ps.a3d???

[Gmuruillo]

Logfile of HijackThis v1.99.1
Scan saved at 02:32:56 p.m., on 18/09/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\ADSF\System32\smss.exe
C:\ADSF\system32\csrss.exe
C:\ADSF\system32\services.exe
C:\ADSF\system32\lsass.exe
C:\ADSF\system32\svchost.exe
C:\ADSF\System32\svchost.exe
C:\ADSF\System32\svchost.exe
C:\ADSF\System32\svchost.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\ADSF\system32\spoolsv.exe
C:\Archivos de programa\ewido anti-malware 4.0\guard.exe
C:\Archivos de programa\ewido anti-spyware 4.0\guard.exe
C:\ADSF\System32\svchost.exe
C:\ADSF\System32\wdfmgr.exe
C:\ADSF\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE
C:\Archivos de programa\SlySoft\AnyDVD\AnyDVD.exe
C:\Archivos de programa\ewido anti-malware 4.0\ewido.exe
C:\Archivos de programa\QuickTime\qttask.exe
C:\Archivos de programa\iTunes\iTunesHelper.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\iPod\bin\iPodService.exe
C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
C:\ADSF\System32\LVComsX.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\Source Engine\OSE.EXE
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {8199CDD4-F8E5-456A-8342-89EF71F23766} - C:\Archivos de programa\PLUS!\safesuk.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\ADSF\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\ADSF\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [AnyDVD] C:\Archivos de programa\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [!ewido] "C:\Archivos de programa\ewido anti-malware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Archivos de programa\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Archivos de programa\Yahoo!\Messenger\YahooMessenger.exe (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Archivos de programa\Yahoo!\Messenger\YahooMessenger.exe (file missing)
O12 - Plugin for .pdf: C:\Archivos de programa\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: http://www.phazeddl.com
O16 - DPF: {00000000-0000-0000-0000-020050050000} - http://209.58.80.244/wallpaper/mexico/mxlip5.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0F222EC8-205D-463F-90C9-D7249B333F09} (VacPro.int_ver1) - http://advnt01.biz/dialer/int_ver1.CAB
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/mex_ver34_35.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARCHIV~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documentos\Settings\artm_new.dll
O20 - Winlogon Notify: winf44 - C:\ADSF\SYSTEM32\winf44.dll
O21 - SSODL: SysTray.Exconga - {7722ECFF-4E56-4E5b-B53C-E65294F575E0} - C:\ADSF\System32\oelgafbe.dll (file missing)
O21 - SSODL: WyDZPGsr - {253B686C-8F91-C2C6-FCD4-80985C33B708} - C:\ADSF\System32\ylyqe.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ewido anti-malware 4.0 guard - Unknown owner - C:\Archivos de programa\ewido anti-malware 4.0\guard.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Archivos de programa\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe


someone help please :sad:

[Gmuruillo]

ahh someone help me please im going nuts :sad:

[LonnyRJones]

Hello

Run Hijackthis click >"config" then "misc tools" >"delete file on reboot"
(exact spelling counts!!! so dont browse to the files)
Copy/Paste the bolded line below into the File name box then click Open,
C:\Documents and Settings\All Users\Documentos\Settings\artm_new.dll

Answer yes to the prompt to reboot the PC
Once windows has restarted Start Hijackthis and place a check next to these items If there.
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {8199CDD4-F8E5-456A-8342-89EF71F23766} - C:\Archivos de programa\PLUS!\safesuk.dll (file missing)
O16 - DPF: {00000000-0000-0000-0000-020050050000} - http://209.58.80.244/wallpaper/mexico/mxlip5.exe
O16 - DPF: {0F222EC8-205D-463F-90C9-D7249B333F09} (VacPro.int_ver1) - http://advnt01.biz/dialer/int_ver1.CAB
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/mex_ver34_35.CAB
O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documentos\Settings\artm_new.dll
O21 - SSODL: SysTray.Exconga - {7722ECFF-4E56-4E5b-B53C-E65294F575E0} - C:\ADSF\System32\oelgafbe.dll (file missing)
O21 - SSODL: WyDZPGsr - {253B686C-8F91-C2C6-FCD4-80985C33B708} - C:\ADSF\System32\ylyqe.dll (file missing)
====================================
Hit fix checked and close Hijackthis.

Post a new hijackthis log and one from Haxfix >
Download haxfix.exe. http://users.telenet.be/marcvn/tools/haxfix.exe
Save it to your desktop.
Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files\haxfix)
Checkmark "Create a desktop icon".
Click "Next".
When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed.
Click "Finish".
A red "dos window" (dos box) will open.
Select option 1. Make logfile by typing 1 and then pressing Enter.
Haxfix will start scanning the computer. When it is finished a logfile will open.
Copy the contents of that logfile and paste it into this thread.

[tashi]

This topic has been closed to prevent others with similar issues posting in it.
If you need it re-opened please send me or your helper a private message (pm) and provide a link to the thread.

Applies only to the original topic starter.

FYI for future reference:
If you have waited four days for advice post here. (http://forums.spybot.info/showthread.php?p=4836#post4836)

RE:
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Please see:
You and Windows, a joint effort (http://forums.spybot.info/showpost.php?p=25290&postcount=4)