D
Dan Williams
October 28, 2004
Windows 2000 SP4
Yesterday my firewall caught an executable file trying to make an
outgoing connection. The executable is D3DRM.EXE and resides in the
Winnt\System32 directory. I denied the connection and didn't pay much
attention it. Yesterday, later in the day, I noticed that the system
was slowing to a crawl. Rebooting brought it back to normal. Before
leaving the house for the day, I set Forte Agent to download a ton of
binaries that would take several days to download.
Came back this morning, not much had been downloaded in Agent, system
was extremely slow, alt-tab between apps didn't work, couldn't bring
Task Manager forward to see what was eating the CPU, had to hit reset
button. Soon after rebooting, D3DRM.EXE makes an outgoing connection
attempt to port 80 of
lineAR50.velocom.com.ar
which I deny. Browsing to http://www.velocom.com.ar reveals an
apparently legit site of an telecom company in Argentina.
I then do a virus check with Syamantec Corporate 8.1.0825 with the
most recent definitions (10/27/04 rev 18) that comes up negative. Also
negative is a check for spyware using Ad-aware 6 with the most recent
defs (01R347 26.10.2004). The file D3DRM.EXE is in one of the Run keys
in the Registry so it loads at startup.
Searching Symantec virus list for D3DRM is negative. Google search for
D3DRM.EXE has zero hits, for D3DRM without the extension has many hits
that all seem to be about programming, the file is related to DirectX.
Checkinig the DirectX diagnostic tool reveals that D3DRM.DLL is a part
of DirectX, but D3DRM.EXE is not listed on the 'DirectX Files' tab.
When right-clicking D3DRM.EXE and choosing Properties, there is no
Version tab like with most/all the other EXE's, the file looks
suspicious.
I have been surfing to some semi-questionable sites recently and
suspect that this D3DRM.EXE is some kind of malware that is very new.
Going to remove the Run key in the Registry and see if everything is
back to normal.
Anyone know anything about D3DRM.EXE?
Windows 2000 SP4
Yesterday my firewall caught an executable file trying to make an
outgoing connection. The executable is D3DRM.EXE and resides in the
Winnt\System32 directory. I denied the connection and didn't pay much
attention it. Yesterday, later in the day, I noticed that the system
was slowing to a crawl. Rebooting brought it back to normal. Before
leaving the house for the day, I set Forte Agent to download a ton of
binaries that would take several days to download.
Came back this morning, not much had been downloaded in Agent, system
was extremely slow, alt-tab between apps didn't work, couldn't bring
Task Manager forward to see what was eating the CPU, had to hit reset
button. Soon after rebooting, D3DRM.EXE makes an outgoing connection
attempt to port 80 of
lineAR50.velocom.com.ar
which I deny. Browsing to http://www.velocom.com.ar reveals an
apparently legit site of an telecom company in Argentina.
I then do a virus check with Syamantec Corporate 8.1.0825 with the
most recent definitions (10/27/04 rev 18) that comes up negative. Also
negative is a check for spyware using Ad-aware 6 with the most recent
defs (01R347 26.10.2004). The file D3DRM.EXE is in one of the Run keys
in the Registry so it loads at startup.
Searching Symantec virus list for D3DRM is negative. Google search for
D3DRM.EXE has zero hits, for D3DRM without the extension has many hits
that all seem to be about programming, the file is related to DirectX.
Checkinig the DirectX diagnostic tool reveals that D3DRM.DLL is a part
of DirectX, but D3DRM.EXE is not listed on the 'DirectX Files' tab.
When right-clicking D3DRM.EXE and choosing Properties, there is no
Version tab like with most/all the other EXE's, the file looks
suspicious.
I have been surfing to some semi-questionable sites recently and
suspect that this D3DRM.EXE is some kind of malware that is very new.
Going to remove the Run key in the Registry and see if everything is
back to normal.
Anyone know anything about D3DRM.EXE?