Well it would be illegal technically to tell anybody to use ComboFix and charge them money afterwards seeing as it violates the GPL by refusing it's source.
I'm not trying to insult anybody, as this is a noble pursuit, but spotting a line in a log from Hijackthis or whatever tool might be used doesn't exactly require intimate esoteric knowledge that must be purchased. Which is more where my negativity is directed.
Sorry, I must be missing something here, what made you bring up charging people? I've read my post again and I honestly don't think I said that, if I did then I'm willing to hold my hands up and admit my mistake. I just want to note, in case I am at fault here, my training is free and is run by volunteers
What does this line mean then?
 2009-04-11 . F3F5549E69AE8509342E67E4F972CA1C . 820224 . . [6.0.6002.18005] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_2b4280d122dbbbb4\user32.dll