Thank you for your reply. I did everything what you recommended. I
checked also the registry. In the section
HK_LM\Software\Microsoft\Windows\CurrentVersion\Run was a key->value
ezbewvi->"C:\WINNT\System32\ezbewvi.exe". I tried to remove it but it
was immediatly restored, like some process is watching the registry.
SpyBot wrote an entry in the Run-Disabled section for this ezbewvi.
What is the effect from this action? Does it prevent running the exe
from the dll later or does it only prevent the process to run at
system startup? After rebooting, some time later svchost.exe threw an
exception, DaD in the IE was disabled, several applications could not
start. I'd like to send someone this exe and dll for checking. Whom?