OK could you run a fresh FRST please and I will check the MD5, the restore may well have re-installed a legitimate copy