MANY thanks, Milo. Your diagnosis fits better than you realise.
Hans had two of those "forceware" browser menu bars that had appeared from nowhere that he could remember authorising (he's pretty careful like that).
I removed them both - one using Windows "uninstall"; the other wouldn't go that way so I uninstalled Chrome (which is the one it had hooked to), then deleted its files. It looks as if it has done things in the registry.
I've passed that information on to Hans with a copy of the .inf file.
I compared the entries in the .inf file with my (apparently healthy) Win 7 64-bit. The first five entries are the same as I have.
The scrfile line in the Symantec has
HKLM, Software\CLASSES\scrfile\shell\open\command,,,"""%1"" %*"
whereas my PC has "%1" /S
The last entry has
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,Di sableRegistryTools,0x00000020,0
whereas my PC doesn't have that entry - but then, mine hasn't been infected.
I've sent him two versions, one with those last two entries omitted, one with them in, and the suggestion to try the first one to see if it fixes the problem, and if not to run the second.
I didn't try to run Regedit while I was up there yesterday, so I don't know if anything was trying to block that.
I'll report back if I hear more from Hans.
Last edited by Keef; 21st Feb 2013 at 23:50.