drm3.exe

nkjinderi

virustotal结果如下http://www.virustotal.com/analisis/bafe0489b577c1b5c1e82c4e8dc0d23c

根据创建时间判断，估计是我那个金士顿的U盘加密软件创建的。红伞在之前是 不报的，在上报之后，它就报了。不清楚到底是不是恶意程序了。麻烦大家看一看

kingsheet

卡巴不报

揍敌客

ik:Trojan-Downloader.Win32.Banload

ledled

to VB

kingmuro

过BD

wrq

Warning

--------------------------------------------------------------------------------

In order not to compromise your security, this page will not be accessed


A virus or unwanted program has been detected
in the HTTP data on the requested page.

--------------------------------------------------------------------------------

Requested URL: http://bbs.kafan.cn/attachment.p ... 3c&t=1238758567
Information Is the TR/Agent.itn Trojan


--------------------------------------------------------------------------------

Generated by AntiVir WebGuard 9.0.3.0, AVE 8.2.0.129, VDF 7.1.3.8

BING126

没发现生成物。。  可能是误报。。

nkjinderi

难道存在这种可能说，本来不是病毒的文件，上报给红伞分析了过后，就认为是病毒?

这是回复的邮件：

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00288476.


A listing of files alongside their results can be found below:

File ID        ?Filename         Size (Byte)        Result
25307549         drm3.exe         366 KB         MALWARE

Please find a detailed report concerning each individual sample below:

?Filename        Result
drm3.exe         MALWARE

The file 'drm3.exe' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.

Alternatively you can see the analysis result here:
http://analysis.avira.com/sample ... p;incidentid=288476

An overview of all your submissions can be found here:
http://analysis.avira.com/sample ... nOVXGxE29xp5pCyVrDI

Please note: If you have specific questions please address them to support@avira.com

Kind regards
Avira Virus Lab

---------------------------------------------
Avira GmbH
Lindauer Str. 21, D-88069 Tettnang, Germany
Phone: +49 (0) 7542-500 0
Fax: +49 (0) 7542-525 10
Internet: http://www.avira.com

CEO: Tjark Auerbach
Headquarter: Tettnang
Commercial register: AG Ulm HRB 630992
---------------------------------------------

尤金卡巴斯基

Hello,


drm3.exe

No malicious code was found in this file.


Regards, Tatarinov Ivan
Virus Analyst

10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia
Tel./Fax: + 7 (495) 797 8700
http://www.kaspersky.com http://www.viruslist.com

nkjinderi

红伞的分析师是怎么搞的？为啥要认为是malware呢？难道评判标准不一样？