Multi-Av Av-cls corruption

David and Leythos,

After taking a break for the weekend I have returned to this.

Last week I was stepping through the original script. The advantage of this
was that it preserved the script intact, but the disadvantage was that it was
time consuming, and I was always taken by surprise when the event happened.
This time I put break points and markers at various point in the script, so I
could skim over the boring bits and focus on the interesting stuff.

I can now say with certainty that the event occurs when the second of the
following lines of code executes:

$Cache1=ReadValue("HKEY_LOCAL_MACHINE\SOFTWARE\Mic rosoft\Windows\CurrentVersion\Internet Settings\Cache\Paths","Directory")
del $Cache1+"\*.*" /c /f /h /s

I don’t know exactly what is going on here, because from the registry
extract I sent to Leythos last week, that path is:

"CachePath"="C:\\Documents and Settings\\Jonno\\Local Settings\\Temporary
Internet Files\\Content.IE5\\Cache1"

whereas on my computer the furthest you can get along that path is:

C:\Documents and Settings\Jonno\Local Settings\Temporary Internet Files

And when

del $Cache1+"\*.*" /c /f /h /s

was run, nothing from that folder was removed, but everything except kix.32
was deleted from av-cls and the content of my documents was deleted as before.