<https://forums.malwarebytes.com/topic/25481-following-a-request-from-advanced-setup/#comment-134431>
<http://schema.org/text>
"HJT LOG ____________________________ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:29:45, on 28/09/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\\WINDOWS\\System32\\smss.exe C:\\WINDOWS\\system32\\winlogon.exe C:\\WINDOWS\\system32\\services.exe C:\\WINDOWS\\system32\\lsass.exe C:\\WINDOWS\\system32\\svchost.exe C:\\WINDOWS\\System32\\svchost.exe C:\\WINDOWS\\system32\\spoolsv.exe C:\\Program Files\\ESET\\ESET Smart Security\\ekrn.exe C:\\Program Files\\McAfee\\SiteAdvisor\\McSACore.exe C:\\WINDOWS\\System32\\svchost.exe C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\WrtMon.exe C:\\Program Files\\ESET\\ESET Smart Security\\egui.exe C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\WrtProc.exe C:\\Program Files\\Logitech\\SetPoint\\KEM.exe C:\\Program Files\\Outils PC\\SpeedFan\\speedfan.exe C:\\Program Files\\Outils PC\\Mail Washer Pro\\MailWasher.exe C:\\Program Files\\Logitech\\SetPoint\\KHALMNPR.EXE C:\\WINDOWS\\explorer.exe C:\\WINDOWS\\system32\\notepad.exe C:\\WINDOWS\\system32\\ctfmon.exe C:\\Program Files\\Outils PC\\HijackThis\\HijackThis.exe R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://www.afp.com/francais/home/ R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = about:blank R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName = Liens O2 - BHO: Spybot-S&amp;D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\\PROGRA~1\\OUTILS~1\\SPYBOT~1\\SPYBOT~1\\SDHelper.dll O2 - BHO: BHO Barre de Confiance CM-CIC - {988B07F5-7392-455A-8A1F-64935CB8B6ED} - C:\\Program Files\\BarreConfCMCIC\\TAPBar.dll O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\\PROGRA~1\\mcafee\\SITEAD~1\\mcieplg.dll O3 - Toolbar: Barre de confiance CM-CIC - {55BDF3B0-C0A8-481A-B8A6-01CD2BE0F3FD} - C:\\Program Files\\BarreConfCMCIC\\TAPBar.dll O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\\PROGRA~1\\mcafee\\SITEAD~1\\mcieplg.dll O4 - HKLM\\..\\Run: [WrtMon.exe] C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\WrtMon.exe O4 - HKLM\\..\\Run: [egui] \"C:\\Program Files\\ESET\\ESET Smart Security\\egui.exe\" /hide /waitservice O4 - HKCU\\..\\Run: [spybotSD TeaTimer] C:\\Program Files\\Outils PC\\Spybot - Search &amp; Destroy\\Spybot - Search &amp; Destroy\\TeaTimer.exe O4 - HKCU\\..\\Run: [ctfmon.exe] C:\\WINDOWS\\system32\\ctfmon.exe O4 - HKUS\\S-1-5-18\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\System32\\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\\.DEFAULT\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\System32\\CTFMON.EXE (User 'Default user') O4 - Startup: MailWasherPro.lnk = C:\\Program Files\\Outils PC\\Mail Washer Pro\\MailWasher.exe O4 - Global Startup: KEM.lnk = C:\\Program Files\\Logitech\\SetPoint\\KEM.exe O4 - Global Startup: SpeedFan.lnk = C:\\Program Files\\Outils PC\\SpeedFan\\speedfan.exe O8 - Extra context menu item: Ajouter au tueur de pub - C:\\Program Files\\Outils PC\\Maxthon\\config/blacklist.htm O8 - Extra context menu item: Download with GetRight - C:\\Program Files\\Outils PC\\GetRight\\GRdownload.htm O8 - Extra context menu item: E&amp;xporter vers Microsoft Excel - res://C:\\PROGRA~1\\MICROS~2\\OFFICE11\\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\\Program Files\\Outils PC\\GetRight\\GRbrowse.htm O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\\PROGRA~1\\MICROS~3\\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\\PROGRA~1\\MICROS~3\\INetRepl.dll O9 - Extra 'Tools' menuitem: Cr "
<https://forums.malwarebytes.com/topic/25481-following-a-request-from-advanced-setup/?tab=comments#comment-132650>