Nuevas variantes de FAKE ALERT DROPPER y SCANNER cazadas por el ELISTARA

Recibidas nuevas muestras de FAKE ALERT, dropper y scanner, cazadas por la heuristica del ELISTARA, pasamos a controlarlas especificamente a partir del ELISTARA 24.18 de hoy

Los preanalisis del vIRUStOTAL muestran los siguientes informes:

DROPPER:

File name: CSYSMKJXQRYUN.EXE.Muestra EliStartPage v24.17
Submission date: 2011-11-02 10:48:27 (UTC)
Current status: finished
Result: 23 /43 (53.5%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.11.01.00 2011.11.01 Trojan/Win32.Jorik
AntiVir 7.11.16.238 2011.11.02 TR/FakeSysdef.425984
Antiy-AVL 2.0.3.7 2011.11.02 Trojan/Win32.Jorik.gen
Avast 6.0.1289.0 2011.11.02 Win32:FakeSysdef-HC [Trj]
AVG 10.0.0.1190 2011.11.01 FakeAV.TNU
BitDefender 7.2 2011.11.02 Trojan.Generic.KDV.388327
ByteHero 1.0.0.1 2011.09.23 –
CAT-QuickHeal 11.00 2011.11.02 –
ClamAV 0.97.3.0 2011.11.02 –
Commtouch 5.3.2.6 2011.11.02 –
Comodo 10637 2011.11.02 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2011.11.02 –
Emsisoft 5.1.0.11 2011.11.02 Trojan.Win32.FakeAV!IK
eSafe 7.0.17.0 2011.11.02 –
eTrust-Vet 36.1.8652 2011.11.02 –
F-Prot 4.6.5.141 2011.11.01 –
F-Secure 9.0.16440.0 2011.11.02 Trojan.Generic.KDV.388327
Fortinet 4.3.370.0 2011.11.02 W32/Jorik_Fraud.BK!tr
GData 22 2011.11.02 Trojan.Generic.KDV.388327
Ikarus T3.1.1.107.0 2011.11.02 Trojan.Win32.FakeAV
Jiangmin 13.0.900 2011.11.01 Trojan/Jorik.upi
K7AntiVirus 9.116.5371 2011.11.01 Trojan
Kaspersky 9.0.0.837 2011.11.02 Trojan.Win32.Jorik.Fraud.gif
McAfee 5.400.0.1158 2011.11.02 Generic FakeAlert.bz
McAfee-GW-Edition 2010.1D 2011.11.02 Generic FakeAlert.bz
Microsoft 1.7801 2011.11.02 Trojan:Win32/FakeSysdef
NOD32 6594 2011.11.02 Win32/TrojanDownloader.Prodatect.BK
Norman 6.07.13 2011.11.02 W32/Suspicious_Gen2.RQWXC
nProtect 2011-11-02.02 2011.11.02 –
Panda 10.0.3.5 2011.11.01 –
PCTools 8.0.0.5 2011.11.02 –
Prevx 3.0 2011.11.02 –
Rising 23.82.02.02 2011.11.02 –
Sophos 4.70.0 2011.11.02 Mal/FakeAV-OZ
SUPERAntiSpyware 4.40.0.1006 2011.11.02 Trojan.Agent/Gen-FakeSecurity
Symantec 20111.2.0.82 2011.11.02 –
TheHacker 6.7.0.1.336 2011.10.31 –
TrendMicro 9.500.0.1008 2011.11.02 –
TrendMicro-HouseCall 9.500.0.1008 2011.11.02 –
VBA32 3.12.16.4 2011.11.02 –
VIPRE 10943 2011.11.02 Trojan.Win32.Generic!BT
ViRobot 2011.11.2.4751 2011.11.02 –
VirusBuster 14.1.40.1 2011.11.01 –
Additional informationShow all
MD5   : dfe3d9c0c2535e665f3bae6a63d63c70
SHA1  : 39ee7a12c4ba3c5e026139c64715c8cd5376e28c

File size : 424336 bytes
SCANNER:

File name: 6DSS92C31APGJK.EXE.Muestra EliStartPage v24.17
Submission date: 2011-11-02 11:22:45 (UTC)
Current status: finished
Result: 23 /43 (53.5%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.11.01.00 2011.11.01 Trojan/Win32.Jorik
AntiVir 7.11.16.238 2011.11.02 TR/FakeSysdef.A.1272
Antiy-AVL 2.0.3.7 2011.11.02 Trojan/Win32.Jorik.gen
Avast 6.0.1289.0 2011.11.02 Win32:FakeSysdef-HC [Trj]
AVG 10.0.0.1190 2011.11.02 Cryptic.DSW
BitDefender 7.2 2011.11.02 –
ByteHero 1.0.0.1 2011.09.23 –
CAT-QuickHeal 11.00 2011.11.02 –
ClamAV 0.97.3.0 2011.11.02 –
Commtouch 5.3.2.6 2011.11.02 –
Comodo 10639 2011.11.02 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2011.11.02 Trojan.Click2.1496
Emsisoft 5.1.0.11 2011.11.02 Trojan.Win32.FakeAlert!IK
eSafe 7.0.17.0 2011.11.02 –
eTrust-Vet 36.1.8652 2011.11.02 –
F-Prot 4.6.5.141 2011.11.01 –
F-Secure 9.0.16440.0 2011.11.02 –
Fortinet 4.3.370.0 2011.11.02 W32/Jorik_Fraud.AB!tr
GData 22 2011.11.02 Win32:FakeSysdef-HC
Ikarus T3.1.1.107.0 2011.11.02 Trojan.Win32.FakeAlert
Jiangmin 13.0.900 2011.11.01 Trojan/Jorik.upj
K7AntiVirus 9.116.5371 2011.11.01 Trojan
Kaspersky 9.0.0.837 2011.11.02 Trojan.Win32.Jorik.Fraud.gig
McAfee 5.400.0.1158 2011.11.02 Generic FakeAlert.bz
McAfee-GW-Edition 2010.1D 2011.11.02 Generic FakeAlert.bz
Microsoft 1.7801 2011.11.02 Trojan:Win32/FakeSysdef
NOD32 6594 2011.11.02 Win32/Adware.HDDRescue.AB
Norman 6.07.13 2011.11.02 W32/Crypt.AWRL
nProtect 2011-11-02.02 2011.11.02 –
Panda 10.0.3.5 2011.11.01 Trj/CI.A
PCTools 8.0.0.5 2011.11.02 –
Prevx 3.0 2011.11.02 –
Rising 23.82.02.02 2011.11.02 –
Sophos 4.70.0 2011.11.02 Mal/FakeAV-OZ
SUPERAntiSpyware 4.40.0.1006 2011.11.02 Trojan.Agent/Gen-Surchar
Symantec 20111.2.0.82 2011.11.02 –
TheHacker 6.7.0.1.336 2011.10.31 –
TrendMicro 9.500.0.1008 2011.11.02 –
TrendMicro-HouseCall 9.500.0.1008 2011.11.02 –
VBA32 3.12.16.4 2011.11.02 –
VIPRE 10943 2011.11.02 Trojan.Win32.Skintrim.c (v)
ViRobot 2011.11.2.4751 2011.11.02 –
VirusBuster 14.1.40.1 2011.11.01 –
Additional informationShow all
MD5   : 14ee86f9b47542c0b587b16b46d6ec17
SHA1  : a75f9b0289e3254a83a7a2c43a7f8c7d5ecbd87d

File size : 336272 bytes
Dicha version del ELISTARA 24.18 que los detecta y elimina, estará disponible en nuestra web a partir de lS 19 H CEST de hoy

saludos

ms, 2-11-2011