Nueva variante (dropper y scanner) de FAKE TOOL SYSTEM RESTORE, que oculta el contenido del disco duro

Otra variante de la familia de FAKE TOOLS, esta vez de los que ocultan todo el disco duro, que ha detectado la heuristica del ELISTARA y pedido muestra para analizar y controlar.

A partir de la version 24.12 del ELISTARA de hoy controlamos dicha nueva varinate, incluso restauramos la visibilidad a los ficheros y carpetas ocultadas si se detecta algun fichero infectado (como la muestra que guarda en C:\muestras el ELISTARA)
Los preanalisis sobre los dos ficheros (dropper y scanner) que integran dicha variante, ofrecen los siguientes informes:
Dropper:

ile name: KLFAHGCHHUFCKDH.EXE.Muestra EliStartPage v24.11
Submission date: 2011-10-20 11:08:57 (UTC)
Current status: queued queued analysing finished
Result: 19/ 43 (44.2%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.20.00 2011.10.20 Trojan/Win32.Jorik
AntiVir 7.11.16.91 2011.10.20 –
Antiy-AVL 2.0.3.7 2011.10.20 –
Avast 6.0.1289.0 2011.10.20 Win32:Rootkit-gen [Rtk]
AVG 10.0.0.1190 2011.10.20 Downloader.Zlob.BDGP
BitDefender 7.2 2011.10.20 Gen:Variant.Kazy.40440
ByteHero 1.0.0.1 2011.09.23 Trojan.Win32.Heur.Gen
CAT-QuickHeal 11.00 2011.10.20 (Suspicious) – DNAScan
ClamAV 0.97.0.0 2011.10.20 –
Commtouch 5.3.2.6 2011.10.20 –
Comodo 10506 2011.10.20 –
DrWeb 5.0.2.03300 2011.10.20 Trojan.DownLoader5.4824
Emsisoft 5.1.0.11 2011.10.20 Trojan.Win32.FakeSysdef!IK
eSafe 7.0.17.0 2011.10.17 –
eTrust-Vet 36.1.8629 2011.10.20 –
F-Prot 4.6.5.141 2011.10.20 –
F-Secure 9.0.16440.0 2011.10.20 Gen:Variant.Kazy.40440
Fortinet 4.3.370.0 2011.10.20 –
GData 22 2011.10.20 Gen:Variant.Kazy.40440
Ikarus T3.1.1.107.0 2011.10.20 Trojan.Win32.FakeSysdef
Jiangmin 13.0.900 2011.10.19 –
K7AntiVirus 9.115.5313 2011.10.19 –
Kaspersky 9.0.0.837 2011.10.20 Trojan.Win32.Jorik.Fraud.fka
McAfee 5.400.0.1158 2011.10.20 FakeAlert-SysDef.b
McAfee-GW-Edition 2010.1D 2011.10.20 FakeAlert-SysDef.b
Microsoft 1.7801 2011.10.20 Trojan:Win32/FakeSysdef
NOD32 6559 2011.10.20 a variant of Win32/Kryptik.UDJ
Norman 6.07.13 2011.10.19 –
nProtect 2011-10-20.01 2011.10.20 Gen:Variant.Kazy.40440
Panda 10.0.3.5 2011.10.19 –
PCTools 8.0.0.5 2011.10.20 –
Prevx 3.0 2011.10.20 –
Rising 23.80.03.04 2011.10.20 –
Sophos 4.70.0 2011.10.20 Mal/FakeAV-OP
SUPERAntiSpyware 4.40.0.1006 2011.10.20 Trojan.Agent/Gen-RogueAntiSpy
Symantec 20111.2.0.82 2011.10.20 –
TheHacker 6.7.0.1.327 2011.10.19 –
TrendMicro 9.500.0.1008 2011.10.20 –
TrendMicro-HouseCall 9.500.0.1008 2011.10.20 –
VBA32 3.12.16.4 2011.10.19 –
VIPRE 10818 2011.10.20 –
ViRobot 2011.10.20.4729 2011.10.20 –
VirusBuster 14.1.20.0 2011.10.19 –
Additional informationShow all
MD5   : 80fdd6e814ec2d8075a05477c6e47693
SHA1  : f60a625e9131c19f1463ee27e6038463964b0d4a

File size : 468992 bytes

publisher….: Sun Microsystems, Inc.
copyright….: Copyright (c) 2004
product……:
description..:
original name:
internal name:
file version.: 6.0.60.2
____
Scanner:
File name: 6DSS92C31APGJK.EXE.Muestra EliStartPage v24.11
Submission date: 2011-10-20 11:12:36 (UTC)
Current status: queued queued analysing finished
Result: 17/ 43 (39.5%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.20.00 2011.10.20 Trojan/Win32.Jorik
AntiVir 7.11.16.91 2011.10.20 TR/Fakealert.TZ
Antiy-AVL 2.0.3.7 2011.10.20 –
Avast 6.0.1289.0 2011.10.20 –
AVG 10.0.0.1190 2011.10.20 Downloader.Zlob.BDGP
BitDefender 7.2 2011.10.20 Gen:Variant.Kazy.40492
ByteHero 1.0.0.1 2011.09.23 Trojan.Win32.Heur.Gen
CAT-QuickHeal None 2011.10.20 –
ClamAV 0.97.0.0 2011.10.20 –
Commtouch 5.3.2.6 2011.10.20 –
Comodo 10506 2011.10.20 –
DrWeb 5.0.2.03300 2011.10.20 –
Emsisoft 5.1.0.11 2011.10.20 Trojan.Win32.FakeSysdef!IK
eSafe 7.0.17.0 2011.10.17 –
eTrust-Vet 36.1.8629 2011.10.20 –
F-Prot 4.6.5.141 2011.10.20 –
F-Secure 9.0.16440.0 2011.10.20 Gen:Variant.Kazy.40492
Fortinet 4.3.370.0 2011.10.20 –
GData 22 2011.10.20 Gen:Variant.Kazy.40492
Ikarus T3.1.1.107.0 2011.10.20 Trojan.Win32.FakeSysdef
Jiangmin 13.0.900 2011.10.19 –
K7AntiVirus 9.115.5313 2011.10.19 –
Kaspersky 9.0.0.837 2011.10.20 Trojan.Win32.Jorik.Fraud.fka
McAfee 5.400.0.1158 2011.10.20 FakeAlert-SysDef.b
McAfee-GW-Edition 2010.1D 2011.10.20 FakeAlert-SysDef.b
Microsoft 1.7801 2011.10.20 Trojan:Win32/FakeSysdef
NOD32 6559 2011.10.20 a variant of Win32/Kryptik.UDJ
Norman 6.07.13 2011.10.19 –
nProtect 2011-10-20.01 2011.10.20 Gen:Variant.Kazy.40492
Panda 10.0.3.5 2011.10.19 –
PCTools 8.0.0.5 2011.10.20 –
Prevx 3.0 2011.10.20 –
Rising 23.80.03.04 2011.10.20 –
Sophos 4.70.0 2011.10.20 Mal/FakeAV-OP
SUPERAntiSpyware 4.40.0.1006 2011.10.20 Trojan.Agent/Gen-RogueAntiSpy
Symantec 20111.2.0.82 2011.10.20 –
TheHacker 6.7.0.1.327 2011.10.19 –
TrendMicro 9.500.0.1008 2011.10.20 –
TrendMicro-HouseCall 9.500.0.1008 2011.10.20 –
VBA32 3.12.16.4 2011.10.19 –
VIPRE 10818 2011.10.20 –
ViRobot 2011.10.20.4729 2011.10.20 –
VirusBuster 14.1.20.0 2011.10.19 –
Additional informationShow all
MD5   : 736b6ee1391444c8784ed1353da91933
SHA1  : 2e0455b07c124dcd24fcc8dc40c3b278bde35853

File size : 349184 bytes

publisher….: Sun Microsystems, Inc.
copyright….: Copyright (c) 2004
product……:
description..:
original name:
internal name:
file version.: 6.0.60.2
Dicha version del ELISTARA 24.12 estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 20-10-2011