Can't delete kqbmsupb.dat from my temp directory

DaveF wrote:
"Twayne" wrote in message
...
DaveF wrote:
I have a file named "kqbmsupb.dat" in my temp directory that I am
unable to delete. It doesn't appear to be locked by any program but
I keep getting an Access Denied error. When I open the properties on
the file there is no Security tab. I am an admin on the machine
which is running Windows XP SP3 and is part of a domain.

Here are some of the things I tried to delete the file and they all
failed.
1) Signed in as Administrator
2) Tried Safe Mode
3) Used Unlocker
4) Used recovery console
5) Used Sysinternals Process Explorer but file does not show up
6) Used Sysinternals Handle but file does not show up
7) Tried to quarentine it with my AV software
8) Tried to delete it with Anti-malware software

Any suggestions would be welcome.

Dave

Have you tried taking ownership of the file? If Home version, you
need Safe Mode to do so. Then you should be able to control it.
You didn't mention TaskManager or msconfig?

HTH

Twayne


It is the Pro version. Nothing out of the ordinary appears in either
task manager or msconfig. There is no security tab in properties to
change the permissions. Is there another way to take ownership?

You probably have fast user switching turned on? I think that prevents
you from getting the security tab.

Twayne

David H. Lipman wrote:
From: "DaveF"


Dave,

I was able to delete the file with GMER. Thank you very much.

Dave

YW :-)

Good catch, David!

Twayne

From: "Twayne"


| You probably have fast user switching turned on? I think that prevents
| you from getting the security tab.

| Twayne

Since this was a RootKit, it wouldn't have helped. The file is protected and hidden.
That's why it couldn't be seen in Process Explorer.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

David H. Lipman wrote:
From: "Twayne"


You probably have fast user switching turned on? I think that
prevents you from getting the security tab.

Twayne

Since this was a RootKit, it wouldn't have helped. The file is
protected and hidden. That's why it couldn't be seen in Process
Explorer.

Yup; posted that before the other showed up.

Twayne