Nueva variante de FAKE AV poco detectada actualmente por los antivirus (22 de 43)

 Recibida nueva muestra de malware Falso Antivirus o Rogue, el preanalisis del Virus Total muestra que solo lo detectan un 51.2% de antivirus:

File name: mainapp7080010000.exe
Submission date: 2010-09-03 08:45:27 (UTC)
Current status: queued (#6) queued (#6) analysing finished
Result: 22/ 43 (51.2%)
 VT Community

not reviewed
 Safety score: – 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.09.03.00 2010.09.03 Trojan/Win32.FakeAV
AntiVir 8.2.4.46 2010.09.03 TR/FakeAV.dxo
Antiy-AVL 2.0.3.7 2010.09.03 –
Authentium 5.2.0.5 2010.09.03 –
Avast 4.8.1351.0 2010.09.02 Win32:Malware-gen
Avast5 5.0.594.0 2010.09.02 Win32:Malware-gen
AVG 9.0.0.851 2010.09.02 SHeur3.AWGU
BitDefender 7.2 2010.09.03 Gen:Variant.TDss.24
CAT-QuickHeal 11.00 2010.09.03 –
ClamAV 0.96.2.0-git 2010.09.03 –
Comodo 5953 2010.09.03 –
DrWeb 5.0.2.03300 2010.09.03 –
Emsisoft 5.0.0.37 2010.09.03 Gen.Variant!IK
eSafe 7.0.17.0 2010.09.01 –
eTrust-Vet 36.1.7834 2010.09.03 –
F-Prot 4.6.1.107 2010.09.01 –
F-Secure 9.0.15370.0 2010.09.03 Gen:Variant.TDss.24
Fortinet 4.1.143.0 2010.09.02 –
GData 21 2010.09.03 Gen:Variant.TDss.24
Ikarus T3.1.1.88.0 2010.09.03 Gen.Variant
Jiangmin 13.0.900 2010.09.03 –
K7AntiVirus 9.63.2424 2010.09.02 –
Kaspersky 7.0.0.125 2010.09.03 Trojan.Win32.FakeAV.dxo
McAfee 5.400.0.1158 2010.09.03 Artemis!1AF7486A63B5
McAfee-GW-Edition 2010.1B 2010.09.03 Artemis!1AF7486A63B5
Microsoft 1.6103 2010.09.03 Rogue:Win32/FakeYak
NOD32 5419 2010.09.02 a variant of Win32/Kryptik.GJT
Norman 6.05.11 2010.09.02 –
nProtect 2010-09-03.01 2010.09.03 Gen:Variant.TDss.24
Panda 10.0.2.7 2010.09.02 Trj/CI.A
PCTools 7.0.3.5 2010.09.03 –
Prevx 3.0 2010.09.03 Medium Risk Malware
Rising 22.63.04.01 2010.09.03 Trojan.Win32.Generic.522BED24
Sophos 4.57.0 2010.09.03 Mal/FakeAV-CS
Sunbelt 6827 2010.09.03 VirTool.Win32.Obfuscator.da!a (v)
SUPERAntiSpyware 4.40.0.1006 2010.09.03 –
Symantec 20101.1.1.7 2010.09.03 –
TheHacker 6.5.2.1.362 2010.09.03 –
TrendMicro 9.120.0.1004 2010.09.03 –
TrendMicro-HouseCall 9.120.0.1004 2010.09.03 –
VBA32 3.12.14.0 2010.09.02 Trojan.FakeAV.dxo
ViRobot 2010.8.31.4017 2010.09.03 –
VirusBuster 12.64.15.0 2010.09.02 –
Additional informationShow all 
MD5   : 1af7486a63b52234109c2eafe9195796
SHA1  : fb20bfe36c0f44bae06891d533112f8d78d1dfc7

Pasamos a controlarlo a partir del ELISTARA 21.54 de hoy, que estará disponible a partor de las 15 horas.

saludos

ms, 3-9-2010