[Resolved] ZIP files locked by explorer.exe

The ESET just stops in the same place it did last time. C:\System Volume Information\MountPointManagerRemoteDatabase Note that this file is O KB, and has been sitting there, unchanged, since 2005.

Here is what ESET found: C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BookmarkExpress1.zip Win32/Bagle.gen.zip worm C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\BookmarkExpress4.zip Win32/Bagle.gen.zip worm C:\QooBox\Quarantine\C\WINDOWS\system32\exlywrqw.ini.vir Win32/Adware.Virtumonde.NEO application C:\QooBox\Quarantine\C\WINDOWS\system32\ufbenuld.ini.vir Win32/Adware.Virtumonde.NEO application C:\QooBox\Quarantine\C\WINDOWS\system32\vycdd.bak1.vir Win32/Adware.Virtumonde.NEO application C:\QooBox\Quarantine\C\WINDOWS\system32\vycdd.bak2.vir Win32/Adware.Virtumonde.NEO application C:\QooBox\Quarantine\C\WINDOWS\system32\vycdd.ini.vir Win32/Adware.Virtumonde.NEO application

Hi,

Please advise how long you have had all the zip utilities installed, 7-zip, winzip, winrar, does the issue with the zip folders still occur?
Do you have the same problem with any other type of file?



The items found by ESET are already in quarantine, which we can clean up shortly.

The folder where the online scans are hanging is the System Volume Information Folder.

The files that the scanners are hanging on are

MountPointManagerRemoteDatabase <- a system file associated with Dynamic Disks/Volumes
tracking.log <- maintenance information stored by the DLT Client service

these files may have become corrupted

we can rename these files and they will regenerate.

Please do the following:

• Go to Start->Run and type in notepad and hit OK.
• Then copy and paste the content of the following codebox into Notepad:
  
  

  @echo off 
  
  cacls c:\system~1 /e /g administrators:f
  cacls c:\system~1\MountPointManagerRemoteDatabase /e /g administrators:f
  attrib -h-s c:\system~1\tracking.log
  ren c:system~1\tracking.log tracking.log.old
  attrib -h-s c:\system~1\MountPointManagerRemoteDatabase 
  ren c:\system~1\MountPointManagerRemoteDatabase  MountPointManagerRemoteDatabase.old
  cacls c:\system~1 /e /r administrators
  del %0

• Save the file to your DESKTOP as "find.bat". Make sure to save it with the quotes.
• Once saved, the icon to click should look like this on your desktop:
  
  [external image: Posted Image]
  
• Double click find.bat. to run it. A small black box should open and close - this is normal.

Now reboot your computer.

Use the computer for about 5 minutes or so, then reboot the computer again.

Those files will have regenerated.


NEXT


Run system file checker

Have your installation disk handy

• Click Start, click Run, type cmd.exe, and then click OK.
• At the command prompt, type sfc /scannow, and then press ENTER.
  Note This command may take several minutes to finish. You may also be prompted to provide Windows installation source files when you run the sfc /scannow command.
• At the command prompt, type exit, and then press ENTER to close the command prompt.

NEXT

Please download FindAWF
Save the file to the Desktop
Double-click the FindAWF icon.

If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 1 then Enter to scan for bak folders
The scan may take a while, please be patient.

When done, awf.txt will open. Please post it's contents here.

Hi,

Please advise how long you have had all the zip utilities installed, 7-zip, winzip, winrar, does the issue with the zip folders still occur?
Do you have the same problem with any other type of file?



The items found by ESET are already in quarantine, which we can clean up shortly.

The folder where the online scans are hanging is the System Volume Information Folder.

The files that the scanners are hanging on are

MountPointManagerRemoteDatabase <- a system file associated with Dynamic Disks/Volumes
tracking.log <- maintenance information stored by the DLT Client service

these files may have become corrupted

we can rename these files and they will regenerate.

Please do the following:

• Go to Start->Run and type in notepad and hit OK.
• Then copy and paste the content of the following codebox into Notepad:
  
  

  @echo off 
  
  cacls c:\system~1 /e /g administrators:f
  cacls c:\system~1\MountPointManagerRemoteDatabase /e /g administrators:f
  attrib -h-s c:\system~1\tracking.log
  ren c:system~1\tracking.log tracking.log.old
  attrib -h-s c:\system~1\MountPointManagerRemoteDatabase 
  ren c:\system~1\MountPointManagerRemoteDatabase  MountPointManagerRemoteDatabase.old
  cacls c:\system~1 /e /r administrators
  del %0

• Save the file to your DESKTOP as "find.bat". Make sure to save it with the quotes.
• Once saved, the icon to click should look like this on your desktop:
  
  [external image: Posted Image]
  
• Double click find.bat. to run it. A small black box should open and close - this is normal.

Now reboot your computer.

Use the computer for about 5 minutes or so, then reboot the computer again.

Those files will have regenerated.


NEXT


Run system file checker

Have your installation disk handy

• Click Start, click Run, type cmd.exe, and then click OK.
• At the command prompt, type sfc /scannow, and then press ENTER.
  Note This command may take several minutes to finish. You may also be prompted to provide Windows installation source files when you run the sfc /scannow command.
• At the command prompt, type exit, and then press ENTER to close the command prompt.

NEXT

Please download FindAWF
Save the file to the Desktop
Double-click the FindAWF icon.

If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 1 then Enter to scan for bak folders
The scan may take a while, please be patient.

When done, awf.txt will open. Please post it's contents here.

I have had the zip programs installed for years and years, with no problems until recently.
As far as I know, the problem is only with .ZIP files, I don't recall having the issue with RAR files, though I don't use them all that often. I could probably uninstall 7Zip, since I don't remember the last time I needed it.

I finally remembered what I think was the moment that this all started. I had downloaded a custom map file from l4dmaps.com, which has zipped up .VPK files used in the Left 4 Dead game. One of them got stuck in my FireFox download manager window, saying it was scanning for viruses, and it staying in that status for a really long time, so I had to break out of it. I typically save them to my desktop, then uncompress them to the proper folder for use in the game. When I would try to delete the zip file after uncompressing it, that is when it would get stuck with a message saying that the file was in use. The only way to get rid of it was to use one of the commonly available unlocking utilities, which would free it up, but I still could not delete it until the next reboot.

I am testing this with a fresh, never downloaded map file from the same site, and I will see if it happens again.

I will complete the rest of the steps and report back. Thanks for all your help so far, I appreciate it!!! :-)

Find AWF report by noahdfear ©2006 Version 1.40 The current date is: Fri 03/19/2010 The current time is: 9:23:53.60 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\CREATIVE\SBDRIV~1\BAK 12/03/2002 06:06 PM 45,056 SBDrvDet.exe 1 File(s) 45,056 bytes Directory of C:\PROGRA~1\ADOBE\ACROBA~1.0\READER\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\CREATIVE\SBAUDI~1\DVDAUDIO\BAK 06/18/2003 01:00 AM 45,056 CTDVDDet.EXE 1 File(s) 45,056 bytes Directory of C:\QOOBOX\QUARAN~1\C\WINDOWS\BAK 05/11/2000 01:00 AM 90,112 UpdReg.EXE.vir 12/31/2003 06:39 PM 40,960 vsnpstd.exe.vir 2 File(s) 131,072 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\MICROS~1\BAK 06/26/2006 04:13 PM 1,207,080 wcescomm.exe.vir 1 File(s) 1,207,080 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\QUICKT~1\BAK 10/30/2005 01:57 PM 155,648 qttask.exe.vir 1 File(s) 155,648 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\CREATIVE\SHARED~1\BAK 11/17/2004 10:50 PM 258,048 CamTray.exe.vir 1 File(s) 258,048 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\NOVASTOR\NOVABA~1\BAK 04/08/2005 04:39 PM 221,184 NbkCtrl.exe.vir 1 File(s) 221,184 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\SPRITE~1\SPRITE~1\BAK 07/27/2006 10:49 AM 544,768 SpriteService.exe.vir 1 File(s) 544,768 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\TRENDM~1\INTERN~1\BAK 11/25/2005 08:51 PM 819,262 pccguide.exe.vir 1 File(s) 819,262 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\JAVA\JRE15~1.0_~\BIN\BAK 11/09/2006 04:07 PM 49,263 jusched.exe.vir 1 File(s) 49,263 bytes Directory of C:\QOOBOX\QUARAN~1\C\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK 09/05/2002 10:05 AM 45,056 LMPDPSRV.EXE.vir 1 File(s) 45,056 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 45056 Dec 3 2002 "C:\Program Files\Creative\SB Drive Det\bak\SBDrvDet.exe" 45056 Jun 18 2003 "C:\Program Files\Creative\SBAudigy2\DVDAudio\bak\CTDVDDet.EXE" 90112 May 11 2000 "C:\QooBox\Quarantine\C\WINDOWS\bak\UpdReg.EXE.vir" 40960 Dec 31 2003 "C:\QooBox\Quarantine\C\WINDOWS\bak\vsnpstd.exe.vir" 1207080 Jun 26 2006 "C:\QooBox\Quarantine\C\Program Files\Microsoft ActiveSync\bak\wcescomm.exe.vir" 155648 Oct 30 2005 "C:\QooBox\Quarantine\C\Program Files\QuickTime\bak\qttask.exe.vir" 258048 Nov 17 2004 "C:\QooBox\Quarantine\C\Program Files\Creative\Shared Files\bak\CamTray.exe.vir" 221184 Apr 8 2005 "C:\QooBox\Quarantine\C\Program Files\NovaStor\NovaBACKUP\bak\NbkCtrl.exe.vir" 544768 Jul 27 2006 "C:\QooBox\Quarantine\C\Program Files\Sprite Software\Sprite Backup\bak\SpriteService.exe.vir" 819262 Nov 25 2005 "C:\QooBox\Quarantine\C\Program Files\Trend Micro\Internet Security 2005\bak\pccguide.exe.vir" 49263 Nov 9 2006 "C:\QooBox\Quarantine\C\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe.vir" 45056 Sep 5 2002 "C:\QooBox\Quarantine\C\WINDOWS\system32\spool\drivers\w32x86\3\bak\LMPDPSRV.EXE.vir" end of report

Hi,

Please do the following:

You had an AWF infection that replaced legitmate files on your system with rogue copies and placed the originals in a different location. Lets get them restored.

Highlight and copy the list of files to be restored from the code box below below, all quotes included.

"C:\Program Files\Creative\SB Drive Det\bak\SBDrvDet.exe"
 "C:\Program Files\Creative\SBAudigy2\DVDAudio\bak\CTDVDDet.EXE"

Double-click the FindAWF icon once again.

If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 2 then Enter to restore files from bak folders

A text file will open called: files.txt
Click below the line then right click and paste the list of files to be restored.

Next, close files.txt and click Yes to save the changes.

Once files.txt is saved, FindAWF does the following:
-It attempts to terminate the process represented by each filename on the list, if running
-Deletes the rogue file from the parent folder, if present
-Copies the original file to the parent folder

When done with the above, it automatically runs a new scan and opens a new log. Please post the contents of the new awf.txt log here.

Find AWF report by noahdfear ©2006 Version 1.40 Option 2 run successfully The current date is: Fri 03/19/2010 The current time is: 13:41:50.70 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\CREATIVE\SBDRIV~1\BAK 12/03/2002 06:06 PM 45,056 SBDrvDet.exe 1 File(s) 45,056 bytes Directory of C:\PROGRA~1\ADOBE\ACROBA~1.0\READER\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\CREATIVE\SBAUDI~1\DVDAUDIO\BAK 06/18/2003 01:00 AM 45,056 CTDVDDet.EXE 1 File(s) 45,056 bytes Directory of C:\QOOBOX\QUARAN~1\C\WINDOWS\BAK 05/11/2000 01:00 AM 90,112 UpdReg.EXE.vir 12/31/2003 06:39 PM 40,960 vsnpstd.exe.vir 2 File(s) 131,072 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\MICROS~1\BAK 06/26/2006 04:13 PM 1,207,080 wcescomm.exe.vir 1 File(s) 1,207,080 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\QUICKT~1\BAK 10/30/2005 01:57 PM 155,648 qttask.exe.vir 1 File(s) 155,648 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\CREATIVE\SHARED~1\BAK 11/17/2004 10:50 PM 258,048 CamTray.exe.vir 1 File(s) 258,048 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\NOVASTOR\NOVABA~1\BAK 04/08/2005 04:39 PM 221,184 NbkCtrl.exe.vir 1 File(s) 221,184 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\SPRITE~1\SPRITE~1\BAK 07/27/2006 10:49 AM 544,768 SpriteService.exe.vir 1 File(s) 544,768 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\TRENDM~1\INTERN~1\BAK 11/25/2005 08:51 PM 819,262 pccguide.exe.vir 1 File(s) 819,262 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\JAVA\JRE15~1.0_~\BIN\BAK 11/09/2006 04:07 PM 49,263 jusched.exe.vir 1 File(s) 49,263 bytes Directory of C:\QOOBOX\QUARAN~1\C\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK 09/05/2002 10:05 AM 45,056 LMPDPSRV.EXE.vir 1 File(s) 45,056 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 45056 Dec 3 2002 "C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" 45056 Dec 3 2002 "C:\Program Files\Creative\SB Drive Det\bak\SBDrvDet.exe" 45056 Jun 18 2003 "C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" 45056 Jun 18 2003 "C:\Program Files\Creative\SBAudigy2\DVDAudio\bak\CTDVDDet.EXE" 90112 May 11 2000 "C:\QooBox\Quarantine\C\WINDOWS\bak\UpdReg.EXE.vir" 40960 Dec 31 2003 "C:\QooBox\Quarantine\C\WINDOWS\bak\vsnpstd.exe.vir" 1207080 Jun 26 2006 "C:\QooBox\Quarantine\C\Program Files\Microsoft ActiveSync\bak\wcescomm.exe.vir" 155648 Oct 30 2005 "C:\QooBox\Quarantine\C\Program Files\QuickTime\bak\qttask.exe.vir" 258048 Nov 17 2004 "C:\QooBox\Quarantine\C\Program Files\Creative\Shared Files\bak\CamTray.exe.vir" 221184 Apr 8 2005 "C:\QooBox\Quarantine\C\Program Files\NovaStor\NovaBACKUP\bak\NbkCtrl.exe.vir" 544768 Jul 27 2006 "C:\QooBox\Quarantine\C\Program Files\Sprite Software\Sprite Backup\bak\SpriteService.exe.vir" 819262 Nov 25 2005 "C:\QooBox\Quarantine\C\Program Files\Trend Micro\Internet Security 2005\bak\pccguide.exe.vir" 49263 Nov 9 2006 "C:\QooBox\Quarantine\C\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe.vir" 45056 Sep 5 2002 "C:\QooBox\Quarantine\C\WINDOWS\system32\spool\drivers\w32x86\3\bak\LMPDPSRV.EXE.vir" end of report

Hi,

Please do the following:

Double-click the FindAWF icon once again

If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 3 then Enter to remove bak folders

A text file opens called: folders.txt
Highlight and copy the following bolded list of folders to be removed from the code box below.

C:\Program Files\Creative\SB Drive Det\bak
C:\Program Files\Creative\SBAudigy2\DVDAudio\bak

Click below the line of folders.txt and paste the list.
Close folders.txt and click Yes to save the changes.

Once folders.txt is saved, FindAWF does the following:
-It deletes the contents of the bak folders
-Removes the bak folders

When done with the above, it automatically runs a new scan and opens a new log. Please post the contents of the new awf.txt log here.


NEXT

Please advise how your computer is running now and what outstanding issues there still are.

Find AWF report by noahdfear ©2006 Version 1.40 Option 3 run successfully The current date is: Fri 03/19/2010 The current time is: 16:35:01.48 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\ADOBE\ACROBA~1.0\READER\BAK 0 File(s) 0 bytes Directory of C:\QOOBOX\QUARAN~1\C\WINDOWS\BAK 05/11/2000 01:00 AM 90,112 UpdReg.EXE.vir 12/31/2003 06:39 PM 40,960 vsnpstd.exe.vir 2 File(s) 131,072 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\MICROS~1\BAK 06/26/2006 04:13 PM 1,207,080 wcescomm.exe.vir 1 File(s) 1,207,080 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\QUICKT~1\BAK 10/30/2005 01:57 PM 155,648 qttask.exe.vir 1 File(s) 155,648 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\CREATIVE\SHARED~1\BAK 11/17/2004 10:50 PM 258,048 CamTray.exe.vir 1 File(s) 258,048 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\NOVASTOR\NOVABA~1\BAK 04/08/2005 04:39 PM 221,184 NbkCtrl.exe.vir 1 File(s) 221,184 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\SPRITE~1\SPRITE~1\BAK 07/27/2006 10:49 AM 544,768 SpriteService.exe.vir 1 File(s) 544,768 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\TRENDM~1\INTERN~1\BAK 11/25/2005 08:51 PM 819,262 pccguide.exe.vir 1 File(s) 819,262 bytes Directory of C:\QOOBOX\QUARAN~1\C\PROGRA~1\JAVA\JRE15~1.0_~\BIN\BAK 11/09/2006 04:07 PM 49,263 jusched.exe.vir 1 File(s) 49,263 bytes Directory of C:\QOOBOX\QUARAN~1\C\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK 09/05/2002 10:05 AM 45,056 LMPDPSRV.EXE.vir 1 File(s) 45,056 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 90112 May 11 2000 "C:\QooBox\Quarantine\C\WINDOWS\bak\UpdReg.EXE.vir" 40960 Dec 31 2003 "C:\QooBox\Quarantine\C\WINDOWS\bak\vsnpstd.exe.vir" 1207080 Jun 26 2006 "C:\QooBox\Quarantine\C\Program Files\Microsoft ActiveSync\bak\wcescomm.exe.vir" 155648 Oct 30 2005 "C:\QooBox\Quarantine\C\Program Files\QuickTime\bak\qttask.exe.vir" 258048 Nov 17 2004 "C:\QooBox\Quarantine\C\Program Files\Creative\Shared Files\bak\CamTray.exe.vir" 221184 Apr 8 2005 "C:\QooBox\Quarantine\C\Program Files\NovaStor\NovaBACKUP\bak\NbkCtrl.exe.vir" 544768 Jul 27 2006 "C:\QooBox\Quarantine\C\Program Files\Sprite Software\Sprite Backup\bak\SpriteService.exe.vir" 819262 Nov 25 2005 "C:\QooBox\Quarantine\C\Program Files\Trend Micro\Internet Security 2005\bak\pccguide.exe.vir" 49263 Nov 9 2006 "C:\QooBox\Quarantine\C\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe.vir" 45056 Sep 5 2002 "C:\QooBox\Quarantine\C\WINDOWS\system32\spool\drivers\w32x86\3\bak\LMPDPSRV.EXE.vir" end of report I tried a quick test by downloading a zip file from the same site, saving it to my desktop, extracting it to the proper folder, and then deleting the original zip file, and it worked correctly. I will have to experiment some more, but it looks like it may be fixed. Unless you see something else that needs attention, my machine may be good to go. Thanks so much for all your help, I truly appreciate it!

Hi,

Check and see if you can get one of those online scanners to complete all the way through now we have replaced those folders.

We still have tool cleanup to do:

Lets do that now, then get back to me regarding the zip folder issue and the online scan, hopefully both are resolved now:

please do the following:

Follow these steps to uninstall Combofix

• Click START then RUN
• Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]




NEXT

Now to remove the rest of the tools that we have used in fixing your machine:

• Make sure you have an Internet Connection.
• Download OTC to your desktop and run it
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
• Click Yes to begin the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

If any logs/tools remain on your desktop > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

• It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
  Strong passwords: How to create and use them
  Then consider a password keeper, to keep all your passwords safe.
  
  
• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  
  
  
  WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop
  WOT has an addon available for both Firefox, IE and chrome.
  
  
  
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
  
• In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
  Think Prevention.
  PC Safety and Security–What Do I Need?.

I finished up the removals. I will try the Kaspersky again later, just to see if it will stop of those same files again. If it does, is there still a problem? I have seen countless posts on various forums with people having the same issue with these files, but I never did determine if it was actually a problem or not.

Hi, I haven't discovered anything that would indicate that it indicates a real problem either, there doesn't seem to be an explanation why this happens, but I'll keep digging, hopefully the recreation of those files solved the issue.

Well, if you are confident based on what logs I have posted, that any malware should be gone, then we can close this out. If push comes to shove and the problems continue, then I think a reformat would be in order. Thanks again.

You may want to start a new topic in our Windows forum and ask our expert techs about those folders, they may have more information than I

I don't believe it is a malware issue at this point, it may just be a setting that the techs can resolve for you.

I will do that. Thanks again for your help.