Hi Flaviuscrispus, Welcome to DaniWeb :D
Sorry for the delay in replying to this; as you can see, there are a lot of people with problems and not many of us available to help.
Aside from the legal aspects, malware is the next biggest problem with file sharing programs such as Limewire.
You shouldn't need to clean each users account; as long as your logged into the Administrator account, that should be good enough.
You will need to disconnect from the internet so you may wish to print these instructions. If you have problems with the Ewido scan again, continue on with the remaining steps.
The first thing you need to do is go to Window Update and get SP1a for both XP and IE (don't get SP2, at least until your system is clean).
If you have more then one partition or drive in your computer, scan only the C drive with Ewido, for the time being anyway (when requested).
Get the Pocket Killbox from here:
http://bleepingcomputer.com/files/spyware/KillBox.zip
Unzip the file to your desktop.
If any requested files cannot be deleted, run Pocket Killbox and paste the full file path in the box and click on Delete on Reboot. Click on the button with the red circle and an X in the middle; you will get a message saying File will be deleted on next reboot, Process and Reboot now?, Click Yes to reboot. (Note: the 'file path' will be something like C:\windows\system32\jiorzm.exe)
Download the latest Nailfix from here (remove the one you have if it's not nailfix.cmd):
http://www.noidea.us/easyfile/file.php?download=20050515010747824
Unzip it to your desktop, but do not run it yet.
Download, install, update, and run PurityScan uninstaller -- http://www.purityscan.com/uninstall.html
Disconnect from the net, boot into Safe Mode, and log in as Administrator.
Even if you've previously completed any of these steps, please do them again.
Double-click on the Nailfix.cmd that is on your desktop. Your desktop and icons will disappear and reappear, and a window should open and close very quickly -- this is normal.
Do a search for the for the following files and delete any instances found:
abetterinternet.txt
alchem.ini
bi.dll
espam.exe
Empty your Recycle Bin
Then run a scan of the C drive with Ewido (note: you will be posting the log from this scan when back in normal mode).
Still in Safe Mode, scan with hijackthis and have it fix the following entries:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus7.hpwis.com/
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKCU\..\Run: [Hlidv] C:\WINDOWS\System32\??chost.exe
O4 - HKCU\..\Run: [Jws9RRZpe] shuap05.exe
O4 - Startup: Download Plus.lnk = C:\Documents and Settings\Owner\Application Data\DownloadPlus.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusear...?p=ZSzeb02942US
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
Go to the following locations and delete the highlighted files:
C:\WINDOWS\Nail.exe
C:\WINDOWS\svcproc.exe
C:\WINDOWS\System32\??chost.exe
C:\Documents and Settings\Owner\Application Data\DownloadPlus.exe
Do a search for shuap05.exe and delete any instances found.
Empty your Recycle Bin, reboot normally, close any open browser windows, scan with hijackthis, and post a new log along with the Ewido log.
