I don’t think the ‘locking theory’ is correct. While the virus warning is on the screen, the file should be somewhere in the %TEMP% folder, with a name in the form AvOxxxx.tmp (xxxx is some number). You can check if it’s there, and if it’s locked or not…