the infectede files are called trz13.tmp …trz14.tmp … trz15.tmp and so on they are locatede in C:\Documents and Settings\Admin\impostazioni locali\temp I use windows XP