Nuevo virus de pendrive que ejecuta desde el AUTORUN.INF el fichero baswala.exe, de varias formas

Este virus que se propaga por pendrive , viendo repetidas ejecuciones del fichero malware baswala.exe de la carpeta NIKOLIC, en el AUTORUN.INF:

shell\\open\\command=NIKOLIC\\\baswala.exe
Shell\\open\\command=NIKOLIC\\\baswala.exe
shellexecute=NIKOLIC\\\baswala.exe
shell\\explore\\command=NIKOLIC\\\baswala.exe
open=NIKOLIC\\baswala.exe

El contenido COMPLETO de dicho AUTORUN es el siguiente:

[autorun]
*äñàêä×ÊÔÄΌףԌŠ×Ô£êô¼ŒŠÊÔלÊÔœ÷šËÔŽÏŒŠÊÄל¼äôêõŒŠÔÊלêä×ÎŒŠ£ÔÈŒŠõ¼ô׌ŠÊ×ÔõèàñëÕËÔñõíôè£ÈŒŠÓԌˊ¼ôëœô¼œëšôèêïœî÷šôœ¼ôëèàñõÔÔÈŒÎÔÊœš÷ôՌˊõôèœëšôó¼àëÈÊÔœî÷õ¼ôë蜚õÄÈËŒŠÔÈËœ¼Ôàõ¼èëîôŒÎÔÈʌˊÕԜ늣ԌËÔãñó¼ôõÀÑÎÔÊ£ŒŠ×ãäñã
action=Open folder to view files using Windows Explorer
;ôœšôšœêô׌Šêô÷¼ôàêë¼ôÀŒÎ×ôkofAPFwqhfWQIKFw???
shell\\open\\command=NIKOLIC\\\baswala.exe
:fafl?LFWQf?Wqdjlasj?ASDPO?WQ?FJuwq?ifjW?hl
Shell\\open\\command=NIKOLIC\\\baswala.exe
\fafwQFLP??WQFJSLkfaÝÇÔÎÀÄØÖÐÉÄÆ
shellexecute=NIKOLIC\\\baswala.exe
/àôöàëÖÆÉäàÝÖÉàäÝÛÔÎìàæÛÔÇÝÄÙÀÇëöéàËÎÖÉÀÐÖÉÆÀ
shell\\explore\\command=NIKOLIC\\\baswala.exe
>àôàäÝÖËÄÀÝÇÖÉëàæùûôîàæÔÛËÀçýæöäÇÝÆÀÖÉðàÎÆÀ
USEAUTOPLAY=1
@àôûàÝÆéöäÝÀËÝÄÛÔÌÀÛýäæôëÀÝÊÄÇÝÖÉÀÝÆöéËÂÝÖÄÂÖÔÐØÆ
icon=SHELL32.dll,4
#àôàëÄÝÆÇÖÄÉýçöäÝÇÕÂÆÝÖÉÂÎûëôîÀÄÙÇÝÖÉàîøöäðà
open=NIKOLIC\\baswala.exe
!àôàäÝÆÖÉÄÀÝÇÖÉÄÀûðôàÔÛÇÙÀÉÆëàÝÆÖÉËÀðàôØÀÇÕÖÙÆäùàêÉÆÎ

el resultado del VirusTotal sobre dicho fichero baswala.exe es el siguiente:

File name: baswala.exe
Submission date: 2010-08-25 07:05:17 (UTC)
Current status: queued queued analysing finished
Result: 21/ 42 (50.0%)
 VT Community

not reviewed
 Safety score: – 
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.08.25.00 2010.08.24 Worm/Win32.Palevo
AntiVir 8.2.4.38 2010.08.24 –
Antiy-AVL 2.0.3.7 2010.08.23 –
Authentium 5.2.0.5 2010.08.25 W32/Rimecud.J.gen!Eldorado
Avast 4.8.1351.0 2010.08.24 Win32:MalOb-BZ
Avast5 5.0.594.0 2010.08.24 Win32:MalOb-BZ
AVG 9.0.0.851 2010.08.24 Cryptic.AUG
BitDefender 7.2 2010.08.25 Gen:Variant.Bredo.15
CAT-QuickHeal 11.00 2010.08.24 Win32.Packed.Katusha.o.3.Pack
ClamAV 0.96.2.0-git 2010.08.25 –
Comodo 5848 2010.08.24 Heur.Suspicious
DrWeb 5.0.2.03300 2010.08.25 –
Emsisoft 5.0.0.37 2010.08.25 Trojan.Win32.Rimecud!IK
eSafe 7.0.17.0 2010.08.24 –
eTrust-Vet 36.1.7814 2010.08.24 Win32/Rimecud.A!Generic
F-Prot 4.6.1.107 2010.08.24 W32/Rimecud.J.gen!Eldorado
F-Secure 9.0.15370.0 2010.08.25 Gen:Variant.Bredo.15
Fortinet 4.1.143.0 2010.08.24 –
GData 21 2010.08.24 Gen:Variant.Bredo.15
Ikarus T3.1.1.88.0 2010.08.25 Trojan.Win32.Rimecud
Jiangmin 13.0.900 2010.08.25 –
Kaspersky 7.0.0.125 2010.08.25 P2P-Worm.Win32.Palevo.jub
McAfee 5.400.0.1158 2010.08.25 –
McAfee-GW-Edition 2010.1B 2010.08.25 –
Microsoft 1.6103 2010.08.25 Trojan:Win32/Rimecud.A
NOD32 5394 2010.08.24 a variant of Win32/Kryptik.FZG
Norman 6.05.11 2010.08.24 W32/Obfuscated.K
nProtect 2010-08-24.01 2010.08.24 –
Panda 10.0.2.7 2010.08.25 Suspicious file
PCTools 7.0.3.5 2010.08.25 –
Prevx 3.0 2010.08.25 –
Rising 22.62.02.03 2010.08.25 –
Sophos 4.56.0 2010.08.25 Mal/FakeAV-EW
Sunbelt 6788 2010.08.25 –
SUPERAntiSpyware 4.40.0.1006 2010.08.25 –
Symantec 20101.1.1.7 2010.08.25 –
TheHacker 6.5.2.1.355 2010.08.24 –
TrendMicro 9.120.0.1004 2010.08.25 –
TrendMicro-HouseCall 9.120.0.1004 2010.08.25 –
VBA32 3.12.14.0 2010.08.24 Malware-Cryptor.Grygoryi.3
ViRobot 2010.8.25.4006 2010.08.25 –
VirusBuster 5.0.27.0 2010.08.24 –
Additional informationShow all 
MD5   : 18c4f2120f0572e45c77e74ceb1cdf92
SHA1  : 16e684ce6de1ff744a3d471c755923bdf09a3b37
COn el 50 % de detecciones

Lo pasamos a controlar a partir de la versión de hoy del ELIPALEVO 1.73, que estará disponible a partir de las 15 horas.

saludos

ms, 25-8-2010