Błędy rundll.dll

[Gość: Tomasso]

Po uruchomieniu systemu Xp pojawiają mi się błedy że coś jest nie tak.Chyba mam Buggera jakiegoś.Nie można utworzyć pliku txt poniważ znika rozszerzenie.Musiałem je dodać ręcznie.
Problem pojawił się podczas nortmalnego urzytkowania komputera.AdwCklener nic nie wykrył oraz skanowanie Mmb też nic nie wykryło.
Załączam logi OTL oraz FRST.

wklej.org/id/1725849/
wklej.org/id/1725859/
wklej.org/id/1725860/

[kolobos]

Obok frst.exe utworz plik fixlist.txt z zawartoscia:
Task: C:\WINDOWS\Tasks\Bidaily Synchronize Task[in].job => c:\documents and settings\all users\dane aplikacji\{c43bacae-239b-8d80-c43b-bacae239b2b8}\download.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\SMupdate2.job => C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll <==== ATTENTION
Task: C:\WINDOWS\Tasks\SMupdate3.job => C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll <==== ATTENTION
HKU\S-1-5-21-343818398-776561741-1177238915-1004\...\Run: [Web Companion] => C:\Program Files\Lavasoft\Web Companion\Application\WebCompanion.exe [1376016 2015-05-25] (Lavasoft)
SearchScopes: HKU\S-1-5-21-343818398-776561741-1177238915-1004 -> DefaultScope {BDF61FAE-9D19-40F0-8F34-688DEB334CA9} URL = http://securedsearch.lavasoft.com/results.php?pr=vmn&id=webcompa&ent=ch_WCYID10140_majorgeeks_150528&q={searchTerms}
SearchScopes: HKU\S-1-5-21-343818398-776561741-1177238915-1004 -> {BDF61FAE-9D19-40F0-8F34-688DEB334CA9} URL = http://securedsearch.lavasoft.com/results.php?pr=vmn&id=webcompa&ent=ch_WCYID10140_majorgeeks_150528&q={searchTerms}
Toolbar: HKU\S-1-5-21-343818398-776561741-1177238915-1004 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
FF DefaultSearchEngine: Ad-Aware SecureSearch
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Ad-Aware SecureSearch
FF Homepage: hxxp://securedsearch.lavasoft.com/?pr=vmn&id=webcompa&ent=hp_WCYID10140_majorgeeks_150528
FF NewTab: hxxp://securedsearch.lavasoft.com/?pr=vmn&id=webcompa&ent=hp_WCYID10140_majorgeeks_150528
FF SearchPlugin: C:\Documents and Settings\Tomasz\Dane aplikacji\Mozilla\Firefox\Profiles\ad22heh9.default\searchplugins\securesearch.xml [2015-05-28]
FF Extension: Fast Start - C:\Documents and Settings\Tomasz\Dane aplikacji\Mozilla\Firefox\Profiles\ad22heh9.default\Extensions\1403434611_xpi [2014-06-22]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found]
R2 LavasoftTcpService; C:\Program Files\Lavasoft\Web Companion\TcpService\2.3.4.2\LavasoftTcpService.exe [2751816 2015-05-25] (Lavasoft Limited)
R2 SearchProtectionService; C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [19816 2015-05-25] ()
S3 avchv; system32\DRIVERS\avchv.sys [X]
S4 IntelIde; No ImagePath
S1 scfd_1_10_0_16; system32\drivers\scfd_1_10_0_16.sys [X]
2015-05-30 21:25 - 2015-05-30 21:25 - 00000000 ____D () C:\_OTL
Winsock: Catalog9 01 C:\WINDOWS\system32\LavasoftTcpService.dll [347976 2015-05-28] (Lavasoft Limited)
Winsock: Catalog9 02 C:\WINDOWS\system32\LavasoftTcpService.dll [347976 2015-05-28] (Lavasoft Limited)
Winsock: Catalog9 16 C:\WINDOWS\system32\LavasoftTcpService.dll [347976 2015-05-28] (Lavasoft Limited)
2015-05-28 12:00 - 2015-05-28 12:06 - 00000000 ____D () C:\AdwCleaner
2015-05-28 01:42 - 2015-05-28 01:42 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Documents and Settings\Tomasz\Moje dokumenty\SpyHunter-Installer.exe
2015-05-24 17:20 - 2015-05-24 17:20 - 00000000 _____ () C:\Documents and Settings\Tomasz\Ustawienia lokalne\Temp.dat
2015-05-24 17:18 - 2015-05-30 21:34 - 00000432 _____ () C:\WINDOWS\Tasks\SMupdate3.job
2015-05-24 17:18 - 2015-05-30 21:29 - 00000432 _____ () C:\WINDOWS\Tasks\SMupdate2.job
2015-05-24 17:18 - 2015-05-24 17:20 - 00000000 ____D () C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\BrowserHelper
2015-05-24 17:16 - 2015-05-24 17:16 - 00000000 ____D () C:\Documents and Settings\Tomasz\Ustawienia lokalne\Dane aplikacji\CrashRpt
2015-05-24 17:14 - 2015-05-29 17:14 - 00000404 _____ () C:\WINDOWS\Tasks\Bidaily Synchronize Task[in].job
EmptyTemp:

W FRST wybierz Fix.

[Gość: tomasso]

Dziękuję za odpowiedz.
Niestety nie pomoglo dalej mam błędy po starcie windowsa.
Wykonałem skrypt i zrobiłem nowe logi oto one;
wklej.org/id/1731411/
wklej.org/id/1731415/
Prosżę o pomoc chciałbym uratować system mam niesprawny CDROM nie bedę mógł zrobić formata/naprawy . Co ma dalej robić????

[Gość: Kolobos]

Nie pomoglo bo na biezaco infekujesz! Pobrales TeamViewer ze strony instalujacej szkodliwe dodatki i zainstalowales system jeszcze bardziej! Nie pobieraj programow z dobrychprogramow lub innych stron oferujacych wlasne menadzery pobierania.

Odinstaluj:
do-search uninstall (HKLM\...\do-search uninstall) (Version: - do-search) <==== ATTENTION!
Sale Charger (HKLM\...\Sale Charger) (Version: 2.0.5635.15646 - Sale Charger) <==== ATTENTION

Uzyj AdwCleaner, opcja Szukaj i usun:
www.bleepingcomputer.com/download/adwcleaner/dl/125/
Nowy Fixlist.txt dla FRST:
(XTab system) C:\Program Files\MiuiTab\ProtectService.exe
(SearchProtect) C:\Program Files\MiuiTab\CmdShell.exe
() C:\Documents and Settings\All Users\Dane aplikacji\322cb724-1680-423d-8862-1b52ca5027ad\PluginContainer.exe
(XTab system) C:\Program Files\MiuiTab\HPNotify.exe
() C:\Program Files\Common Files\322cb724-1680-423d-8862-1b52ca5027ad\Updater.exe
() C:\Documents and Settings\All Users\Dane aplikacji\322cb724-1680-423d-8862-1b52ca5027ad\plugins\2\Plugin.exe
() C:\Documents and Settings\All Users\Dane aplikacji\322cb724-1680-423d-8862-1b52ca5027ad\plugins\3\Plugin.exe
() C:\Documents and Settings\All Users\Dane aplikacji\322cb724-1680-423d-8862-1b52ca5027ad\plugins\3\Plugin.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://do-search.com/?type=hppp&ts=1433620100&z=9d4462ec05791f3a7171485gaz0c0ceqdo1efe8w5q&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://do-search.com/web/?type=dspp&ts=1433620100&z=9d4462ec05791f3a7171485gaz0c0ceqdo1efe8w5q&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://do-search.com/?type=hppp&ts=1433620100&z=9d4462ec05791f3a7171485gaz0c0ceqdo1efe8w5q&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://do-search.com/web/?type=dspp&ts=1433620100&z=9d4462ec05791f3a7171485gaz0c0ceqdo1efe8w5q&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180&q={searchTerms}
HKU\S-1-5-21-343818398-776561741-1177238915-1004\Software\Microsoft\Internet Explorer\Main,Start Page = http://do-search.com/?type=hppp&ts=1433620100&z=9d4462ec05791f3a7171485gaz0c0ceqdo1efe8w5q&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180
HKU\S-1-5-21-343818398-776561741-1177238915-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://do-search.com/?type=hppp&ts=1433620100&z=9d4462ec05791f3a7171485gaz0c0ceqdo1efe8w5q&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180
URLSearchHook: HKLM - Default Value = {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?type=dspp&ts=1433620100&z=9d4462ec05791f3a7171485gaz0c0ceqdo1efe8w5q&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?type=dspp&ts=1433620100&z=9d4462ec05791f3a7171485gaz0c0ceqdo1efe8w5q&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-343818398-776561741-1177238915-1004 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?type=dspp&ts=1433620100&z=9d4462ec05791f3a7171485gaz0c0ceqdo1efe8w5q&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180&q={searchTerms}
SearchScopes: HKU\S-1-5-21-343818398-776561741-1177238915-1004 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180&ts=1433620114&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-343818398-776561741-1177238915-1004 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180&ts=1433620114&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-343818398-776561741-1177238915-1004 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?type=dspp&ts=1433620100&z=9d4462ec05791f3a7171485gaz0c0ceqdo1efe8w5q&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180&q={searchTerms}
SearchScopes: HKU\S-1-5-21-343818398-776561741-1177238915-1004 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=WDCXWD800BB-00FJA0_WD-WCAJ92433180&ts=1433620114&type=default&q={searchTerms}
BHO: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files\MiuiTab\SupTab.dll [2015-06-03] (Thinknice Co. Limited)
BHO: Sale Charger -> {7a38e53c-e000-41e4-9b5a-47447db81c2b} -> C:\Program Files\Sale Charger\Extensions\7a38e53c-e000-41e4-9b5a-47447db81c2b.dll [2015-06-06] ()
FF DefaultSearchEngine: Ad-Aware SecureSearch
FF SelectedSearchEngine: Ad-Aware SecureSearch
FF Homepage: hxxp://securedsearch.lavasoft.com/?pr=vmn&id=webcompa&ent=hp_WCYID10140_majorgeeks_150528
FF NewTab: hxxp://securedsearch.lavasoft.com/?pr=vmn&id=webcompa&ent=hp_WCYID10140_majorgeeks_150528
R2 IHProtect Service; C:\Program Files\MiuiTab\ProtectService.exe [125056 2015-06-03] (XTab system)
R2 Service Mgr SaleCharger; C:\Documents and Settings\All Users\Dane aplikacji\322cb724-1680-423d-8862-1b52ca5027ad\plugincontainer.exe [653584 2015-06-06] () <==== ATTENTION
R2 Update Mgr SaleCharger; C:\Program Files\Common Files\322cb724-1680-423d-8862-1b52ca5027ad\updater.exe [575248 2015-06-06] () <==== ATTENTION
U3 aa3oobvz; C:\WINDOWS\system32\Drivers\aa3oobvz.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
2015-06-06 21:48 - 2015-06-06 21:48 - 00000000 ____D () C:\Program Files\MiuiTab
2015-06-06 21:48 - 2015-06-06 21:48 - 00000000 ____D () C:\Documents and Settings\Tomasz\Dane aplikacji\do-search
2015-06-06 21:48 - 2015-06-06 21:48 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\IHProtectUpDate
2015-06-06 21:47 - 2015-06-06 21:49 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\322cb724-1680-423d-8862-1b52ca5027ad
2015-06-06 21:47 - 2015-06-06 21:47 - 00709248 _____ (Installer ) C:\Documents and Settings\Tomasz\Moje dokumenty\TeamViewer(13319)-dp.exe
2015-06-06 21:47 - 2015-06-06 21:47 - 00000000 ____D () C:\Program Files\Sale Charger
2015-06-06 21:47 - 2015-06-06 21:47 - 00000000 ____D () C:\Program Files\Common Files\322cb724-1680-423d-8862-1b52ca5027ad

[Gość: Tomasso]

Wykonalem wszystko o czym pisałeś.Podczas startu systemu pokazjue mi sie to:
postimg.org/image/46t897bz7/
postimg.org/image/yhctsdqa7/
Wykonałem nowe logi FRST co mam dalej robić?
wklej.org/id/1732220/
wklej.org/id/1732226/
wklej.org/id/1732229/
wklej.org/id/1732231/

[Gość: Kolobos]

Odinstaluj sterowniki ati i zainstaluj ponownie.

Logi sa ok, usun katalog C:\FRST i to wszystko.