File called MGRSTS.EXE 1

[ajacko]

Can anyone tell me if they know what the file MGRSTS.EXE is? My firewall is telling me that it is trying to access the internet. I am running XP Pro SP2. The file is located in the windows folder.

I cannot find any information about it.

Neither Norton Anti-Virus or Ad-Aware have picked it up as malicious.

Many thanks.

Andrew.

 

[Happo]

Never heard of it.
Google returns nothing.
Checked on two XPSP2 systems here, nothing.
If it was me it would be quarantined by now.
Be suspicious, very suspicious.

Daniel.

 

[ajacko]

Thanks Daniel.

I have now quarantined it.

Andrew

 

[LloydSev]

I've found an entry regarding mgrsts.exe on a french website..

Here is basically what was first said ....

"Hello,

Yesterday after midday, by lighting the PC, my firewall a file of my computer intercepted which wanted to be connected on the site

http://www.slotch.com

(not very advisable site) Intrigué, I made several scans, antivirus, antispyware, similar in without failure and nothing was detected. However all is up to date, and I used Avast, Spybot and AD-Aware. I even manually checked my programs of starting and nothing unusual and subjected the file accused to Kaspersky Labs, he is syphilitic.

A small research did not give anything on Google in connection with a certain file "mgrsts.exe", which is in the repertory of Windows, I will have liked to know if you have it in your machines and if possible, if you know for what it is used.

Thank you icon_wink.gif"


" Me I had it it y' has some time, but Viruskeeper2005 quarantined"

Other than the 1 guy there who said his virus program quarantined it.. no one knew what it was or could find anything on it.

Computer/Network Technician
CCNA

 

[ajacko]

If anyone is interested, I think I have found out a little more about it.

MGRSTS.EXE kept on replacing itself everytime I booted up after I had quarantined it. So I decided to do a little further investigation.

After running HijackThis, I discovered an entry in my registry that was running a file called SQLDATA1.EXE

Other people who have had this file have been advised to remove it. (Although I could not find a reason why!) I did the same.

MGRSTS.EXE has now stopped reappearing on my pc.

As LloydSev mentioned above, it is definitely something to do with slotch.com, I traced the IP address it was trying to find.

Anyway, i'm happy now