[poker_pro@hotmail.com]

I have a clean HijackThis log and I have just cleaned up from the nail-aurora
bit of fun we all seem to be finding one way or another. (what really kills
me is how you get infected even when you answer no or hit "cancel") so I have
a question now about a file that wont delete. The files name is
"Auroreco.exe245A7426.pf" and yes I know its part of that same infection,
what would you suggest I try to delete this being it keeps giving me that "in
use or write protected" message?

One other question, obviously this file is running as part of a process or
in conjunction with another file, isnt there anyway to tell what files are
associated with a file in a case like this? There must be something or
someway to find out what was installed on your PC right?

Thanx so much!

[Malke]

poker_pro@hotmail.com wrote:

> I have a clean HijackThis log and I have just cleaned up from the
> nail-aurora bit of fun we all seem to be finding one way or another.
> (what really kills me is how you get infected even when you answer no
> or hit "cancel") so I have a question now about a file that wont
> delete. The files name is "Auroreco.exe245A7426.pf" and yes I know its
> part of that same infection, what would you suggest I try to delete
> this being it keeps giving me that "in use or write protected"
> message?
>
> One other question, obviously this file is running as part of a
> process or
> in conjunction with another file, isnt there anyway to tell what files
> are associated with a file in a case like this? There must be
> something or someway to find out what was installed on your PC right?
>
> Thanx so much!

The files in Prefetch aren't running. Here's an explanation by
Microsoft:

"Windows XP Professional monitors the files that are used when the
computer starts and when you start applications. By monitoring these
files, Windows XP Professional can prefetch them. Prefetching data is
the process whereby data that is expected to be requested is read ahead
into the cache. Prefetching boot files and applications decreases the
time needed to start Windows XP Professional and start applications."

Although XP Pro is referenced, the same information applies to Home
Edition. You can delete the contents of Prefetch and it will be rebuilt
over a few days. If you do this in Safe Mode - where you should be
doing all malware cleanup work - you won't have a problem with the
files being in use.

Thanks for your nice comments in the other thread, btw.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User