c:\program files\filelist.txt
2007-12-13 16:20 275,704 a------- c:\program files\SimsCS_Uninst.exe
2007-12-13 16:20 881,912 a------- c:\program files\EAInstall.dll
2007-12-13 16:20 337,144 a------- c:\program files\eauninstall.exe
2007-05-28 20:57 0 a------- c:\docume~1\owner~1.you\applic~1\wklnhst.dat
2007-03-24 21:24 164 a---h--- c:\documents and settings\all users\hpothb07.dat
============= FINISH: 16:57:17.55 ===============
Attached Files
Edited by borderlineelite, 20 April 2009 - 08:43 PM.