the infectede files are called trz13.tmp …trz14.tmp … trz15.tmp and so on
they are locatede in C:\Documents and Settings\Admin\impostazioni locali\temp
I use windows XP