Nueva variante de FAKE TOOL SYSTEM RESTORE (DE LOS QUE OCULTAN FICHEROS Y CARPETAS)

Una nueva variante de este FAKE ha sido cazada por la heuristica del ELIUSTARA y es controlada a partir del ELUSTARA 24.30 de hoy

El preanalisis de virustotal ofrece estos informes en el dropper y scanner, respectivamente:
DROPPER:

File name: LENXUYTOREFXPOR.EXE.Muestra EliStartPage v24.20
Submission date: 2011-11-18 12:18:29 (UTC)
Current status: queued (#1) queued (#1) analysing finished
Result: 29/ 42 (69.0%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.11.17.00 2011.11.18 Trojan/Win32.FakeAV
AntiVir 7.11.17.224 2011.11.18 TR/Offend.6855474.1
Antiy-AVL 2.0.3.7 2011.11.18 Trojan/Win32.FakeAV.gen
Avast 6.0.1289.0 2011.11.18 Win32:MalOb-HS [Cryp]
AVG 10.0.0.1190 2011.11.18 FakeAV.VBN
BitDefender 7.2 2011.11.18 Trojan.Generic.6855474
ByteHero 1.0.0.1 2011.11.14 –
ClamAV 0.97.3.0 2011.11.18 –
Commtouch 5.3.2.6 2011.11.18 –
Comodo 10780 2011.11.18 UnclassifiedMalware
DrWeb 5.0.2.03300 2011.11.18 Trojan.DownLoad2.42876
Emsisoft 5.1.0.11 2011.11.18 Trojan.Win32.FakeAV!IK
eSafe 7.0.17.0 2011.11.18 Win32.FakeAV.Oz
eTrust-Vet 37.0.9574 2011.11.18 –
F-Prot 4.6.5.141 2011.11.18 –
F-Secure 9.0.16440.0 2011.11.18 Trojan.Generic.6855474
Fortinet 4.3.370.0 2011.11.18 W32/FakeAV.OZ!tr
GData 22 2011.11.18 Trojan.Generic.6855474
Ikarus T3.1.1.109.0 2011.11.18 Trojan.Win32.FakeAV
Jiangmin 13.0.900 2011.11.16 Trojan/Fakeav.ahjy
K7AntiVirus 9.119.5484 2011.11.18 Riskware
Kaspersky 9.0.0.837 2011.11.18 Trojan.Win32.FakeAV.iqzb
McAfee 5.400.0.1158 2011.11.18 Generic FakeAlert.bz
McAfee-GW-Edition 2010.1D 2011.11.18 FakeAlert-QU
Microsoft 1.7801 2011.11.18 Trojan:Win32/FakeSysdef
NOD32 6640 2011.11.18 a variant of Win32/Kryptik.VHJ
Norman 6.07.13 2011.11.18 W32/Suspicious_Gen2.SLROM
nProtect 2011-11-18.01 2011.11.18 –
Panda 10.0.3.5 2011.11.18 Generic Trojan
PCTools 8.0.0.5 2011.11.18 –
Prevx 3.0 2011.11.18 –
Rising 23.84.04.02 2011.11.18 –
Sophos 4.71.0 2011.11.18 Mal/FakeAV-PA
SUPERAntiSpyware 4.40.0.1006 2011.11.18 Trojan.Agent/Gen-FakeSecurity
Symantec 20111.2.0.82 2011.11.18 –
TheHacker 6.7.0.1.344 2011.11.18 –
TrendMicro 9.500.0.1008 2011.11.18 TROJ_FAKEAV.EEG
TrendMicro-HouseCall 9.500.0.1008 2011.11.18 TROJ_FAKEAV.EEG
VBA32 3.12.16.4 2011.11.18 –
VIPRE 11078 2011.11.18 Trojan.Win32.Generic!BT
ViRobot 2011.11.18.4780 2011.11.18 –
VirusBuster 14.1.71.0 2011.11.18 Trojan.FakeAV!4n3CXJ9Y4XU
Additional informationShow all
MD5   : bc6cd9dfd2a090b1bc0bf938d1bd5bf1
SHA1  : cbd9fec405d5ffd4ee61c5bbe8f7df08b8652b4c

File size : 424720 bytes
_________

Dicha version del ELISTARA 24.30 que lo detecta y elimina (aparte de restaurar las modificaciones, estara disponible en nuestra web a partir de las 15 h CEST de hoy

saludos

ms, 18/11/2011