[exwizard]

When I ran a Sophos rootkit check, it listed the above program as being hidden.
I cann't delete them or access them to change the attributes. When I attempted to send them to Sophos for analysis, the files shower up as zero byte files. Sophos also listed these as having nulls in the registry entries.
Does anyone recognize what these are?
When I explore C:\aa47f the folders under it are: download, ic, lang, and new.
However it won't let me explore any deeper, giving me an "access denied" message.
I already have unchecked "hide protected op sys files" and checked "show hidden files"

[Phantom010]

Have you tried Unlocker?

Or, take ownership of the file.

If using XP Pro, open My Computer or My Documents. Click on Folder Options and select the View tab. At the bottom of the list, uncheck the "Use simple file sharing (recommended)" box to display the Security tab when you open a folder's Properties.

If using XP Home, you have to Start Windows in Safe Mode and log in with the Administrator account. The Security tab will appear.

[exwizard]

Unlocker said there were no locks.
However I was able to take ownership and delete them.
I then ran command line version of RegDelNull (sysinternals) to make sure the registry entries got deleted.
Thank you very much.

[Phantom010]

You're welcome!