Question on two .exe files

Hi.

Recently, two program have been trying to do something on my computer. One is called

tscr10nl.exe

and the other

mcompodd.exe.

My firewall stopped them and put a major severity flag on them. So, I back traced them and they have both came from the same place, an ISP called National Net down in Georgia. I have Googled to try and find info on both of the programs, but nothing has come up. I have sent an e-mail to the admin asking to know what the programs are because I am curious. As of yet, the admin has failed to return a message, and I suspect he/she never willl. So, any info on these two programs would be greatly appreciated.

Thanks in advance.

And please note, I am not one bit worried about these programs. They aren't viruses unless my Norton Antivirus Corporate Edition can't find them, and my firewall stopped whatever they were trying to do. I am just curious as to what they are.

Have you done a check for spyware/adware? Perhaps firing up HiJackThis!, CWShredder and Adware/Spybot to see if there is anything else with those files?

Ok. I just ran Adaware and Spybot 1.3. They are both fully updated, and neither of them found the programs. Also note that my Norton Antivirus scanner is updated as well.

I have gotten advice from another online friend to move the files to a folder called backup, and to make a restore point before I do that. What do you guys think?

I would suggest that you submit them to Symantec.

To do this open the quarantine click file>add item.Then navigate to the files. This will put them in quarantine where they can not do any damage. From Quarantine they can the be submitted to Symantec for evaluation. You will get a reply from Symantec within 48 hrs.

By doing this you can later restore the files if the are found to be benign.

Edit:

I just re read your post, just because Norton did not find them as a threat does not mean that they are not a threat. Norton is an Anti Virus program, it is not so good at detecting trojans.

Edit

What directories are they run out of?
Do they fireup on boot?
Any associated system try icons?

If you can stop them from running on boot, what breaks or changes? Anything?

Just rename them in place to .old or whatever and restart the box. If you can't find them through Google then they aren't "standard" files and therefore should not mess your box up. If they do restarting in safe mode would allow you to put them back if it fails to boot and if your printer stops working or whatever you can rename each one back to exe and see which one, (or both), makes the failed device work.

If nothing bad happens in a week or so go and delete them and any pointers to them in the registry, (backing it up before you do it of course).

A strings output or posting those files here would be nice. Someone may be able to analyze them and find out what they do.

Cheers,
cgkanchi

Sorry for not telling the specifics.

They run out of my System32 folder and start on boot. And thanks for the submitting to Symantec advice, I am going to do that right now.

Let us no the result from symantec. I'm sure we would all be interested.
They may be legit process for software that you have installed, on the other hand they may not be.

Guys, I am sorry but you may not believe this and I hardly can't either. I can't find them in the System32 folder now. The mcompodd.exe file has moved to WINDOWS\Prefetch. The wierd thing, it has some type of string of characters after the .exe ending now. It looks like "mcompodd.exe-31f263c9.pf" So I am guessing it isn't even a .exe file? I don't know, all thoughts I once had are just jumbled up and confused now...I am gonna search for the other file now....Gahhh....

Yep, the other file as moved and has the same string of characters and .pf ending. And nope, they aren't in the System32 folder anymore. Any suggestions now? lol

Extension File Definitions might help.

Yeah. I have already looked at that. Thanks anyways.

Damn. I didn't read that right. Ok, so the windows prefetch file is used so that it makes the program load faster. Now I understand that. But I don't udnerstand why I can't find the actual program on my computer now. It is like they are gone. Any suggestions?

Did you quarantine the files??

I have recently started to use Swat-it, to check for trojans, bots etc.
contact details below:

---------------------
Contact Information
---------------------
LockDown Corp.
One Second Online Services
827 Central Ave
Suite #258
Dover, NH. 03820

Sales 800-249-0253
Support 603-740-5666

Business Hours: Mon - Fri 10:00 AM - 8:00 PM E.S.T.

Downloads : http://www.swatit.org
Sales : [email protected]
Support : [email protected]

Can you zip the files and post them here. I'd like a look see.

Wanna link to National Net ?? Here you go>>>.

http://www.national-net.com/2003/index.php

Can you say pr0n & spam ?
;)

Quote:

---

Can you say pr0n & spam ?

---

I can but I don't see any on their website.

Run a google search on

"national net",'adult'

All I can say right now is that I know somebody that used to work for them

Thanks guys. Ok, so I woke up this morning and read all your posts made over the night and yesterday. I also did a search for those programs again. They didn't start up at boot, at least my firwall didn't catch them, and my search only turned up the .pf files for the two programs, and not the actual programs. (So obviously I can't zip them up and post them, sorry.)

Oh, and I have heard some good things on Swat-it. So thanks for the info.

Jinxy, I was going to quarintine them, and submit them to Symantec, but unfortuanatly, they disappeared before I got to them. Like I said, I still can't find them now. Maybe they self-deleted or something? I am stumped on that part....

Thanks for all of your help guys.