Tohle je postup na Winantispy 2005, možná to bude podobné...

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride =
O2 - BHO: (no name) - {02F96FB7-8AF6-439B-B7BA-2F952F9E4800} - C:\DOCUME~1\Dave\LOCALS~1\Temp\pilld.dat
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [*dllip] C:\WINDOWS\AppPatch\dllip.exe
O4 - HKLM\..\RunOnce: [*dllip] C:\WINDOWS\AppPatch\dllip.exe rerun
O4 - HKCU\..\RunOnce: [*WinLogon] C:\WINDOWS\Microsoft.NET\harddll.exe ren time:1100814571
O16 - DPF: {70522FA0-4656-11D5-B0E9-0050DAC24E8F} - http://download.iwon.com/ct/pm3/iwonpm_8_1,0,2,5.ca b

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):
C:\WINDOWS\AppPatch <- this folder
C:\WINDOWS\Microsoft.NET\harddll.exe