.EXE file file: can't delete

Avast Free Antivirus / Premium Security
1

I have a fresh WinXP install, with Comodo and Avast. Everything is fully updated. All install media were verified for viruses prior to the installation.

The other HD holds my previous Windows install, and nothing there has ever been executed or booted since the new install.

As I browsed thru the older install, in order to delete files to minimize a full backup, I ran thru some big .EXE files, all of them install kits of several packages (Nero, Logitech, etc).

The problem is, during several deletions, I got a message saying that either the filesystem was READ-ONLY or the file was IN USE, and therefore the latter couldn’t be deleted.

When the file was relatively small, a second or third try would succeed. But a BIG file (100MB+) couldn’t be deleted. I even rebooted and stopped Avast on-access scanner to no avail. But after I changed the file’s extension to .TXT the HD lit up for about 4 secs and then I was able to delete the file.

Based on this I have some candidates for a culprit:

– Avast VRDB (Virus Recovery database) generator;
– Comodo;
– System Restore (active for that drive);
– Unperceived virus activity;
– A CMOS virus.

Which of those could it be? Experts’ opinions are very welcome.

2

Sometimes, only using Unlocker (http://ccollomb.free.fr/unlocker/) or Delete FXP (http://www.jrtwine.com/) you can delete files that, for any reason, have a bad ‘signature’ in the Master File Table (MFT).

Some files could be removed following How to Remove Files with Reserved Names in Windows XP.

See more info: http://forum.avast.com/index.php?topic=15680.0

3

Hello Tech,

Thanks but, as I said before, I was able to delete the file before I posted. What bugs me is what was keeping that file “busy”.

One thing that I suspect was causing that is Avats! VRDB Generator checksumming the big .EXE file. Does VRDB follow directories opened by Explorer? If positive, that would explain a lot.

4

No. VRDB is just generated when the computer is idle (no keyboard and no mouse action) or when the screen saver is running. So, no, while opening Explorer the two conditions aren’t filled and VRDB is off.