NUEVA VARIANTE DE SPY ZBOT-Y

Una nueva variante de este Rootkit ZBOT-Y, la pasamos a controlar a partir de la versión 24.38 del ELISTARA de hoy

El preanalisis con virustotal ofrece el siguiente informe

File name: EFAXEM.EXE.Muestra EliStartPage v24.26
Submission date: 2011-11-29 16:34:00 (UTC)
Current status: finished
Result: 20 /43 (46.5%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.11.29.01 2011.11.29 Trojan/Win32.Bamital
AntiVir 7.11.18.119 2011.11.29 TR/Crypt.ULPM.Gen
Antiy-AVL 2.0.3.7 2011.11.29 Backdoor/Win32.Sinowal.gen
Avast 6.0.1289.0 2011.11.29 Win32:Malware-gen
AVG 10.0.0.1190 2011.11.29 PSW.Generic9.AKNB
BitDefender 7.2 2011.11.29 Gen:Variant.Kazy.41749
ByteHero 1.0.0.1 2011.11.29 Trojan.Win32.Heur.Gen
CAT-QuickHeal 12.00 2011.11.29 –
ClamAV 0.97.3.0 2011.11.29 –
Commtouch 5.3.2.6 2011.11.29 –
Comodo 10793 2011.11.29 –
DrWeb 5.0.2.03300 2011.11.29 Trojan.PWS.Panda.1214
Emsisoft 5.1.0.11 2011.11.29 –
eSafe 7.0.17.0 2011.11.28 –
eTrust-Vet 37.0.9593 2011.11.29 –
F-Prot 4.6.5.141 2011.11.29 –
F-Secure 9.0.16440.0 2011.11.29 Gen:Variant.Kazy.41749
Fortinet 4.3.370.0 2011.11.29 W32/ZbotPk.GA!tr
GData 22 2011.11.29 Gen:Variant.Kazy.41749
Ikarus T3.1.1.109.0 2011.11.29 –
Jiangmin 13.0.900 2011.11.28 –
K7AntiVirus 9.119.5563 2011.11.29 –
Kaspersky 9.0.0.837 2011.11.29 Backdoor.Win32.Sinowal.phg
McAfee 5.400.0.1158 2011.11.29 PWS-Zbot.gen.hb
McAfee-GW-Edition 2010.1D 2011.11.29 PWS-Zbot.gen.hb
Microsoft 1.7801 2011.11.29 PWS:Win32/Zbot.gen!Y
NOD32 6668 2011.11.29 a variant of Win32/Kryptik.USU
Norman 6.07.13 2011.11.29 –
nProtect 2011-11-29.01 2011.11.29 Gen:Variant.Kazy.41749
Panda 10.0.3.5 2011.11.29 Suspicious file
PCTools 8.0.0.5 2011.11.29 –
Prevx 3.0 2011.11.29 –
Rising 23.86.01.02 2011.11.29 –
Sophos 4.71.0 2011.11.29 Mal/Bredo-Q
SUPERAntiSpyware 4.40.0.1006 2011.11.29 –
Symantec 20111.2.0.82 2011.11.29 –
TheHacker 6.7.0.1.350 2011.11.27 Trojan/Kryptik.usu
TrendMicro 9.500.0.1008 2011.11.29 –
TrendMicro-HouseCall 9.500.0.1008 2011.11.29 –
VBA32 3.12.16.4 2011.11.28 –
VIPRE 11175 2011.11.29 –
ViRobot 2011.11.29.4799 2011.11.29 –
VirusBuster 14.1.90.0 2011.11.29 –
Additional informationShow all
MD5   : 9ee0a0eaf963c25a819f6575b21cf2d5
SHA1  : e51e2f724835137ab560a79f023db0a07c052efd

File size : 186880 bytes

publisher….: Foundstone Inc.
copyright….: Map (c) Salk Boob 1997-2007
product……: Leona Utter Edsel Begin
description..: Tuck Sims Tgif Stems Humor
original name: Chart.exe
internal name: Tunnel Chalk Shops
file version.: 3.10
Dicha versión del ELISTARA 24.38 que lom detecta y elimina, estará disponible en nuestra web a partir delas 19 h CEST de hoy

saludos

ms, 30-11-2011