That was the W32/Braid@MM virus (McAfee name). It is recent - even slightly old definitions may not detect it.
Max. ------------------------------------------------------- > Hello, > > Product Name: Microsoft Windows 2000 > Product Id: 52262-005-0249992-09667 > > Process List: > NtLmSsp NT LM Security Support Provider > ProtectedStorage Protected Storage > SamSs Security Accounts Manager > SysmonLog Performance Logs and Alerts > NtLmSsp NT LM Security Support Provider > ProtectedStorage Protected Storage > SamSs Security Accounts Manager > SysmonLog Performance Logs and Alerts > > Thank you.
