Nueva variante de FAKE TOOL WINDOWS RECOVERY

Recibidas dos muestras del mismo troyano, una es el dropper y la otra el scanner, que ocasionan la pérdida visual del escritorio y la carpeta de Inicio, lo cual se recupera con el ELISTARA si no se ha manipulado el ordenador con otras herranmientas.

Se controla a partir del ELISTARA 23.87 de hoy
Los preanalisis del Virus Total de los dos ficheros al respecto, son:
el del dropper:

File name: GDUJIWCDLSMLA.EXE.Muestra EliStartPage v23.86-dropper
Submission date: 2011-09-14 08:30:38 (UTC)
Current status: finished
Result: 37 /44 (84.1%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.09.13.00 2011.09.13 Trojan/Win32.Jorik
AntiVir 7.11.14.189 2011.09.13 TR/Kazy.25447.AB
Antiy-AVL 2.0.3.7 2011.09.14 Trojan/Win32.Dapato.gen
Avast 4.8.1351.0 2011.09.13 –
Avast5 5.0.677.0 2011.09.13 Win32:Alureon-AEF [Trj]
AVG 10.0.0.1190 2011.09.14 Downloader.Generic11.AJPS
BitDefender 7.2 2011.09.14 Trojan.Generic.KDV.241939
ByteHero 1.0.0.1 2011.09.13 Trojan.Win32.Heur.Gen
CAT-QuickHeal 11.00 2011.09.14 Trojan.FakeAV
ClamAV 0.97.0.0 2011.09.14 –
Commtouch 5.3.2.6 2011.09.14 W32/FakeAlert.PG.gen!Eldorado
Comodo 10109 2011.09.14 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2011.09.14 Trojan.Dapat.22
Emsisoft 5.1.0.11 2011.09.14 Trojan.Win32.FakeSysdef!IK
eSafe 7.0.17.0 2011.09.13 Win32.TrojanFakeSysd
eTrust-Vet 36.1.8558 2011.09.13 Win32/FakeAV.SOJ!genus
F-Prot 4.6.2.117 2011.09.14 W32/FakeAlert.PG.gen!Eldorado
F-Secure 9.0.16440.0 2011.09.14 Trojan.Generic.KDV.241939
Fortinet 4.3.370.0 2011.09.14 W32/FakeAlertSPKer.B!tr
GData 22 2011.09.14 Trojan.Generic.KDV.241939
Ikarus T3.1.1.107.0 2011.09.14 Trojan.Win32.FakeSysdef
Jiangmin 13.0.900 2011.09.13 TrojanDownloader.Dapato.dy
K7AntiVirus 9.112.5128 2011.09.13 Trojan
Kaspersky 9.0.0.837 2011.09.14 Trojan-Downloader.Win32.Dapato.ej
McAfee 5.400.0.1158 2011.09.14 FakeAlert-SysDef.b
McAfee-GW-Edition 2010.1D 2011.09.13 FakeAlert-SysDef.b
Microsoft 1.7604 2011.09.14 Trojan:Win32/FakeSysdef
NOD32 6461 2011.09.14 a variant of Win32/Kryptik.OKF
Norman 6.07.11 2011.09.13 W32/FakeAlert.CKDE
nProtect 2011-09-14.01 2011.09.14 Trojan/W32.Agent.418816.BG
Panda 10.0.3.5 2011.09.13 Generic Trojan
PCTools 8.0.0.5 2011.09.14 Trojan.Gen
Prevx 3.0 2011.09.14 –
Rising 23.74.03.03 2011.09.09 –
Sophos 4.69.0 2011.09.14 Mal/FakeAV-LS
SUPERAntiSpyware 4.40.0.1006 2011.09.14 Trojan.Agent/Gen-FakeAlert[GDI]
Symantec 20111.2.0.82 2011.09.14 Trojan.Gen
TheHacker 6.7.0.1.296 2011.09.14 –
TrendMicro 9.500.0.1008 2011.09.14 TROJ_GEN.RC1C1FC
TrendMicro-HouseCall 9.500.0.1008 2011.09.14 TROJ_GEN.RC1C1FC
VBA32 3.12.16.4 2011.09.13 TrojanDownloader.Dapato.ej
VIPRE 10470 2011.09.14 Trojan-Downloader.Win32.Dapato.gz (v)
ViRobot 2011.9.14.4667 2011.09.14 –
VirusBuster 14.0.211.0 2011.09.13 –
Additional informationShow all
MD5   : 78bf68d42b38eaca0e2020f1916843c0
SHA1  : 6a5b2eb98e3a333f33f2d68f60609826ec5568de

File size : 418816 bytes

publisher….: Microsoft Corporation
copyright….: (c) Microsoft Corporation. All rights reserved.
product……: Microsoft_ Windows_ Operating System
description..: GDI Client DLL
original name: gdi32
internal name: gdi32
file version.: 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932)

y el del scanner
File name: 31252216.EXE.Muestra EliStartPage v23.86
Submission date: 2011-09-14 08:39:47 (UTC)
Current status: finished
Result: 39 /44 (88.6%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.09.13.00 2011.09.13 Win-Trojan/Fakeav.333312.BJ
AntiVir 7.11.14.190 2011.09.14 TR/Dropper.Gen
Antiy-AVL 2.0.3.7 2011.09.14 Trojan/Win32.FakeAV.gen
Avast 4.8.1351.0 2011.09.13 Win32:MalOb-CA [Cryp]
Avast5 5.0.677.0 2011.09.13 Win32:MalOb-CA [Cryp]
AVG 10.0.0.1190 2011.09.14 Generic22.CFIV
BitDefender 7.2 2011.09.14 Trojan.Generic.KDV.242057
ByteHero 1.0.0.1 2011.09.13 Trojan.Win32.Heur.Gen
CAT-QuickHeal 11.00 2011.09.14 Trojan.FakeAV
ClamAV 0.97.0.0 2011.09.14 –
Commtouch 5.3.2.6 2011.09.14 W32/FakeAlert.PG.gen!Eldorado
Comodo 10109 2011.09.14 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2011.09.14 Trojan.DownLoader3.14876
Emsisoft 5.1.0.11 2011.09.14 Trojan.Win32.FakeSysdef!IK
eSafe 7.0.17.0 2011.09.13 Win32.TrojanFakeSysd
eTrust-Vet 36.1.8558 2011.09.13 Win32/FakeAV.SRW
F-Prot 4.6.2.117 2011.09.14 W32/FakeAlert.PG.gen!Eldorado
F-Secure 9.0.16440.0 2011.09.14 Trojan.Generic.KDV.242057
Fortinet 4.3.370.0 2011.09.14 W32/FakeAlertSPKer.B!tr
GData 22 2011.09.14 Trojan.Generic.KDV.242057
Ikarus T3.1.1.107.0 2011.09.14 Trojan.Win32.FakeSysdef
Jiangmin 13.0.900 2011.09.13 TrojanDownloader.Dapato.dy
K7AntiVirus 9.112.5128 2011.09.13 Trojan
Kaspersky 9.0.0.837 2011.09.14 Trojan.Win32.FakeAV.dilu
McAfee 5.400.0.1158 2011.09.14 FakeAlert-SysDef.b
McAfee-GW-Edition 2010.1D 2011.09.13 FakeAlert-SysDef.b
Microsoft 1.7604 2011.09.14 Trojan:Win32/FakeSysdef
NOD32 6461 2011.09.14 a variant of Win32/Kryptik.OKF
Norman 6.07.11 2011.09.13 W32/FakeAlert.CKDE
nProtect 2011-09-14.01 2011.09.14 Trojan/W32.FakeAV.333312.B
Panda 10.0.3.5 2011.09.13 Generic Trojan
PCTools 8.0.0.5 2011.09.14 Trojan.Gen
Prevx 3.0 2011.09.14 –
Rising 23.74.03.03 2011.09.09 –
Sophos 4.69.0 2011.09.14 Mal/FakeAV-LS
SUPERAntiSpyware 4.40.0.1006 2011.09.14 Trojan.Agent/Gen-FakeAlert[Gdi]
Symantec 20111.2.0.82 2011.09.14 Trojan.Gen
TheHacker 6.7.0.1.296 2011.09.14 Trojan/FakeAV.dilu
TrendMicro 9.500.0.1008 2011.09.14 TROJ_GEN.RC1C2FD
TrendMicro-HouseCall 9.500.0.1008 2011.09.14 TROJ_GEN.RC1C2FD
VBA32 3.12.16.4 2011.09.13 Trojan.FakeAV.dilu
VIPRE 10470 2011.09.14 Trojan.Win32.Jorik.Fraud.un (v)
ViRobot 2011.9.14.4667 2011.09.14 –
VirusBuster 14.0.211.0 2011.09.13 –
Additional informationShow all
MD5   : 6f735ddca3fc20505175bd3006c0edbe
SHA1  : 34b15eb8c4269e40760860c4a903c9d027ae942d
SHA256: 0cea4ac795439471db8e5dc6ecd312746973db767a60449eeddad5d174b41bc0
ssdeep: 6144:Woaep9iPnfG1usf/N9v6uKU0J++5KuE+wfFZJiXFiBk:Oep9WD60s+51ENZuFiB
File size : 333312 bytes
First seen: 2011-06-04 06:18:38
Last seen : 2011-09-14 08:39:47
Magic: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:
Win64 Executable Generic (72.0%)
Windows Screen Saver (11.0%)
Win32 Executable Generic (7.1%)
Win32 Dynamic Link Library (generic) (6.3%)
Generic Win/DOS Executable (1.6%)
sigcheck:
publisher….: Microsoft Corporation
copyright….: (c) Microsoft Corporation. All rights reserved.
product……: Microsoft_ Windows_ Operating System
description..: GDI Client DLL
original name: gdi32
internal name: gdi32
file version.: 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932)
Dicha version del ELISTARA 23.87 con el que se detecta y elimina dicha variante, además de recuperra en lo posible la normalidad del escritorio y carpetas ocultadas, (tras reiniciar) ,estará disponible en nuestra web a partir de las 19n h CEST de hoy

saludos

ms, 14-9-2011