Nueva variante de PALEVO cazada por la heuristica del ELIPALEVO

Una nueva variante  de PALEVO ha sido detectada por el ELIPALEVO y enviada para analizar

File name: kusdnfsndgf987ewu495oihwifyvdbe.exe
Submission date: 2010-12-15 10:35:25 (UTC)
Current status: queued (#18) queued (#19) analysing finished
Result: 5/ 43 (11.6%)
 VT Community

not reviewed
 Safety score: – 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.12.15.00 2010.12.14 –
AntiVir 7.11.0.39 2010.12.15 –
Antiy-AVL 2.0.3.7 2010.12.15 –
Avast 4.8.1351.0 2010.12.15 –
Avast5 5.0.677.0 2010.12.15 Win32:FakeVB
AVG 9.0.0.851 2010.12.14 –
BitDefender 7.2 2010.12.15 –
CAT-QuickHeal 11.00 2010.12.15 –
ClamAV 0.96.4.0 2010.12.14 –
Command 5.2.11.5 2010.12.15 –
Comodo 7068 2010.12.15 Heur.Packed.Unknown
DrWeb 5.0.2.03300 2010.12.15 Trojan.DownLoader1.44605
Emsisoft 5.1.0.1 2010.12.15 –
eSafe 7.0.17.0 2010.12.14 –
eTrust-Vet 36.1.8042 2010.12.15 –
F-Prot 4.6.2.117 2010.12.14 –
F-Secure 9.0.16160.0 2010.12.15 –
Fortinet 4.2.254.0 2010.12.15 –
GData 21 2010.12.15 –
Ikarus T3.1.1.90.0 2010.12.15 –
Jiangmin 13.0.900 2010.12.15 –
K7AntiVirus 9.72.3246 2010.12.14 –
Kaspersky 7.0.0.125 2010.12.15 –
McAfee 5.400.0.1158 2010.12.15 –
McAfee-GW-Edition 2010.1C 2010.12.15 –
Microsoft 1.6402 2010.12.15 –
NOD32 5704 2010.12.15 –
Norman 6.06.12 2010.12.15 –
nProtect 2010-12-15.02 2010.12.15 –
Panda 10.0.2.7 2010.12.14 –
PCTools 7.0.3.5 2010.12.15 –
Prevx 3.0 2010.12.15 High Risk Cloaked Malware
Rising 22.78.01.04 2010.12.15 –
Sophos 4.60.0 2010.12.15 –
SUPERAntiSpyware 4.40.0.1006 2010.12.15 Trojan.Agent/Gen-Falint
Symantec 20101.3.0.103 2010.12.15 –
TheHacker 6.7.0.1.101 2010.12.15 –
TrendMicro 9.120.0.1004 2010.12.15 –
TrendMicro-HouseCall 9.120.0.1004 2010.12.15 –
VBA32 3.12.14.2 2010.12.14 –
VIPRE 7659 2010.12.15 –
ViRobot 2010.12.15.4202 2010.12.15 –
VirusBuster 13.6.94.0 2010.12.14 –
Additional informationShow all 
MD5   : e7bb356588ff94afe4a8ce45ea2a05c6
SHA1  : 4e4cf8aa2cdabe4bde9b5629dc3220a80779765a

File size : 170520 bytes

product……:
description..: tVkMknsyBiGbY7Yspbntn5inytX7Y0ZqGJah0fBf9n4HwaYwvMUT5UPcsBoU7Gz38Ev33goT4S3Yi53c4dpq566oTPdspH7JwecUFWvLh27iZYPJoZsBTHzfbsKBbz9mBNbx2pexwZjwDDKCRHDNX9ijGzsMrNY1NbKxH982jq7dCgrqAWRn4bN42L8fJLRHVF7GdXQVwBC3Mu3zqa8ccTPUDeZHuTHio6mzR0aQPBPjNBXw6ezeiZRgth
original name: dvTc6Q4RwC08rECgEQK0MqNdMtuKtZ.exe
internal name: dvTc6Q4RwC08rECgEQK0MqNdMtuKtZ
file version.: 1.00.0012
 

Viendo que se transmite por pendrive, a traves de lanzar en el AUTORUN.INF el fichewro en cuestion en:

shell\\open\\command=kusdnfsndgf987ewu495oihwifyvdbe.exe
recomendamos vacunar ordenadores y pendrives con el ELIPEN para evitar la propagacion de virus de este tipo.

Ademas con el ELIPALEVO 2.01 de hoY pasamos a controlar y eliminar esta variante
saludos

ms, 15/12/2010