Nueva variante de FAKE AV SECURITY TOOLS

La heuristica del ELISTARA ha pedido muestras de fichero sospechoso que ha resultado ser una variante aun poco controlada (18 de 43) de la familia de los FAKE AV SECURITY TOOLS:

File name: 97691787.EXE.Muestra EliStartPage v22.15
Submission date: 2010-12-09 10:49:17 (UTC)
Current status: queued queued analysing finished
Result: 18/ 43 (41.9%)
 VT Community

malware
 Safety score: 0.0% 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.12.09.00 2010.12.08 –
AntiVir 7.10.14.235 2010.12.09 TR/Crypt.ZPACK.Gen2
Antiy-AVL 2.0.3.7 2010.12.09 –
Avast 4.8.1351.0 2010.12.08 Win32:MalOb-DM
Avast5 5.0.677.0 2010.12.08 Win32:MalOb-DM
AVG 9.0.0.851 2010.12.08 –
BitDefender 7.2 2010.12.09 Gen:Variant.Kazy.5038
CAT-QuickHeal 11.00 2010.12.09 –
ClamAV 0.96.4.0 2010.12.09 –
Command 5.2.11.5 2010.12.09 –
Comodo 6999 2010.12.09 –
DrWeb 5.0.2.03300 2010.12.09 Trojan.Fakealert.19447
Emsisoft 5.1.0.1 2010.12.09 –
eSafe 7.0.17.0 2010.12.07 –
eTrust-Vet 36.1.8029 2010.12.09 Win32/FraudSecurityTool.N!generi
F-Prot 4.6.2.117 2010.12.08 –
F-Secure 9.0.16160.0 2010.12.09 Gen:Variant.Kazy.5038
Fortinet 4.2.254.0 2010.12.09 –
GData 21 2010.12.09 Gen:Variant.Kazy.5038
Ikarus T3.1.1.90.0 2010.12.09 –
Jiangmin 13.0.900 2010.12.09 –
K7AntiVirus 9.71.3191 2010.12.08 –
Kaspersky 7.0.0.125 2010.12.09 –
McAfee 5.400.0.1158 2010.12.09 FakeAlert-SecurityTool.w
McAfee-GW-Edition 2010.1C 2010.12.09 FakeAlert-SecurityTool.w
Microsoft 1.6402 2010.12.09 Rogue:Win32/Winwebsec
NOD32 5687 2010.12.09 a variant of Win32/Kryptik.IQV
Norman 6.06.12 2010.12.08 –
nProtect 2010-12-09.01 2010.12.09 Gen:Variant.Kazy.5038
Panda 10.0.2.7 2010.12.08 –
PCTools 7.0.3.5 2010.12.09 SecurityToolFraud!Gen4
Prevx 3.0 2010.12.09 –
Rising 22.77.02.04 2010.12.09 –
Sophos 4.60.0 2010.12.09 Mal/FakeAV-DO
SUPERAntiSpyware 4.40.0.1006 2010.12.09 –
Symantec 20101.3.0.103 2010.12.09 SecurityToolFraud!Gen4
TheHacker 6.7.0.1.097 2010.12.09 –
TrendMicro 9.120.0.1004 2010.12.09 –
TrendMicro-HouseCall 9.120.0.1004 2010.12.09 –
VBA32 3.12.14.2 2010.12.08 –
VIPRE 7572 2010.12.09 FraudTool.Win32.FakeAV.a (v)
ViRobot 2010.12.9.4193 2010.12.09 –
VirusBuster 13.6.82.0 2010.12.08 Trojan.Winwebsec.Gen!Pac.21
Additional informationShow all 
MD5   : a85d4eecc4c12b56c123386aa5520d94
SHA1  : 2dba095be0ac685cdd97da5b8ef4ef709eba510c

File size : 887296 bytes

Pasamos a controlarlo  a partir del ELISTARA de hoy, 22.16

saludos

ms, 9-12-2010