DLL creada por el Dropper del FAKE TOOL ULTRADEFRAGGER

Por ultimo, aparte del Dropper y los ejecutables y links creados por él, hemos conseguido detectar y controlar la DLL que organiza todo el falseo de información de corrupción que aparenta tener el ordenador cuando este troyano está activo, para que el usuario tome medidas y acepte, al reiniciar, ekjecutar la utilidad que se le ofrece, este falso ULTRADEFRAGGER.

En la barra de tareas aparecen dos iconos: un circulo rojo con X en blanco de la DLL y el de UltraDefragger del exe lanzado.

________________

Aparentes errores que se muestran cuando esta DLL está activa:

 Windows detected a hard drive problem.

A hard drive error occurred while starting the application.

Windows cannot find notepad. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.
Requested registry access is not allowed. Registry defragmentation required
Read time of hard drive clusters less than 500 ms
32% of HDD space is unreadable
Bad sectors on hard drive or damaged file allocation table
GPU RAM temperature is critically high. Urgent RAM memory optimization is required to prevent system crash
Drive C initializing error
Ram Temperature is 83 C. Optimization is required for normal operation.
Hard drive doesn’t respond to system commands
Data Safety Problem. System integrity is at risk.
Registry Error – Critical Error

Critical Error
Windows can’t find hard disk space. Hard drive error

Critical Error!
Windows was unable to save all the data for the file System32496A8300. The data has been lost. This error may be caused by a failure of your computer hardware.

Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.

System Restore
The system has been restored after a critical error. Data integrity and hard drive integrity verification required.

________________
 

Actualmente esta DLL, es aun menos detectada por los AV, que el propio Dropper o ejecutables correspondientes:

File name: tGjxrCtIcE.dll
Submission date: 2010-11-16 09:10:42 (UTC)
Result: 8/ 43 (18.6%)
 VT Community

not reviewed
 Safety score: – 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.11.16.00 2010.11.15 Packed/Win32.Krap
AntiVir 7.10.14.7 2010.11.16 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.11.16 –
Avast 4.8.1351.0 2010.11.15 –
Avast5 5.0.594.0 2010.11.15 –
AVG 9.0.0.851 2010.11.15 –
BitDefender 7.2 2010.11.16 –
CAT-QuickHeal 11.00 2010.11.09 –
ClamAV 0.96.4.0 2010.11.16 –
Command 5.2.11.5 2010.11.16 –
Comodo 6738 2010.11.16 –
DrWeb 5.0.2.03300 2010.11.16 –
Emsisoft 5.0.0.50 2010.11.16 Trojan.Crypt!IK
eSafe 7.0.17.0 2010.11.14 –
eTrust-Vet 36.1.7980 2010.11.16 –
F-Prot 4.6.2.117 2010.11.16 –
F-Secure 9.0.16160.0 2010.11.16 –
Fortinet 4.2.249.0 2010.11.15 –
GData 21 2010.11.16 –
Ikarus T3.1.1.90.0 2010.11.16 Trojan.Crypt
Jiangmin 13.0.900 2010.11.16 –
K7AntiVirus 9.67.2973 2010.11.12 –
Kaspersky 7.0.0.125 2010.11.15 Packed.Win32.Krap.ao
McAfee 5.400.0.1158 2010.11.16 –
McAfee-GW-Edition 2010.1C 2010.11.15 –
Microsoft 1.6301 2010.11.16 –
NOD32 5622 2010.11.15 a variant of Win32/Kryptik.IEZ
Norman 6.06.10 2010.11.15 –
nProtect 2010-11-16.02 2010.11.16 –
Panda 10.0.2.7 2010.11.15 Suspicious file
PCTools 7.0.3.5 2010.11.16 –
Prevx 3.0 2010.11.16 –
Rising 22.74.00.01 2010.11.16 –
Sophos 4.59.0 2010.11.16 Mal/FakeAV-EA
SUPERAntiSpyware 4.40.0.1006 2010.11.16 –
Symantec 20101.2.0.161 2010.11.16 –
TheHacker 6.7.0.1.085 2010.11.16 –
TrendMicro 9.120.0.1004 2010.11.16 –
TrendMicro-HouseCall 9.120.0.1004 2010.11.16 –
VBA32 3.12.14.2 2010.11.15 –
VIPRE 7323 2010.11.16 –
ViRobot 2010.11.16.4150 2010.11.16 –
VirusBuster 12.76.1.0 2010.11.15 –
Additional informationShow all 
MD5   : 170a9d6f2af1e3737991021a82e8ae18
SHA1  : 8d8a78b2c2d80ae71404e8fc94c75e8f36510fff

File size : 400896 bytes

publisher….: Microsoft Corporation
copyright….: (c) Microsoft Corporation. All rights reserved.
product……: Microsoft_ Windows_ Operating System
description..: Windows AutoDiscovery API
original name: AUTODISC.DLL
internal name: AUTODISC
file version.: 5.1.2600.0 (xpclient.010817-1148)
 
Si bien es de nombre variable, la pasamos a controlar en la exploración por cadenas, a partir del ELISTARA de hoy, 22.02, que estará disponible en nuestra web a partir de las 19 h

saludos

ms, 16-11-2010