w32.pinfi tmp files on NT4 Server

[chrism1]

We just finished cleaning up w32.pinfi/pe_perite virus on our network but we still have some remnant tmp files on an NT4 server. If we try to delete them will get a message they are in use.

We tried booting in VGA mode to scan and/or delete but we'll still get locked out of the file. There is no safe mode. At this point they don't seem to be harming anything but the weekly scan still creates the notification and we don't get the warm fuzzies just leaving them.

Any suggestions on deleting these tmp files?

 

[tahoe2]

have you tried renaming them? Are they showing up in Task Manager? If so, tey shutting them down in there, then deleting.
Are they in the registry somewhere?

Hope this helps,
Corie

 

[chrism1]

Renaming doesn't work. They are not in the task manager. The virus does make a registry entry but that has been deleted and does not refer to the tmp file.

A symptom of the virus is that it creates random named tmp files in the windows directory. One method of deleting these files is to use a Win2000 server system cd to boot to an emergency repair console. I was looking for another way.