Question on two .exe files

[Cpt. Commander]

Hi.

Recently, two program have been trying to do something on my computer. One is called

tscr10nl.exe

and the other

mcompodd.exe.

My firewall stopped them and put a major severity flag on them. So, I back traced them and they have both came from the same place, an ISP called National Net down in Georgia. I have Googled to try and find info on both of the programs, but nothing has come up. I have sent an e-mail to the admin asking to know what the programs are because I am curious. As of yet, the admin has failed to return a message, and I suspect he/she never willl. So, any info on these two programs would be greatly appreciated.

Thanks in advance.

And please note, I am not one bit worried about these programs. They aren't viruses unless my Norton Antivirus Corporate Edition can't find them, and my firewall stopped whatever they were trying to do. I am just curious as to what they are.

[MrLinus]

Have you done a check for spyware/adware? Perhaps firing up HiJackThis!, CWShredder and Adware/Spybot to see if there is anything else with those files?

[Cpt. Commander]

Ok. I just ran Adaware and Spybot 1.3. They are both fully updated, and neither of them found the programs. Also note that my Norton Antivirus scanner is updated as well.

I have gotten advice from another online friend to move the files to a folder called backup, and to make a restore point before I do that. What do you guys think?

[jinxy]

I would suggest that you submit them to Symantec.

To do this open the quarantine click file>add item.Then navigate to the files. This will put them in quarantine where they can not do any damage. From Quarantine they can the be submitted to Symantec for evaluation. You will get a reply from Symantec within 48 hrs.

By doing this you can later restore the files if the are found to be benign.

Edit:

I just re read your post, just because Norton did not find them as a threat does not mean that they are not a threat. Norton is an Anti Virus program, it is not so good at detecting trojans.

Edit

[ss2chef]

What directories are they run out of?
Do they fireup on boot?
Any associated system try icons?

If you can stop them from running on boot, what breaks or changes? Anything?

[Tiger Shark]

Just rename them in place to .old or whatever and restart the box. If you can't find them through Google then they aren't "standard" files and therefore should not mess your box up. If they do restarting in safe mode would allow you to put them back if it fails to boot and if your printer stops working or whatever you can rename each one back to exe and see which one, (or both), makes the failed device work.

If nothing bad happens in a week or so go and delete them and any pointers to them in the registry, (backing it up before you do it of course).

[cgkanchi]

A strings output or posting those files here would be nice. Someone may be able to analyze them and find out what they do.

Cheers,
cgkanchi

[Cpt. Commander]

Sorry for not telling the specifics.

They run out of my System32 folder and start on boot. And thanks for the submitting to Symantec advice, I am going to do that right now.

[jinxy]

Let us no the result from symantec. I'm sure we would all be interested.
They may be legit process for software that you have installed, on the other hand they may not be.

[Cpt. Commander]

Guys, I am sorry but you may not believe this and I hardly can't either. I can't find them in the System32 folder now. The mcompodd.exe file has moved to WINDOWS\Prefetch. The wierd thing, it has some type of string of characters after the .exe ending now. It looks like "mcompodd.exe-31f263c9.pf" So I am guessing it isn't even a .exe file? I don't know, all thoughts I once had are just jumbled up and confused now...I am gonna search for the other file now....Gahhh....