Variante de Sirefef

Recibidas muestras de variante de Sirefef, pasan a ser controladas a partir del ELISTARA 24.14 de hoy
El fichero .SYS sustituye al del mismo nombre del sistema operativo, que el virus muestra cuando está en memoria el malware, pero que cuando ya se ha eliminado, es un resto que puede eliminarse, cuidandose normalmente Windows de restablecerlo.

El preanalisis con VirusTotal, ofrece los siguiente informes de las muestras recibidas:

File name: fips.sys.VIR
Submission date: 2011-10-24 07:57:46 (UTC)
Current status: queued queued analysing finished
Result: 35/ 42 (83.3%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.24.00 2011.10.24 Backdoor/Win32.ZAccess
AntiVir 7.11.16.110 2011.10.24 RKIT/ZAccess.EA
Antiy-AVL 2.0.3.7 2011.10.24 Trojan/Win32.ZAccess.gen
Avast 6.0.1289.0 2011.10.24 Win32:Alureon-AJI [Rtk]
AVG 10.0.0.1190 2011.10.23 BackDoor.Generic14.ANAA
BitDefender 7.2 2011.10.24 Gen:Variant.Sirefef.7
ByteHero 1.0.0.1 2011.09.23 –
CAT-QuickHeal 11.00 2011.10.24 –
ClamAV 0.97.3.0 2011.10.24 Trojan.Rootkit-3105
Commtouch 5.3.2.6 2011.10.23 W32/Zaccess.B.gen!Eldorado
Comodo 10542 2011.10.23 TrojWare.Win32.Rootkit.Agent.KE
DrWeb 5.0.2.03300 2011.10.24 Trojan.NtRootKit.12040
Emsisoft 5.1.0.11 2011.10.24 Rootkit.Win32.ZAccess!IK
eSafe 7.0.17.0 2011.10.17 –
eTrust-Vet 36.1.8633 2011.10.21 Win32/Sirefef.B!generic
F-Prot 4.6.5.141 2011.10.23 W32/Zaccess.B.gen!Eldorado
F-Secure 9.0.16440.0 2011.10.24 Gen:Variant.Sirefef.7
Fortinet 4.3.370.0 2011.10.24 W32/ZAccess.E!tr.bdr
GData 22 2011.10.24 Gen:Variant.Sirefef.7
Ikarus T3.1.1.107.0 2011.10.24 Rootkit.Win32.ZAccess
Jiangmin 13.0.900 2011.10.23 Rootkit.ZAccess.ci
K7AntiVirus 9.116.5326 2011.10.22 Riskware
Kaspersky 9.0.0.837 2011.10.24 Rootkit.Win32.ZAccess.e
McAfee 5.400.0.1158 2011.10.24 ZeroAccess
McAfee-GW-Edition 2010.1D 2011.10.23 Heuristic.BehavesLike.Win32.Suspicious.H
Microsoft 1.7801 2011.10.24 TrojanDropper:Win32/Sirefef.B
NOD32 6568 2011.10.24 a variant of Win32/Rootkit.Kryptik.DM
Norman 6.07.13 2011.10.24 W32/ZAccess.Y
Panda 10.0.3.5 2011.10.23 Trj/sirefef.B
PCTools 8.0.0.5 2011.10.24 Trojan.Zeroaccess
Prevx 3.0 2011.10.24 –
Rising 23.81.00.01 2011.10.24 –
Sophos 4.70.0 2011.10.24 Mal/TDSSPack-A
SUPERAntiSpyware 4.40.0.1006 2011.10.22 –
Symantec 20111.2.0.82 2011.10.24 Trojan.Zeroaccess!inf
TheHacker 6.7.0.1.330 2011.10.24 Trojan/ZAccess.e
TrendMicro 9.500.0.1008 2011.10.24 RTKT_ZACESS.SM7
TrendMicro-HouseCall 9.500.0.1008 2011.10.24 RTKT_ZACESS.SM7
VBA32 3.12.16.4 2011.10.24 Rootkit.ZAccess.e
VIPRE 10858 2011.10.24 Trojan.Win32.Generic!BT
ViRobot 2011.10.24.4734 2011.10.24 –
VirusBuster 14.1.26.0 2011.10.23 Rootkit.Kryptik!W+yiGbKwwxc
Additional informationShow all
MD5   : 88004cbfc1ef22c5c8a89cbcf4a1ab5d
SHA1  : 609163d0b5a8fc48e635a804de97610f1f9dcad4
SHA256: c916d6879c6053f7b6c8738fa287d4a1bd26c46e8374c2eef719af9ee9d008a2
ssdeep: 768:6KG3MUb1/4mz/xESN4UM0BKdJ+1bILPhtsOzeIOU/:6qM7fOUMfv++bsOiIO
File size : 44672 bytes
__________

c_69680.nl_.VIR
Submission date: 2011-10-24 07:49:39 (UTC)

Result: 30/ 43 (69.8%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.24.00 2011.10.24 Trojan/Win32.Patched
AntiVir 7.11.16.110 2011.10.24 TR/ATRAPS.Gen2
Antiy-AVL 2.0.3.7 2011.10.24 –
Avast 6.0.1289.0 2011.10.24 Win32:Alureon-AJI [Rtk]
AVG 10.0.0.1190 2011.10.23 Dropper.Agent.ARQJ
BitDefender 7.2 2011.10.24 Gen:Trojan.Heur.Hype.cqW@aCfAJ1b
ByteHero 1.0.0.1 2011.09.23 Trojan.Win32.Heur.Gen
CAT-QuickHeal None 2011.10.24 –
ClamAV 0.97.0.0 2011.10.24 Trojan.Rootkit-3105
Commtouch 5.3.2.6 2011.10.23 W32/Smadow.A.gen!Eldorado
Comodo 10542 2011.10.23 UnclassifiedMalware
DrWeb 5.0.2.03300 2011.10.24 Trojan.Inject.53003
Emsisoft 5.1.0.11 2011.10.24 Backdoor.Win32.Smadow!IK
eSafe 7.0.17.0 2011.10.17 –
eTrust-Vet 36.1.8633 2011.10.21 Win32/Smadow.P
F-Prot 4.6.5.141 2011.10.23 W32/Smadow.A.gen!Eldorado
F-Secure 9.0.16440.0 2011.10.24 Gen:Variant.Sirefef.7
Fortinet 4.3.370.0 2011.10.24 W32/ZAccess.E!tr.bdr
GData 22 2011.10.24 Gen:Trojan.Heur.Hype.cqW@aCfAJ1b
Ikarus T3.1.1.107.0 2011.10.24 Backdoor.Win32.Smadow
Jiangmin 13.0.900 2011.10.23 Rootkit.ZAccess.cj
K7AntiVirus 9.116.5326 2011.10.22 Backdoor
Kaspersky 9.0.0.837 2011.10.24 HEUR:Backdoor.Win32.ZAccess.gen
McAfee 5.400.0.1158 2011.10.24 –
McAfee-GW-Edition 2010.1D 2011.10.23 Heuristic.BehavesLike.Win32.Suspicious.A
Microsoft 1.7801 2011.10.24 Backdoor:Win32/Smadow.gen!B
NOD32 6568 2011.10.24 a variant of Win32/Sirefef.CR
Norman 6.07.13 2011.10.24 W32/ZAccess.G
nProtect 2011-10-24.01 2011.10.24 –
Panda 10.0.3.5 2011.10.23 Generic Trojan
PCTools 8.0.0.5 2011.10.24 –
Prevx 3.0 2011.10.24 –
Rising 23.81.00.01 2011.10.24 –
Sophos 4.70.0 2011.10.24 Troj/Luiha-T
SUPERAntiSpyware 4.40.0.1006 2011.10.22 Trojan.Agent/Gen-Medder
Symantec 20111.2.0.82 2011.10.24 –
TheHacker 6.7.0.1.330 2011.10.24 Trojan/Sirefef.cr
TrendMicro 9.500.0.1008 2011.10.24 –
TrendMicro-HouseCall 9.500.0.1008 2011.10.24 –
VBA32 3.12.16.4 2011.10.21 Rootkit.ZAccess.e
VIPRE 10858 2011.10.24 Trojan.Win32.Sirefef.cr (v)
ViRobot 2011.10.24.4734 2011.10.24 –
VirusBuster 14.1.26.0 2011.10.23 –
Additional informationShow all
MD5   : dc7f892f9c74f5b68c0266ace84ec4b8
SHA1  : e437580f9ee317cab6be700b764a238bc941ebd3

File size : 48016 bytes

Dicha version  del ELISTARA 24.14 que los detecta y elimina, estarán disponibles en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 24-10-2011