Se om der er noget snavs med HJT & underlige mapper

Hej.

Er der en venlig en der vil se om der er noget snavs?

Det er fordi at jeg har opdaget at der er blevet oprettet en masse underlige mapper i min web root :-/
Det er fx:
46391
F 43622

Hvis jeg forsøger at slette dem, får jeg beskeden: Cannot delete file: Cannot read from source file or disk.

Jeg kan godt gå ind i mappen, og der ligger fx følgende filer:
    . %d .con    1.31
  . %d .com3  4.03
Men hvis jeg forsøger at slette dem får jeg samme fejl. Og hvis jeg vil åbne mappen, så siger den bare: Access is denied

Her er HJT loggen:

Logfile of HijackThis v1.97.7
Scan saved at 20:35:57, on 28-05-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\WINNT\System32\llssrv.exe
C:\mysql\bin\mysqld-nt.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\WINNT\System32\lserver.exe
c:\program files\microsoft enterprise instrumentation\bin\trace service\tracesessionmanager.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Dfssvc.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\rdpclip.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINNT\system32\internat.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\mysql\bin\winmysqladmin.exe
C:\WINNT\system32\logon.scr
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\explorer.exe
C:\Documents and Settings\Administrator\Desktop\hjt\hjt.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: WinMySQLadmin.lnk = C:\mysql\bin\winmysqladmin.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Adgang for alle fjernbetjening (HKLM)
O9 - Extra 'Tools' menuitem: Adgang for alle fjernbetjening (HKLM)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38071.0961458333
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash4/cabs/swflash.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.aspupload.com/xupload/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{090D8D0C-28A4-4F8C-8E98-5F4D677A7D9A}: NameServer = 62.61.157.249,62.61.157.248
O17 - HKLM\System\CS1\Services\Tcpip\..\{090D8D0C-28A4-4F8C-8E98-5F4D677A7D9A}: NameServer = 62.61.157.249,62.61.157.248
O17 - HKLM\System\CS2\Services\Tcpip\..\{090D8D0C-28A4-4F8C-8E98-5F4D677A7D9A}: NameServer = 62.61.157.249,62.61.157.248


På forhånd tal :-)
// Rene