Wednesday, 6 May 2009


About two week ago a FreeFixer user added prnet.tmp to the online file database. I've not had the chance to analyze this file myself, but from the large number the searches it must be a major problem right now.

This file is dropped in C:\WINDOWS\system32\ and adds itself to the registry under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, prnet, which starts the prnet.tmp process every time a user logs on to the machine. Those infected by this malware reports a large numbe of unwanted pop-up windows.

If you need assistance to remove prnet.tmp, please post a FreeFixer log at the FreeFixer User Group.

No comments:

Post a Comment