Thank you Danny. Your how-to was very clear and I got it. I succeded getting rid of that nasty malware despite the difficulties. I had noticed a dll whose name changed every time but could not eradicate it. It happened to be the file you call xgwda.dll. Its localisation was either /windows, either /windows/system32. The file you call addes.dll was not resident on my system. Perheaps the former use of anti-spyware had destroyed it. No trace of javatr32.exe or ntis.exe, only javatr.exe and ntis32.exe. I had to follow the procedure twice because I forgot to boot in safe mode and I realised it was necessary when I fall upon the line "reboot your computer back to normal mode". I would suggest you explicitely mention that necessity on top of the procedure. I had already installed Firefox and used it regularly but had kept IE alive. I think I shall destroy it. It is a real threat for everybody using a PC. Congratulations for that pretty good job.