False Positive? - dijpg.dll

Throws this DLL up as a RAT, as far as I can tell its
not, used to convert BMPs to JPG. Availble here
http://www.disoft.com/oss/dijpg.htm. Source code is
available there also.

I may be wrong....?

Check this: Rewindo Trojan Horse

"Pantscum" <anonymous@discussions.microsoft.com> wrote in message
news:09e501c4f4a5$f74657a0$a301280a@phx.gbl...
> Throws this DLL up as a RAT, as far as I can tell its
> not, used to convert BMPs to JPG. Availble here
> http://www.disoft.com/oss/dijpg.htm. Source code is
> available there also.
>
> I may be wrong....?

http://www.sophos.com/virusinfo/ana...ojrewindoa.html



"Pantscum" <anonymous@discussions.microsoft.com> wrote in message
news:09e501c4f4a5$f74657a0$a301280a@phx.gbl...
> Throws this DLL up as a RAT, as far as I can tell its
> not, used to convert BMPs to JPG. Availble here
> http://www.disoft.com/oss/dijpg.htm. Source code is
> available there also.
>
> I may be wrong....?

You can see on the advanced tab that that file is clean,
it is probably used to convert BMP screen shots to JPG
for upload (by the trojan). Just because a trojan uses a
tool, it doesn't mean that that tool is malicious.

>-----Original Message-----
>http://www.sophos.com/virusinfo/ana...rojrewindoa.htm
l
>
>
>
>"Pantscum" <anonymous@discussions.microsoft.com> wrote
in message
>news:09e501c4f4a5$f74657a0$a301280a@phx.gbl...
>> Throws this DLL up as a RAT, as far as I can tell its
>> not, used to convert BMPs to JPG. Availble here
>> http://www.disoft.com/oss/dijpg.htm. Source code is
>> available there also.
>>
>> I may be wrong....?
>
>
>.
>

But that is why it was detected as a threat, not necessarily a true spy.

"user" <anonymous@discussions.microsoft.com> wrote in message
news:171701c4f4f3$6ab6c650$a601280a@phx.gbl...
> You can see on the advanced tab that that file is clean,
> it is probably used to convert BMP screen shots to JPG
> for upload (by the trojan). Just because a trojan uses a
> tool, it doesn't mean that that tool is malicious.
>
>>-----Original Message-----
>>http://www.sophos.com/virusinfo/ana...rojrewindoa.htm
> l
>>
>>
>>
>>"Pantscum" <anonymous@discussions.microsoft.com> wrote
> in message
>>news:09e501c4f4a5$f74657a0$a301280a@phx.gbl...
>>> Throws this DLL up as a RAT, as far as I can tell its
>>> not, used to convert BMPs to JPG. Availble here
>>> http://www.disoft.com/oss/dijpg.htm. Source code is
>>> available there also.
>>>
>>> I may be wrong....?
>>
>>
>>.
>>