[ mikimaki @ 21.01.2010. 17:47 ] @
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:29:59 AM, on 1/21/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROTEC~1\PPTbc.EXE
C:\PROTEC~1\PPInupdt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Protector Plus\POPSCAN.EXE
C:\WINDOWS\ATKKBService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Protector Plus\PPAVMon.exe
C:\Protector Plus\PPServ.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Milan\My Documents\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2384137
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: NETTVPLUS Toolbar - {0511d7fd-5bec-4b1b-b9e1-da065f2a6a60} - C:\Program Files\NETTVPLUS\tbNETT.dll
R3 - URLSearchHook: IObitCom Toolbar - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - (no file)
O2 - BHO: (no name) - {00a6faf1-072e-44cf-8957-5838f569a31d} - (no file)
O2 - BHO: NETTVPLUS Toolbar - {0511d7fd-5bec-4b1b-b9e1-da065f2a6a60} - C:\Program Files\NETTVPLUS\tbNETT.dll
O2 - BHO: (no name) - {07b18ea1-a523-4961-b6bb-170de4475cca} - (no file)
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: (no name) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - (no file)
O2 - BHO: IObitCom Toolbar - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O3 - Toolbar: NETTVPLUS Toolbar - {0511d7fd-5bec-4b1b-b9e1-da065f2a6a60} - C:\Program Files\NETTVPLUS\tbNETT.dll
O3 - Toolbar: IObitCom Toolbar - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [Protector Plus Taskbar Control] C:\PROTEC~1\PPTbc.EXE
O4 - HKLM\..\Run: [Protector Plus InstaUpdate] C:\PROTEC~1\PPInupdt.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Search - ?p=ZCfox000
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.6.0_10) -
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: Protector Plus Anti-virus Monitor Service (ProtectorPlusAVMonitor) - Proland Software - C:\Protector Plus\PPAVMon.exe
O23 - Service: Protector Plus Service (UnRegistered) (ProtectorPlusService) - Proland Software - C:\Protector Plus\PPServ.exe

--
End of file - 8221 bytes
[ kristi1 @ 21.01.2010. 18:01 ] @
Malwarebytes uklanja tu infekciju http://download.cnet.com/Malwa...572&subj=dl&tag=button
Quick scan.

Moja preporuka je da preko add or remove programa uklonis te silne toolbare ( deinstaliras).
[ mikimaki @ 21.01.2010. 18:16 ] @
Malwarebytes' Anti-Malware 1.44
Database version: 3609
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

1/21/2010 7:08:33 AM
mbam-log-2010-01-21 (07-08-33).txt

Scan type: Full Scan (C:\|E:\|)
Objects scanned: 134102
Time elapsed: 14 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 31

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP23\A0002796.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005480.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005481.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005482.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005483.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005484.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005485.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005488.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005491.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005492.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005498.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005499.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005500.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005501.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005502.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005503.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005504.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005505.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005506.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005507.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005508.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005509.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005510.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005511.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005513.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005521.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005522.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005523.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005524.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005525.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D371CE4E-6F67-4CB6-BAA9-290C82379C04}\RP33\A0005512.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
[ Aleksandar Maletic @ 22.01.2010. 01:16 ] @
Bas zanimljivo... :))) Pa jel imas ti uopste AV? :))) Toliko MyWebSearch parazita da uleti u komp,jos nisam video...prodji jos jednom za svaki slucaj Malwarebytes'-om,ali Full scan...takodje,da bi bio siguran skini Dr.Web CureIt,to je free AV koji se ne instalira nego se pokrece dvoklikom na skinutu ikonicu...uradi sa njim Complete scan,dugo ce trajati ali je mnogo dobar alat...i kao sto kaze @kristi1,obrisi sve te toolbar-ove,smetaju ti i preko njih svasta mozes da navuces...kada sve navedeno odradis,stavi nam HJT log ponovo da vidimo sta se desava...
[ magna86 @ 22.01.2010. 01:22 ] @
ma nema potrebe za toolikim skeniranjem...dovoljan je mbam i quick scan..nema potrebe da sad gura i Dr.Web...
mada to za HJT se slazem...neka postavi nov log,reci imas li i sad problema,i zvez HJT da bi @kristi1 ili neko od moderatora znao kakvo je sad stanje.
a vezano za Antivirus...moras da imas neki antivirus...nadji neki free AV ( avast,avira,avg..)
[ valjan @ 22.01.2010. 08:28 ] @
I jos jedan mali savet - kada ubuduce instaliras neki software, nemoj ici slepo "Next > Next > Next > Finish" metodom, nego pogledaj sta se od opcija prilikom instalacije moze iskljuciti, pa sve ono sto ne znas sta je i cemu sluzi i ne znas da li ce ti ikad trebati (poput ovih Toolbarova) slobodno odstikliraj. Kod racunara od viska cesto ume da zaboli glava, i ponekad je lakse naknadno ukljuciti neku opciju nego je uklanjati...
[ Aleksandar Maletic @ 22.01.2010. 10:00 ] @
Ok @magna86,ja volim uvek da odradim sve za svaki slucaj,posebno u ovoj situaciji jer covek nema AV,ko zna sta ga je sve spopalo... :))) Od viska skeniranja ga nece zaboleti glava kao od preterane instalacije toolbar-ova... :))) A sto se tice AV-a,moja preporuka ti je Avast!5 Free Antivirus,inace ga ne gotivim ali sluzice ti,dosta je poboljsan,a i besplatan je...ako se odlucis za komercijalno resenje tu je vec spektar mogucnosti sirok,biraj sam... :)))