|
Posted by Ron Lopshire on April 21, 2006, 1:50 am
If you were Registered and logged in, you could reply and use other advanced thread options
steverossiter@sbcglobal.net wrote:
> I am using Kaspersky Anti-Virus and it has flagged dmocy.exe as
> TrojanDownloader.Win32.Small.cse.
>
> Kaspersky reccommends I delete the file. It is located at
> C:\WINDOWS\SYSTEM32\dmocy.exe, has a size of 51Kb and the same Date
> Modified of 8/4/2004 00:56 as a lot of files around it alphabetically
> that are Microsoft's, some involved with disk management. I can find no
> mention of dmocy.exe on the web nor in Microsoft's Knowledge Base.
> Deleting something having to do with disk management is not my idea of
> fun.
>
> Has Kaspersky detected the Win32.Small trojan inside dmocy.exe or is
> there a way to determine if this is a false alarm? Where could I find
> more information given no luck in searching across the web?
Steve,
Submit the file to VT and/or Jotti for analysis. If Kaspersky is the
only AV flagging your file as malicious, then either KL is ahead of
the others or it is a FP.
Virus Total Online Scan
(http://www.virustotal.com/flash/index_en.html)
Jotti's Online Malware Scan
(http://virusscan.jotti.org/)
If this is a new exploit, it will be submitted to all vendors who flag
it. Anytime KAV flags a file, submit it to KL through your KAV GUI for
analysis. If it is a FP, it will be removed in subsequent DB updates.
Ron :)
| 
XML site map