This one has three parts. I cleaned it by hand on Friday from a system,
after Microsoft Antispyware cleaned perhaps a dozen other items.
I'm sorry that you aren't able to send the suspected spyware report, but I
believe Microsoft will have seen this one.
There are three executables involved.
I believe you have found the hardest-to-spot of the three. I believe this
one is randomly named, but retains the same name on a given system.
There are two other parts. Look for nail.exe--can't recall for sure whether
in \windows or \windows\system32. Additionally, use the Tools, Advanced
Tools, System explorers, to see the running processes. Look for a process
whose name starts with TODO--and an executable name consisting of 6 random
letters. You can kill this process with Microsoft Antispyware, but it will
return immediately with a new name--you'll need to refresh the screen to see
the new version.
Here's how I was able to do the thing in, in the end.
I wasn't able to delete or modify the file you mention in either normal or
any safe mode.
So--I booted from the Windows CD, and chose Repair, and chose the recovery
console--this is a command prompt alternative OS, which allows you to see
some portions of the installed OS. From this, I was able, at a command
prompt to find and delete the three pieces--the ones you've spotted (I
missed the prefetch piece!) the shorter randomly named piece, and nail.exe.
On reboot, I got an error message to the effect that Windows couldn't find
nail.exe
So I searched the registry, found nail.exe appended to the line which
defines the Windows Shell, and removed it.
If you need help with this process, I'd recommend calling Microsoft PSS for
support--I believe this is within the range of services they provide for
free. If you are in the US or Canada, call 1-866-pcsafety. Elsewhere in
the world, call your local Microsoft office--the same free help is
available, although the phone call may not be free.
This free help is limited to issues with viruses and virus removal or
problems with Security patches, or obtaining them. In this case, I believe
your issue is sufficiently virus-like that it'll be within their
guidelines--in fact, their first guideline will be to try using Microsoft
Antispyware.