Quote Originally Posted by jornsen View Post
The last 3 things sound (ordered) increasingly disturbing to me....
There are 4 other users on the machine - I guess there may be more or less bad HKCU for them as well. Should i log in as each and repeat disable or.. a trick?

How about a HJT ScanLog from Each User Account?
I still have to look at the other logs (juggling a few threads in a few different forums) A quick glance looked OK, but I want to go over them again.

I am not particularly worried about ctfmon at the moment. But, I would like to look at another scan:

Download FindAWF by noahdfear and save it to your Desktop.

--Double click FindAWF.exe and follow the instructions.
-- When the tool has finished running, a log should pop up on your Desktop (awf.txt).
-- Please submit that log for us.

Be back as soon as I can
PP