Hello;
thanks for any opinions or advice on this one.

I've gotten good at deleting temporary and index.dat files, (XP home edition), but one last .tmp file resists everything I've tried. The error message says it can't be deleted because it's being used by another person or program, (and I can't see anything that should be using it).

I've tried all the usual Microsoft file deletion methods as well as DeleteDoctor, Spybot, AdAware, CCleaner, EmpTemp, CleanUp40, manual deletion, and deleting from Safe mode. Nothing will remove it, (it doesn't even show up while in Safe mode) and it appears to recreate itself with a new file name, everytime we start up. Its various names have included, "~DF5BO4.tmp", "~DF9757.tmp", and "~DF445F.tmp", and many others. It is 16kb.
It lives at C:\documents and settings\default\local settings\temp.

Is there a chance this file is performing some legitimate function? If not, any suggestions as to how to get rid of it?
Many thanks;
Alan

So, it doesn't delete in safe mode, either?
File name changes... contents of file (properties) always the same?

It could be malware, but not necessarily so.

You might try clearing your prefetch files in safe mode, see if that helps the problem.

C:\windows\prefetch

Thank you for responding!
Yes, the properties do not change, just the name of the file, every time I start up.
When I start in Safe mode, the tmp file does not show up in the TEMP folder, (when I go to, "run", and type in, %temp%, it shows up as empty).
I started in Safe mode as advised, and tracked down c:\windows\preftech", and it has about 100 files in it, (or more). Do I delete any of the files in there, (all of them??)
Alan

Those files represent the OS's way of speeding up file locating. Sometimes they are leftover files from malware you've cleaned out. They will re-generate as you use the apps that placed them there, so yes, delete them. It might help.

I'll do it right now, and report back shortly!

O.K., I deleted the contents of the Preftech file, (115 items), but I still can't delete the stubborn 16kb .tmp file in the Temp folder.
Any thoughts as to what I can try next?
Thanks!

The file you are trying to delete may need a registry change to allow the deletion. Run Adaware and/or Spybot to identify the HKey in the registry.

The disclaimer..








OK. Once you have backup your registry and identified the Hkey, locate it in your registry. Use Start>Run>regedit. Right click on the Hkey and select the premissioms. Set it you FULL. Save your changes and exit regedit. Proceed to the file and delete it. Make sure the file is deleted.

If you are not sure.....DON'T!!! If in doubt refer to the warning above.

O.K., I'll give that a try if I can't find another way.

I am cautious about modifying the registry; are there
any other options?
Many thanks;
Alan

Reluctance is understood.
Once you have accomplished the needed procedure you'll feel better and be more capable of PC operation, if that's any help.

Just be in a head's up mode.
The registry is there doing what it does, and sometimes it errs for one reason or another.
It will not fix itself, so enter the operator (you) with sufficient information to do it.

Registry cleaning applications do a heck of a lot more than careful selective "pruning".
You might just as well approach this as an opportunity to learn more.

Backups mean you can readily restore the setting in the reg key to what it was before you made the change, if necessary.
single changes can be reversed by simply reversing your action(s).

You'll be OK