Ayer adelantabamos la noticia del nuevo y peligros ZIMUSE, con payload destructivo segun decíamos en https://blog.satinfo.es/?p=2541
Hoy nos informa McAfee que ya está controlado por el actual DAT del VirusScan:

W32/Zimuse

Type
    Virus
SubType
    Worm
Discovery Date
    01/25/2010
Length
Minimum DAT
    N/A (01/26/2010)
Updated DAT
    5873 (01/26/2010)
Minimum Engine
    5.3.00
Description Added
    01/25/2010
Description Modified
    01/27/2010 2:55 AM (PT)

Overview –

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it’s quite common for viruses to do nothing more than spread from one system to another.
Characteristics
Characteristics –

— Update January 26, 2010 —
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:  http://www.theregister.co.uk/2010/01/25/slovak_biker_destructive_worm/

Upon execution, the malware drops the following files

    * %windir%\system32\drivers\Mstart.sys
    * %ProgramFiles%\Dump\Dump.exe
    * %windir%\system32\drivers\Mseu.sys
    * %windir%\system32\tokset.dll
    * %windir%\system32\ainf.inf
    * %SystemDrive%\IQTEST\Iqtest.exe
    * %windir%\system32\Mseus.exe

It creates follwing registry entries:

    * HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSTART
          o “Type”  = “0x1”
          o  “Start” = “0x3”
          o  “ImagePath” = “%windir%\system32\drivers\Mstart.sys”
          o  “ErrorControl” = “0x1”
          o  “DisplayName” = “MSTART”

    * HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UnzipService
          o “Type”  = “0x110”
          o  “Start” = “0x2”
          o  “ImagePath” = “System32\Mseus.exe”
          o  “ErrorControl” = “0x0”
          o  “DisplayName” = “Self extract service”
          o  “ObjectName” = “LocalSystem”
          o  “Description” = “Self extract archive decrypt”

    * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
       “Dump” = “%ProgramFiles%\Dump\Dump.exe”
 Fuente

saludos

ms, 27-1-2010