Variante de virus infector RAMNIT infecta EXES y DLL, y que ademas infecta pendrives

La heuristica del ELISTARA ha cazado un par de ficheros infectados con este virus, de los que ofrecemos el preanalisis del virustotal para ver los antivirus que lo controlan, los cuales poder usar para desinfectar dicho ficheros:
File name: SVCHOST.EXE.Muestra EliStartPage v23.99
Submission date: 2011-10-03 08:36:13 (UTC)
Current status: finished
Result: 37 /43 (86.0%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.10.02.00 2011.10.02 Win-Trojan/Ircnite.53760.B
AntiVir 7.11.15.85 2011.10.02 TR/Crypt.XPACK.Gen
Antiy-AVL 2.0.3.7 2011.10.03 Backdoor/Win32.IRCNite.gen
Avast 6.0.1289.0 2011.10.02 Win32:Malware-gen
AVG 10.0.0.1190 2011.10.02 BackDoor.Generic13.GAE
BitDefender 7.2 2011.10.03 Trojan.Generic.4857497
ByteHero 1.0.0.1 2011.09.23 Trojan.Malware.Obscu.Gen.002
CAT-QuickHeal 11.00 2011.10.03 Backdoor.IRCNite.ase
ClamAV 0.97.0.0 2011.10.02 –
Commtouch 5.3.2.6 2011.10.03 W32/Trojan2.NLRB
Comodo 10327 2011.10.03 Heur.Suspicious
DrWeb 5.0.2.03300 2011.10.03 Trojan.Siggen2.6792
Emsisoft 5.1.0.11 2011.10.03 Backdoor.Win32.IRCNite!IK
eSafe 7.0.17.0 2011.10.02 Win32.Backdoor.Troja
eTrust-Vet 36.1.8594 2011.10.03 –
F-Prot 4.6.2.117 2011.10.03 W32/Trojan2.NLRB
F-Secure 9.0.16440.0 2011.10.03 Trojan.Generic.4857497
Fortinet 4.3.370.0 2011.10.01 W32/IRCNite.ASE!tr.bdr
GData 22 2011.10.03 Trojan.Generic.4857497
Ikarus T3.1.1.107.0 2011.10.03 Backdoor.Win32.IRCNite
Jiangmin 13.0.900 2011.10.03 Backdoor/IRCNite.mi
K7AntiVirus 9.113.5227 2011.10.01 Trojan
Kaspersky 9.0.0.837 2011.10.03 Backdoor.Win32.IRCNite.ase
McAfee 5.400.0.1158 2011.10.03 Generic.dx!udf
McAfee-GW-Edition 2010.1D 2011.10.02 Heuristic.LooksLike.Win32.Suspicious.J
Microsoft 1.7702 2011.10.03 Worm:Win32/Ramnit.A
NOD32 6511 2011.10.03 Win32/Ramnit.A
Norman 6.07.11 2011.10.02 W32/Suspicious_Gen2.DUJBZ
nProtect 2011-10-03.01 2011.10.03 Backdoor/W32.IRCNite.53760
Panda 10.0.3.5 2011.10.02 Trj/Downloader.MDW
PCTools 8.0.0.5 2011.10.03 Backdoor.Trojan
Prevx 3.0 2011.10.03 –
Rising 23.77.04.01 2011.09.30 Trojan.Win32.Generic.1250D89B
Sophos 4.69.0 2011.10.02 Troj/Agent-OXR
SUPERAntiSpyware 4.40.0.1006 2011.10.01 –
Symantec 20111.2.0.82 2011.10.03 Backdoor.Trojan
TheHacker 6.7.0.1.315 2011.10.02 Backdoor/IRCNite.ase
TrendMicro 9.500.0.1008 2011.10.03 BKDR_IRCNITE.Z
TrendMicro-HouseCall 9.500.0.1008 2011.10.03 BKDR_IRCNITE.Z
VBA32 3.12.16.4 2011.09.30 Backdoor.IRCNite.ase
VIPRE 10649 2011.10.03 Trojan.Win32.Generic!BT
ViRobot 2011.10.1.4699 2011.10.03 –
VirusBuster 14.0.244.0 2011.10.02 –
Additional informationShow all
MD5   : 17efb7e40d4cadaf3a4369435a8772ec
SHA1  : eb9302063ac2ab599ae93aaa1e45b88bbeacbca2

File size : 53760 bytes

publisher….: n/a
copyright….: n/a
product……: n/a
description..: Windows Helper Service
original name: n/a
internal name: WinHelp
file version.: 1.3.1.0
comments…..: n/a
signers……: –
signing date.: –
verified…..: Unsigned
Como se ve, la mayoría de los AV actuales ya controlan esta nueva variante, que infecta ejecutables modificando la cabecera del PE y añadiendo el código vírico al final

saludos

ms, 3-10-2011