Malware and Virus RemovalProblems removing malware/viruses? Get help from our Malware removal experts.
Mission Statement
WindowsBBS is an online community dedicated to easily accessible technical support for those using Microsoft operating systems and other Windows software.
Our goal is to become the leading resource for computer users that require assistance with their day-to-day computer usage, including full support for networking PC's, virus & malware removal, system upgrades and general support questions.
I was asked by a client to research the appearance of large files appearing in C:\WINDOWS\TEMP (which, suspiciously, was different from %TEMP%) bearing filenames like PR1.TMP, PR2.TMP, PR7.TMP, etc. The number following the "PR" is hexadecimal and increments with each new file. The user complained of files in excess of 1GB in size, causing him to run out of space on Drive C. He was unable to delete some of these files.
Google searches revealed a handful of similar complaints, including one here at windowsbbs.com, but no resolutions.
Examining the files with a hex editor reveals that they contain e-mail. System Monitor reveals that these temp files are opened and written by Kaspersky Anti-Virus. Their size may have been exacerbated by the user's very large Outlook .pst files, as he was a heavy e-mail user.
The solution is to disable Kaspersky's anti-spam feature. Although Kaspersky still creates PRx.tmp files, they seem to be dramatically smaller when Kaspersky is not processing e-mail.
Cheers,
Miles
Keywords for Google searchers:
PR0.TMP, PR1.TMP, PR2.TMP, PR3.TMP, PR4.TMP, PR5.TMP, PR6.TMP, PR7.TMP, PR8.TMP, PR9.TMP, PRA.TMP, PRB.TMP, PRC.TMP, PRD.TMP, PRE.TMP, PRF.TMP, PR10.TMP, PR11.TMP, PR12.TMP, PR13.TMP, PR14.TMP, PR15.TMP, PR16.TMP, PR17.TMP, PR18.TMP, PR19.TMP, PR1A.TMP, PR1B.TMP, PR1C.TMP, PR1D.TMP, PR1E.TMP, PR1F.TMP (and on and on)
Last edited by mileserickson; 23rd May 2008 at 18:41.
Reason: minor grammatical edit
Didn't find the information you thought to find? Check out these Similar Threads
