Exterminate It! Antimalware


Known threats:700,085 Last Update:March 01, 12:55


Just want to say that apparently your Exterminate It has worked like a charm. I was infected with a most troublesome Malware Trojan that kept replicating every time McAfee found, blocked and removed it... most annoying for several days... until Mr. Google led me to your door. What a God send!

With thanks,

Tom S.

File: E.tmp

Location of E.tmp and Associated Malware

Check whether E.tmp is present in the following locations:

E.tmp file locations that are Windows version independent:

  • C:\Windows\System32\E.tmp

Windows 2000, Windows XP, Windows Server 2003 specific E.tmp file locations:

  • C:\Documents And Settings\USER_NAME\Local Settings\Temp\E.tmp
  • C:\Documents And Settings\USER_NAME\Application Data\E.tmp

Windows Vista, Windows Server 2008, Windows 7, Windows 8 specific E.tmp file locations:

  • C:\Users\USER_NAME\AppData\Local\Temp\E.tmp
  • C:\Users\USER_NAME\AppData\Roaming\E.tmp

If you find E.tmp file in any of these locations, your computer is very likely to be infected with the following malware:

IMPORTANT: Malware files can be camouflaged with the same file names as legitimate files. The E.tmp file is associated with malware only if found in the locations listed above.


Different Variations of E.tmp File^

File SizeFile Md5Last Seen
885761C5E79F5F4CAAB5F5C9A69AB91D478B2Dec 19, 2009
52736936F0FD517D02A8E89E52ED62FFEF8AFDec 18, 2009
172EB3A89FB6F4C21EAC5145B4EAAFDEA22Dec 18, 2009
1894466EFBC71E272DFC1029DB3F61AD77EA0Dec 18, 2009
31068A4A2C8D7B364B0AB7DF12485E36D749ADec 21, 2009
277120DCBFA708CD0A1AC55D2145FADCD795EDec 21, 2009
73881697DD43C7D62AE5DC4541421F842782D3Dec 23, 2009
44DED3877F126DBBC44BF8BF3130029B75Dec 24, 2009
74188892A0F5C84AD644BFEEAD0983AAA2F242Dec 28, 2009
10649691E592A1D3174CB49708B1517CFD072FDec 28, 2009
532483201FC905029F9760E77EF90B695D807Jan 9, 2010
27738B3A95CD4F28A3350CF5531BB5F5640FDJan 11, 2010
374784E23FF51982099641B92BE707FBDE54CBJan 13, 2010
8063C0C35BE75E9BBA8C5285D2D060BD47Jan 18, 2010
88FA6CFA2C37E83060E5AD79B3597E2263Jan 18, 2010
4371242F9E95C5BCFEB483D123E09FCE377F8Jan 22, 2010
124C9799503765A00465F184CC26ED33544Jan 30, 2010
245769166C1DA45A95F326F4136B021E7E365Feb 5, 2010
37376B21C88A7ADD7AFAC981011013CC37BBAFeb 7, 2010
1284421A257E6684562CEFA70B7A78DDE71Feb 8, 2010
208AFD65A5FF5515C33AD410E9E6F627171Feb 8, 2010
204F5C6030A04B3F7467A15E7F78083C51BFeb 12, 2010
5534AAF437BA33FCFDD483AB8A769B0B270EFeb 16, 2010
245761352065A893219E3C245FDAA319F97B9Feb 18, 2010
208DCA9B7EE497FCD90C5B034B0878A5803Feb 18, 2010
128BDE63BBC92AC3D96554AD5D42B5E5FB1Feb 22, 2010
7326727F1FFA06C75DDB6E32DBC368F571102FFeb 25, 2010
18944862F11764F65F3887F5C8CFA8FAEEDE0Feb 25, 2010
1249963E6330D1D4AAF87F61993C075CD10Mar 6, 2010
42544EE828BCE9A1D4EC4B3923AEC5F501E4DMar 8, 2010
42544C5B6858526E193B3E5DE3F9DF9E12364Mar 11, 2010
2406467775675176D6234E3802CC238F153A7Mar 22, 2010
168302C0663CB0D983B2B9D2E3BA92B658CMar 23, 2010
44B90F93C696F7888BF0922CD4D49688DAMar 30, 2010
124F6E3ABA54B951DAFA3A754103856DCE6Mar 31, 2010
44ACDA5BBDAB94A897586544409CCC4DB8Mar 31, 2010
378881218E1344498F45E035677FDD89BEED6Apr 4, 2010
84E35A25A9C610F42BDE80D2D9F06C004CApr 6, 2010
7383049EE97BC7D1F1C32490EA87349E3A77FFApr 10, 2010
3225640795961E58901A49BCF875CB689F835Jun 19, 2010
7464967AA391688AC4E82C77A2CF26F65F4DC5Jul 5, 2010
110796834384C72285E0908D92A3CBAC3FB3905Jul 14, 2010
109721675EDB9E817CEF92A570B31BD66A68EF4Aug 8, 2010
94881CF0B16DBCAA4246DCE6D7565C267537Sep 2, 2010
3317760E1EE2D4C300069409DC8259173EEC27Oct 3, 2010
34406489624CA681C8445E3BB707B03E19E4D7Oct 17, 2010
317447A4A972A04D06BFE893CD6B1408A7D7BOct 24, 2010
17215EE9C7D9DC229D2921A40E899EC5FNov 3, 2010
10869769EBDBEF5207C4680BECEA8D79A362C9DDec 13, 2010
108083268A9C91CA702FEA9D96FAF5FBF743745Dec 24, 2010
15308833A3DFA311C29D48E9D62C9FD26AE1D4Jan 5, 2011
66048F5337D851B876DD9304583CD691D1312Jan 10, 2011
94208CE2A2A5A6F1E7A5D6FA31F5277EAB9ABFeb 2, 2011
1064968574F99B305AAC469CAEAF1425F5E10DFeb 7, 2011
217804863B33A8CEDF0B3F336B0C37F5AD5D566Mar 3, 2011
1067520D9C77F1E312F4EE4416002BC3F1015CDMar 5, 2011
92ED6FA9B380F68EAC5B4617A26D93C589Mar 14, 2011
84192FDFECEECF50CEA1BBCA4D0607FD35May 31, 2011
1184768067C0E66E2D24A5F2220D609BD957C62Jun 14, 2011
1074688CF3D4A2AC3C87A0F61ECD65EC951BB53Jul 3, 2011
11545605BFC10C1A0BD7C0882E9A8B52203BCB6Aug 15, 2011
120D94C024DF7DB4F20C1DEE3975F178485Sep 24, 2011
447E2A5E22CC374D169E56371A7B736A7DOct 19, 2011
374272E57B9492A4393E2BBDC43474184E9690Jan 4, 2012
6144F9CE67E9E0226079B59107B649851F96Jan 30, 2012
1018883AD219413FD7B6FEAB8EAB47E70BB7AEOct 12, 2010
241664B8085A08CDCEA74997195A35988D4B6BNov 15, 2011

Why Is It Important to Remove Malware Files?^

It is imperative that you delete malware-associated files as soon as possible because they can be used - or are already being used - to inflict serious damage on your PC, including:

  • Disrupting the normal functioning of the operating system or rendering it completely useless.
  • Hijacking valuable private information (credit card numbers, passwords, PIN codes, etc.)
  • Directing all your Web searches to the same unwanted or malicious sites.
  • Dramatically slowing down your computer.
  • Gaining total control of your PC to spread viruses and trojans and send out spam.

How to Remove E.tmp^

  1. To enable deleting the E.tmp file, terminate the associated process in the Task Manager as follows:
    • Right-click in the Windows taskbar (a bar that appears along the bottom of the Windows screen) and select Task Manager on the menu.
    • In the Tasks Manager window, click the Processes tab.
    • On the Processes tab, select E.tmp and click End Process.
  2. Using your file explorer, browse to the file using the paths listed in Location of E.tmp and Associated Malware.
  3. Select the file and press SHIFT+Delete on the keyboard.
  4. Click Yes in the confirm deletion dialog box.
  5. Repeat steps 2-4 for each location listed in Location of E.tmp and Associated Malware.
  6. Notes:

    • The deletion of E.tmp will fail if it is locked; that is, it is in use by some application (Windows will display a corresponding message). For instructions on deleting locked files, see Deleting Locked Files.
    • The deletion of E.tmp will fail if your Windows uses the NT File System (NTFS) and you have no write rights for the file. Request your system administrator to grant you write rights for the file.

Deleting Locked Files^

You can delete locked files with the RemoveOnReboot utility. You can install the RemoveOnReboot utility from here.

After you delete a locked file, you need to delete all the references to the file in Windows registry.

To delete a locked file:

  1. Right-click on the file and select Send To -> Remove on Next Reboot on the menu.
  2. Restart your computer.

The file will be deleted on restart.

Note: In the case of complex viruses that can replicate themselves, malware files can reappear in the same locations even after you have deleted those files and restarted your computer. Exterminate It! Antimalware can effectively eradicate such viruses from your computer.

To remove all registry references to a E.tmp malware file:

  1. On the Windows Start menu, click Run.
  2. In the Open box, type regedit and click OK. The Registry Editor window opens.
  3. On the Edit menu, select Find.
  4. In the Find dialog box, type E.tmp. The name of the first found registry value referencing E.tmp is highlighted in the right pane of the Registry Editor window.
  5. Right-click the registry value name and select Delete on the menu.
  6. Click Yes in the Confirm Value Delete dialog box.
  7. To delete all other references to E.tmp, repeat steps 4-6.
IMPORTANT: Malware files can masquerade as legitimate files by using the same file names. To avoid deleting a harmless file, ensure that the Value column for the registry value displays exactly one of the paths listed in Location of E.tmp and Associated Malware.