Nueva variante de FAKE ALERT (Fake Tools System Recovery) cazada por la heuristica del ELISTARA

Una nueva variante de malware ha sido cazada por la heuristica del ELISTARA y pedido muestra para analizar, la cual una vez monitorizada, pasamos a controlarla especificamente y eliminarla a partir del ELISTARA 23.20 de hoy
File name: load.exe
Submission date: 2011-05-12 12:54:33 (UTC)
Current status: finished
Result: 25 /42 (59.5%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.05.12.00 2011.05.11 Trojan/Win32.FakeAlert
AntiVir 7.11.7.250 2011.05.12 TR/FakeSysdef.A.590
Antiy-AVL 2.0.3.7 2011.05.12 –
Avast 4.8.1351.0 2011.05.11 –
Avast5 5.0.677.0 2011.05.11 –
AVG 10.0.0.1190 2011.05.12 PSW.Generic8.BRBG
BitDefender 7.2 2011.05.12 Trojan.Generic.KD.218812
CAT-QuickHeal 11.00 2011.05.12 (Suspicious) – DNAScan
ClamAV 0.97.0.0 2011.05.12 –
Commtouch 5.3.2.6 2011.05.12 –
Comodo 8674 2011.05.12 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2011.05.12 Trojan.Fakealert.20729
Emsisoft 5.1.0.5 2011.05.12 Trojan.Win32.FakeSysdef!IK
eSafe 7.0.17.0 2011.05.11 –
eTrust-Vet 36.1.8323 2011.05.12 –
F-Prot 4.6.2.117 2011.05.12 –
F-Secure 9.0.16440.0 2011.05.12 Trojan.Generic.KD.218812
Fortinet 4.2.257.0 2011.05.12 –
Ikarus T3.1.1.103.0 2011.05.12 Trojan.Win32.FakeSysdef
Jiangmin 13.0.900 2011.05.11 –
K7AntiVirus 9.103.4624 2011.05.11 –
Kaspersky 9.0.0.837 2011.05.11 –
McAfee 5.400.0.1158 2011.05.12 PWS-Zbot.gen.fk
McAfee-GW-Edition 2010.1D 2011.05.12 PWS-Zbot.gen.fk
Microsoft 1.6802 2011.05.12 Trojan:Win32/FakeSysdef
NOD32 6115 2011.05.12 a variant of Win32/Kryptik.NPI
Norman 6.07.07 2011.05.12 W32/FakeAV.ADUJ
nProtect 2011-05-12.01 2011.05.12 Trojan.Generic.KD.218812
Panda 10.0.3.5 2011.05.11 Trj/CI.A
PCTools 7.0.3.5 2011.05.12 RogueAntiSpyware.WinDefragFraud
Prevx 3.0 2011.05.12 Medium Risk Malware
Rising 23.57.03.05 2011.05.12 –
Sophos 4.65.0 2011.05.12 Mal/FakeAV-EA
SUPERAntiSpyware 4.40.0.1006 2011.05.12 Trojan.Agent/Gen-FakeAlert[QNP]
Symantec 20101.3.2.89 2011.05.12 WinDefragFraud
TheHacker 6.7.0.1.195 2011.05.11 –
TrendMicro 9.200.0.1012 2011.05.12 Cryp_FakeAV-48
TrendMicro-HouseCall 9.200.0.1012 2011.05.12 Cryp_FakeAV-48
VBA32 3.12.16.0 2011.05.12 –
VIPRE 9259 2011.05.12 Trojan.Win32.FakeAv.awrp (v)
ViRobot 2011.5.12.4455 2011.05.12 –
VirusBuster 13.6.350.0 2011.05.12 –
Additional informationShow all
MD5   : 25b00454dc84952736325bd37a83b1a6
SHA1  : 768808d4eddafa5d9c4eae08bdb474f3cb4ad24a

File size : 507392 bytes

publisher….: QNP
copyright….: 37 CFR 1.53(c)
product……: CLAnalysis
description..: Cluster analysis
original name: QCLA.EXE
internal name: QCLA
file version.: 1.3.1.1

Dicha version del ELISTARA 23.20 que lo detecta y elimina, estará disponible en nuestra web a partir de las 19 horas CEST de hoy

saludos

ms, 12-5-2011