Remover Feven do PC

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:30:31, on 17/2/2014
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\All Users\Dados de aplicativos\IePluginService\PluginService.exe
C:\Documents and Settings\All Users\Dados de aplicativos\WPM\wprotectmanager.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Arquivos de programas\MyPC Backup\BackupStack.exe
C:\Arquivos de programas\Baidu Security\Baidu Antivirus\BAVSvc.exe
C:\Arquivos de programas\Baidu Security\Baidu Antivirus\BHipsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\TIM Communicator\module\devicemon.exe
C:\Arquivos de programas\Baidu Security\PC App Store\3.15.0.4263\PCAppStoreSvc.exe
C:\Arquivos de programas\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Baidu Security\Baidu Antivirus\BavTray.exe
C:\Arquivos de programas\fst_br_58\fst_br_58.exe
C:\Documents and Settings\Administrador\Configurações locais\Dados de aplicativos\fst_br_58\upfst_br_58.exe
C:\Arquivos de programas\fst_br_27\fst_br_27.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Baidu Security\PC Faster\4.0.0.0\PcfTray.exe
C:\Arquivos de programas\MyPC Backup\MyPC Backup.exe
C:\Arquivos de programas\TIM Communicator\orolixcommunicator.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Arquivos de programas\Movies Toolbar\Datamngr\DatamngrCoordinator.exe
C:\Arquivos de programas\Movies Toolbar\Datamngr\DatamngrCoordinator.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Arquivos de programas\CCleaner\CCleaner.exe
c:\arquivos de programas\google\chrome\application\chrome.exe
C:\Arquivos de programas\AnyProtectEx\AnyProtectTrayIcon.exe
c:\arquivos de programas\google\chrome\application\chrome.exe
c:\arquivos de programas\google\chrome\application\chrome.exe
c:\arquivos de programas\google\chrome\application\chrome.exe
c:\arquivos de programas\google\chrome\application\chrome.exe
C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
C:\Documents and Settings\Administrador\Meus documentos\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R3 - URLSearchHook: Mario Forever B Toolbar - {39825cdc-02d9-4d80-93fe-fdb3860b69ee} - C:\Arquivos de programas\Mario_Forever_B\prxtbMari.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Arquivos de programas\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Mario Forever B - {39825cdc-02d9-4d80-93fe-fdb3860b69ee} - C:\Arquivos de programas\Mario_Forever_B\prxtbMari.dll
O2 - BHO: (no name) - {6EF05952-B48D-4944-AA91-57A6A1A48EF8} - C:\Arquivos de programas\Puxa Rápido\IEBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programa Auxiliar de Início de Sessão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Content Management Wizard - {B72681C0-A222-4b21-A0E2-53A5A5CA3D41} - (no file)
O2 - BHO: Textual Content Provider - {CAC89FF9-34A9-4431-8CFE-292A47F843BC} - C:\Arquivos de programas\Textual Content Provider\1.1.0.1810\TCPIE.dll
O2 - BHO: Movies Toolbar (Dist. by Koyote-Lab, Inc.) - {e5d4f4fd-a039-4670-8354-633c30a5f54e} - C:\ARQUIV~1\MOVIES~1\Datamngr\SRTOOL~1\IE\searchresultsDx.dll
O2 - BHO: Web Search Operator - {EB4A577D-BCAD-4b1c-8AF2-9A74B8DD3431} - (no file)
O2 - BHO: mysearchdial Helper Object - {EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} - C:\Arquivos de programas\Mysearchdial\1.8.21.0\bh\mysearchdial.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Arquivos de programas\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Movies Toolbar (Dist. by Koyote-Lab, Inc.) - {e5d4f4fd-a039-4670-8354-633c30a5f54e} - C:\ARQUIV~1\MOVIES~1\Datamngr\SRTOOL~1\IE\searchresultsDx.dll
O3 - Toolbar: Mario Forever B Toolbar - {39825cdc-02d9-4d80-93fe-fdb3860b69ee} - C:\Arquivos de programas\Mario_Forever_B\prxtbMari.dll
O3 - Toolbar: mysearchdial Toolbar - {3004627E-F8E9-4E8B-909D-316753CBA923} - C:\Arquivos de programas\Mysearchdial\1.8.21.0\mysearchdialTlbr.dll
O4 - HKLM\..\Run: [Baidu PC Faster 4.0.0.0] "C:\Arquivos de programas\Baidu Security\PC Faster\4.0.0.0\PCFaster.exe" -auto -start
O4 - HKLM\..\Run: [Baidu Antivirus] "C:\Arquivos de programas\Baidu Security\Baidu Antivirus\BavTray.exe" -auto
O4 - HKLM\..\Run: [fst_br_58] "C:\Arquivos de programas\fst_br_58\fst_br_58.exe"
O4 - HKLM\..\Run: [upfst_br_58.exe] C:\Documents and Settings\Administrador\Configurações locais\Dados de aplicativos\fst_br_58\upfst_br_58.exe -runhelper
O4 - HKLM\..\Run: [fst_br_27] "C:\Arquivos de programas\fst_br_27\fst_br_27.exe"
O4 - HKLM\..\RunOnce: [Del2062906] cmd.exe /Q /D /c del "C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\0.del"
O4 - HKCU\..\Run: [NextLive] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Administrador\Dados de aplicativos\newnext.me\nengine.dll",EntryPoint -m l
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Del2062546] cmd.exe /Q /D /c del "C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\0.del"
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: MyPC Backup.lnk = C:\Arquivos de programas\MyPC Backup\MyPC Backup.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xportar para o Microsoft Excel - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Exibir ou ocultar HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Arquivos de programas\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB152F69-BF1F-4CA4-A4FE-66A46B7F3937}: NameServer = 189.40.198.80 189.40.224.80
O20 - AppInit_DLLs: c:\docume~1\alluse~1\dadosd~1\wincert\win32c~1.dll c:\arquiv~1\movies~1\datamngr\mgrldr.dll
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Computer Backup (MyPC Backup) (BackupStack) - Just Develop It - C:\Arquivos de programas\MyPC Backup\BackupStack.exe
O23 - Service: Baidu Antivirus Service (BAVSvc) - Baidu, Inc. - C:\Arquivos de programas\Baidu Security\Baidu Antivirus\BAVSvc.exe
O23 - Service: Baidu Hips Service (BHipsSvc) - Baidu, Inc. - C:\Arquivos de programas\Baidu Security\Baidu Antivirus\BHipsSvc.exe
O23 - Service: Datamngr Coordinator (DatamngrCoordinator) - Koyote-Lab Inc. - C:\Arquivos de programas\Movies Toolbar\Datamngr\DatamngrCoordinator.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
O23 - Service: IePlugin Service (IePluginService) - Cherished Technololgy LIMITED - C:\Documents and Settings\All Users\Dados de aplicativos\IePluginService\PluginService.exe
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Orolix Device Monitor (OrolixDeviceMonitor) - Orolix Desenvolvimento de Software LTDA. - C:\Arquivos de programas\TIM Communicator\module\devicemon.exe
O23 - Service: Baidu PC App Store Service 3.15.0.4263 (PCAppStoreSvc_{PCAppStore_3.15.0.4263}) - Baidu Inc. - C:\Arquivos de programas\Baidu Security\PC App Store\3.15.0.4263\PCAppStoreSvc.exe
O23 - Service: Baidu PC Faster Service 4.0.0.0 (PCFasterSvc_{PCFaster_4.0.0.0}) - Baidu Inc. - C:\Arquivos de programas\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe
O23 - Service: QuestService Service - Unknown owner - C:\Documents and Settings\All Users\Dados de aplicativos\QuestService\questservice111.exe
O23 - Service: ServiceLayer - Nokia - C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Update Jump Flip - Unknown owner - C:\Arquivos de programas\Jump Flip\updateJumpFlip.exe
O23 - Service: Util Jump Flip - Unknown owner - C:\Arquivos de programas\Jump Flip\bin\utilJumpFlip.exe
O23 - Service: Wpm Service (Wpm) - Cherished Technololgy LIMITED - C:\Documents and Settings\All Users\Dados de aplicativos\WPM\wprotectmanager.exe

--
End of file - 12162 bytes

  Olá.

 Siga, por gentileza, as dicas do tutorial abaixo:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Na sua próxima resposta poste, por gentileza, o log do Adwcleaner que estará em C:\AdwCleaner\AdwCleaner[S0].txt

Ficamos na espera.

TÓPICO ARQUIVADO

Como a autora não respondeu por mais de 15 dias, o tópico foi arquivado. Caso o autor do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.