Is this Spyware?

[cc02asm]

I have been analysing the processes running on our Windows NT 4.0. server. There is one process that I don't know and that is 'tkl.exe'. It is stored in a directory that I don't know either : c:\winnt\system32\wbem\mof\bad\tkl.exe

Does anyone know what this process and / or directory location is. Is it malicious code or is it a legitimate program? Any help would be greatly appreciated.

Thanking you in advance,

Andy Marshall

 

[crow053]

I googled it, and didnt come up with much on it. However, the few instances of tkl.exe ran in windows, not system32. Bad and mof (mofo?) seems like a tipoff that it isnt any good.

 

[cc02asm]

I also googled it and got nothing!! I agree that it doesn't look any good. If anyone else can shed any light on this it would be greatly appreciated,

Many Thanks,

Andy

 

[Xaqte]

This is the closest that I could find.

 

[Diancecht]

I'd run a full scan, but I think the path "/mof/bad" and "/mof/good" are ok under wbem.

Cheers,

Dian