Nuevo control de malwares DRVSVC que se esconden en carpeta con atributos de papelera

Dos ficheros, uno EXE y otro CPL pasan a ser controlados a partir del ELISTARA 24.43 de hoy, como malware DRVSVC

El preanalisis de virustotal ofrece el siguiente informe:

name: drvsvc.exe
Submission date: 2011-12-12 11:47:42 (UTC)
Current status: finished
Result: 31 /43 (72.1%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.12.11.00 2011.12.12 Trojan/Win32.Jorik
AntiVir 7.11.19.66 2011.12.12 Worm/Slenfbot.D.36
Antiy-AVL 2.0.3.7 2011.12.12 Trojan/Win32.Agent.gen
Avast 6.0.1289.0 2011.12.11 Win32:Kolab-PQ [Trj]
AVG 10.0.0.1190 2011.12.11 Generic26.IKE
BitDefender 7.2 2011.12.12 Trojan.Generic.KD.440264
ByteHero 1.0.0.1 2011.12.07 –
CAT-QuickHeal 12.00 2011.12.12 Worm.SlenfBot.Gen
ClamAV 0.97.3.0 2011.12.12 Trojan.Jorik-371
Commtouch 5.3.2.6 2011.12.11 –
Comodo 10929 2011.12.12 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2011.12.12 Trojan.Siggen3.19245
Emsisoft 5.1.0.11 2011.12.12 Trojan.Win32.Jorik!IK
eSafe 7.0.17.0 2011.12.11 Win32.Trojan
eTrust-Vet 37.0.9616 2011.12.09 –
F-Prot 4.6.5.141 2011.11.29 –
F-Secure 9.0.16440.0 2011.12.12 Trojan.Generic.KD.440264
Fortinet 4.3.388.0 2011.12.12 W32/Injector.HLL!tr
GData 22 2011.12.12 Trojan.Generic.KD.440264
Ikarus T3.1.1.109.0 2011.12.12 Trojan.Win32.Jorik
Jiangmin 13.0.900 2011.12.11 –
K7AntiVirus 9.119.5640 2011.12.09 –
Kaspersky 9.0.0.837 2011.12.12 Trojan-Spy.Win32.Agent.bvxp
McAfee 5.400.0.1158 2011.12.12 W32/IRCBot.worm.f
McAfee-GW-Edition 2010.1E 2011.12.11 W32/IRCBot.worm.f
Microsoft 1.7903 2011.12.12 VirTool:Win32/CeeInject.gen!FZ
NOD32 6702 2011.12.12 Win32/Slenfbot.AE
Norman 6.07.13 2011.12.11 Slenfbot.AS
nProtect 2011-12-11.01 2011.12.12 Trojan/W32.Agent.208896.WP
Panda 10.0.3.5 2011.12.11 Generic Trojan
PCTools 8.0.0.5 2011.12.12 –
Prevx 3.0 2011.12.12 –
Rising 23.88.00.01 2011.12.12 –
Sophos 4.72.0 2011.12.12 W32/Slenfb-Gen
SUPERAntiSpyware 4.40.0.1006 2011.12.10 Trojan.Agent/Gen-TmpBot
Symantec 20111.2.0.82 2011.12.12 WS.Reputation.1
TheHacker 6.7.0.1.356 2011.12.11 –
TrendMicro 9.500.0.1008 2011.12.12 TROJ_SPNR.03L611
TrendMicro-HouseCall 9.500.0.1008 2011.12.12 TROJ_SPNR.03L611
VBA32 3.12.16.4 2011.12.09 –
VIPRE 11239 2011.12.12 Trojan.Win32.Generic!BT
ViRobot 2011.12.12.4820 2011.12.12 Trojan.Win32.Slenfbot.155648
VirusBuster 14.1.110.0 2011.12.11 –
Additional informationShow all
MD5   : 91168f7abd002e099104972bfd08bd24
SHA1  : edcb6bbde2b957c26242b07f75023148ddeb7719
File size : 208896 bytes
_________
y el CPL:
File name: m.cpl
Submission date: 2011-12-12 11:49:03 (UTC)
Current status: finished
Result: 33 /43 (76.7%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.12.11.00 2011.12.12 Worm/Win32.Kolab
AntiVir 7.11.19.66 2011.12.12 TR/Slenfbot.A
Antiy-AVL 2.0.3.7 2011.12.12 Trojan/Win32.Starter.gen
Avast 6.0.1289.0 2011.12.11 –
AVG 10.0.0.1190 2011.12.11 Generic5_c.JGR
BitDefender 7.2 2011.12.12 Worm.Generic.346852
ByteHero 1.0.0.1 2011.12.07 –
CAT-QuickHeal 12.00 2011.12.12 Trojan.Starter.j
ClamAV 0.97.3.0 2011.12.12 –
Commtouch 5.3.2.6 2011.12.11 –
Comodo 10929 2011.12.12 UnclassifiedMalware
DrWeb 5.0.2.03300 2011.12.12 BackDoor.IRC.Bot.1149
Emsisoft 5.1.0.11 2011.12.12 Trojan.Win32.Starter!IK
eSafe 7.0.17.0 2011.12.11 –
eTrust-Vet None 2011.12.09 –
F-Prot 4.6.5.141 2011.11.29 –
F-Secure 9.0.16440.0 2011.12.12 Worm.Generic.346852
Fortinet 4.3.388.0 2011.12.12 W32/Starter.AE!tr
GData 22 2011.12.12 Worm.Generic.346852
Ikarus T3.1.1.109.0 2011.12.12 Trojan.Win32.Starter
Jiangmin 13.0.900 2011.12.11 Trojan/Starter.qs
K7AntiVirus 9.119.5640 2011.12.09 Trojan
Kaspersky 9.0.0.837 2011.12.12 Trojan.Win32.Starter.bca
McAfee 5.400.0.1158 2011.12.12 Generic.dx!bb3j
McAfee-GW-Edition 2010.1E 2011.12.11 Generic.dx!bb3j
Microsoft 1.7903 2011.12.12 Trojan:Win32/Starter.J
NOD32 6702 2011.12.12 Win32/Slenfbot.AE
Norman 6.07.13 2011.12.11 W32/Starter.QG
nProtect 2011-12-11.01 2011.12.12 Trojan/W32.Small.2560.VP
Panda 10.0.3.5 2011.12.11 Trj/Starter.G
PCTools 8.0.0.5 2011.12.12 Trojan.Gen
Prevx 3.0 2011.12.12 High Risk Cloaked Malware
Rising 23.88.00.01 2011.12.12 –
Sophos 4.72.0 2011.12.12 Troj/Agent-TSF
SUPERAntiSpyware 4.40.0.1006 2011.12.10 Trojan.Agent/Gen-Starter
Symantec 20111.2.0.82 2011.12.12 Trojan.Gen
TheHacker 6.7.0.1.356 2011.12.11 –
TrendMicro 9.500.0.1008 2011.12.12 TROJ_SPNR.03L111
TrendMicro-HouseCall 9.500.0.1008 2011.12.12 TROJ_SPNR.03L111
VBA32 3.12.16.4 2011.12.09 Trojan.Starter.bca
VIPRE 11239 2011.12.12 Trojan.Win32.Starter
ViRobot 2011.12.12.4820 2011.12.12 –
VirusBuster 14.1.110.0 2011.12.11 Trojan.Starter!fCHcyCjf16M
Additional informationShow all
MD5   : 5b678e26a703f1d5d369ebe875449f8f
SHA1  : 109f5f9602a882d1c75fe020ced93226a98e3903

File size : 2560 bytes
Dicha version del ELISTARA 24.43 que los detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 12-12-2011