this was quite all right, except that “I” am not virus (at) avast (dot) com , but just a regular user here…
I misunderstood you too, thought you wanted to attach it here on the board…

Anyways…:

[EDIT]
you should DEACTIVATE system RESTORE, too , before going any further with Cleaning, especially if there is/was a trojan/hijacker avast doesn’t recognize yet (this winupd.exe I mean)
[/EDIT]

The file “dr.exe” you mention does sound suspicious, please scan it Online with KAV, RAV & Trend (avast resident shield must be paused for this),
or scan it with Escan in SafeMode
→ for Links to the scanners, please see “Virusremoval”

→ if they also detect this,
try moving the file to quarantine with avast in SafeMode, or via a boot-time scan
or move it manually yourself…

  • if none other scanner detects anythign in “dr.exe”, please submit it to avast, this time stating you suspect a false positive…

Also please post a new hijackthis-Log :wink: :wink: :wink:

P.S.: Also please enter
TROJANO-141
into the board-search above, there are some other topics on it, which might help you

:slight_smile: