fxa1.tmp (in relation to PE_Parite.B)

[Mr. Nutty]

I am currently trying to get rid of the PE_Parite.A virus
that has infected my computer. I'm using Trend Micro's
housecall scan to locate and clean out the virus. I am
doing everything right to get rid of it. (closing
explorer, turning off system restore, deleting PINF from
regedit and such.) But the only file that the
scan "CanNotAccess" is fxa1.tmp It is located in
C:\Documents and Settings\Jason\Local Settings\Temp\
I believe that it is because a program running at the time
of the scan is using that file. The thing is that I don't
know what program it is or what fxa1.tmp (or any other tmp
file for that matter) does. Could someone please tell me
what to do with fxa1.tmp so that I can get rid of or clean
it. Oh, and also fxa1.tmp was the only file in the scan
that was infected with the PE_Parite.B, all the others
were .A, or if you know a better way to get rid of
PE_Parite.A please let me know. Thank you. --Mr. Nutty

 

[Mr. Nutty]

DOes no one know what I'm talking about?

 

[Smile Extender]

If you cannot delete that file, it sounds like the virus is still active on
your system. Or at least some program is using that file.

Most cases you can delete locked files using this procedure:
- open command prompt (cmd.exe)
- go to desired directory (cd "C:\Documents and Settings\Jason\Local
Settings\Temp")
- rename file (ren fxa1.tmp foobar.del"
- reboot

After reboot you can delete renamed file (foobar.del). Usually you can also
delete files from safe mode.

If you like to locate which program is using that file, you can get Process
Explorer from http://www.sysinternals.com. That tool shows running processes
and also files opened by them. You can also kill almost any process from
there even if you cannot kill same process from Task Manager. It's very
handy tool, but be careful with it.

/nico