Nueva variante de FAKE TOOL SYSTEM RESTORE (QUE OCULTA TODO EL DISCO DURO)

Otra variante de este FAKE TOOL que aparenta haber eliminado ficheros y carpetas del disco duro, pero casi todo lo que hace es ocultarlas (menos algunos que sí borra) pasa a ser controlado a partir del ELISTARA 24.14 de hoy

Lo forman esencialmente un dropper y el scanner, los cuales en el preanalisis de VirusTotal han ofrecido estos informes (dropper y scanner respectivamente):
dropper:
File name: WDDuFxuCIM.exe
Submission date: 2011-10-24 09:16:58 (UTC)
Result: 19/ 39 (48.7%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.24.00 2011.10.24 Trojan/Win32.Jorik
AntiVir 7.11.16.110 2011.10.24 TR/FakeAV.anh
Antiy-AVL 2.0.3.7 2011.10.24 Trojan/Win32.Jorik.gen
Avast 6.0.1289.0 2011.10.24 Win32:FakeSysdef-GF [Trj]
AVG 10.0.0.1190 2011.10.23 Generic25.AJZH
BitDefender 7.2 2011.10.24 –
ByteHero 1.0.0.1 2011.09.23 Trojan.Win32.Heur.Gen
CAT-QuickHeal None 2011.10.24 –
ClamAV 0.97.3.0 2011.10.24 –
Commtouch 5.3.2.6 2011.10.23 –
Comodo 10542 2011.10.23 –
DrWeb 5.0.2.03300 2011.10.24 Trojan.DownLoad2.39149
Emsisoft 5.1.0.11 2011.10.24 Trojan.Win32.FakeSysdef!IK
eSafe 7.0.17.0 2011.10.17 –
eTrust-Vet 36.1.8636 2011.10.24 –
F-Prot 4.6.5.141 2011.10.23 –
F-Secure 9.0.16440.0 2011.10.24 –
Fortinet 4.3.370.0 2011.10.24 W32/Jorik_Fraud.FOQ!tr
GData 22 2011.10.24 Win32:FakeSysdef-GF
Ikarus T3.1.1.107.0 2011.10.24 Trojan.Win32.FakeSysdef
Jiangmin 13.0.900 2011.10.23 –
K7AntiVirus 9.116.5326 2011.10.22 –
Kaspersky 9.0.0.837 2011.10.24 Trojan.Win32.Jorik.Fraud.foq
Microsoft 1.7801 2011.10.24 Trojan:Win32/FakeSysdef
NOD32 6568 2011.10.24 a variant of Win32/Kryptik.UHR
nProtect 2011-10-24.01 2011.10.24 –
Panda 10.0.3.5 2011.10.23 Trj/CI.A
PCTools 8.0.0.5 2011.10.24 Trojan.Gen
Prevx 3.0 2011.10.24 –
Sophos 4.70.0 2011.10.24 Mal/FakeAV-OP
SUPERAntiSpyware 4.40.0.1006 2011.10.22 Trojan.Agent/Gen-FakeAV
Symantec 20111.2.0.82 2011.10.24 Trojan.Gen.2
TheHacker 6.7.0.1.330 2011.10.24 –
TrendMicro 9.500.0.1008 2011.10.24 –
TrendMicro-HouseCall 9.500.0.1008 2011.10.24 –
VBA32 3.12.16.4 2011.10.24 –
VIPRE 10858 2011.10.24 –
ViRobot 2011.10.24.4734 2011.10.24 –
VirusBuster 14.1.26.0 2011.10.23 –
Additional informationShow all
MD5   : 0a862e67d90b11051fdff32c68b1cec0
SHA1  : 32dbc2c648f5f7240b37c5ade1f8ec4ff282e1aa

File size : 518144 bytes

publisher….: Mozilla Foundation
copyright….: License: MPL 1.1/GPL 2.0/LGPL 2.1
product……: XULRunner
description..:
original name: xulrunner.exe
internal name:
file version.: 1.9.2.15

_________

scanner:
File name: 9lVK7dmpdonxRW.exe
Submission date: 2011-10-24 09:22:11 (UTC)
Current status: queued (#9) queued (#9) analysing finished
Result: 20/ 42 (47.6%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.24.00 2011.10.24 Trojan/Win32.Jorik
AntiVir 7.11.16.110 2011.10.24 TR/FakeAV.anh
Antiy-AVL 2.0.3.7 2011.10.24 Trojan/Win32.Jorik.gen
Avast 6.0.1289.0 2011.10.24 Win32:FakeSysdef-GF [Trj]
AVG 10.0.0.1190 2011.10.23 Generic25.AJZH
BitDefender 7.2 2011.10.24 –
ByteHero 1.0.0.1 2011.09.23 Trojan.Win32.Heur.Gen
CAT-QuickHeal 11.00 2011.10.24 (Suspicious) – DNAScan
ClamAV 0.97.3.0 2011.10.24 –
Commtouch 5.3.2.6 2011.10.23 –
Comodo 10542 2011.10.23 –
DrWeb 5.0.2.03300 2011.10.24 Trojan.DownLoader5.6634
Emsisoft 5.1.0.11 2011.10.24 Trojan.Win32.FakeSysdef!IK
eSafe 7.0.17.0 2011.10.17 –
eTrust-Vet 36.1.8636 2011.10.24 –
F-Prot 4.6.5.141 2011.10.23 –
F-Secure 9.0.16440.0 2011.10.24 –
Fortinet 4.3.370.0 2011.10.24 W32/Jorik_Fraud.FOQ!tr
GData 22 2011.10.24 Win32:FakeSysdef-GF
Ikarus T3.1.1.107.0 2011.10.24 Trojan.Win32.FakeSysdef
Jiangmin 13.0.900 2011.10.23 –
K7AntiVirus 9.116.5326 2011.10.22 –
Kaspersky 9.0.0.837 2011.10.24 Trojan.Win32.Jorik.Fraud.foq
McAfee 5.400.0.1158 2011.10.24 –
McAfee-GW-Edition 2010.1D 2011.10.24 FakeAlert-SysDef.b
Microsoft 1.7801 2011.10.24 Trojan:Win32/FakeSysdef
NOD32 6568 2011.10.24 a variant of Win32/Kryptik.UHR
Norman 6.07.13 2011.10.24 W32/FakeAV.AETR
Panda 10.0.3.5 2011.10.23 Trj/CI.A
PCTools 8.0.0.5 2011.10.24 –
Prevx 3.0 2011.10.24 –
Rising 23.81.00.01 2011.10.24 –
Sophos 4.70.0 2011.10.24 Mal/FakeAV-OP
SUPERAntiSpyware 4.40.0.1006 2011.10.22 Trojan.Agent/Gen-FakeAV
Symantec 20111.2.0.82 2011.10.24 –
TheHacker 6.7.0.1.330 2011.10.24 –
TrendMicro 9.500.0.1008 2011.10.24 –
TrendMicro-HouseCall 9.500.0.1008 2011.10.24 –
VBA32 3.12.16.4 2011.10.24 –
VIPRE 10858 2011.10.24 –
ViRobot 2011.10.24.4734 2011.10.24 –
VirusBuster 14.1.26.0 2011.10.23 –
Additional informationShow all
MD5   : 00f23c9931e3feaba97faa5eb265e054
SHA1  : 8383221393fc6595c60241bd9750bf132a855de3
File size : 399360 bytes
publisher….: Mozilla Foundation
copyright….: License: MPL 1.1/GPL 2.0/LGPL 2.1
product……: XULRunner
description..:
original name: xulrunner.exe
internal name:
file version.: 1.9.2.15
Dicha version del ELISTARA 24.14 que lo detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

Con ella, si detecta alguno de dichos ficheros infectados, aparte de eliminarlos, restaurará las carpetas ocultadas y eliminará los links que lanzaban el malware.

saludos

ms, 24-10-2011