One question, how did Combofix know to delte c:\programdata\ntuser.dat but MBAM and ESET did not?
I don't know specifically the answer to why that was although ComboFix does target certain conditions and will remove the hidden attributes that commercial products don't.
Also, I could PM you the download link for this file, if you like: C:\Users\Black Box\Desktop\cbsidlm-tr1_7-Advanced_Archive_Password_Recovery-SEO2-10057677.exe
No I think that was specific to your machine.
As always, many thanks!
You are very welcome.