Nueva variante de ADWARE YONTOO

Nueva muestra de malware que pasamos a controlar a partir de la version de hoy del ELISTARA 24.64

El preanalisis con virustotal ofrece este informe:

Nombre del fichero YONTOOIECLIENT.DLL.Muestra EliStartPage v24.61

SHA256: 24710c591c225e7857b49ae98a06f41c367f14608c14bd6885db6dc370a7ee45
SHA1: f180defa96a16da39c7989a35bf5631b59c3dbbb
MD5: 2a9f7520aa15394ae479957fd38d8a70
File size: 190.3 KB ( 194848 bytes )
File type: Win32 DLL
Tags: signed
Detection ratio: 6 / 43
Analysis date: 2012-01-03 08:44:18 UTC ( 1 week, 2 days ago )
00

Antivirus Result Version Update
AhnLab-V3 – 2012.01.02.00 20120102
AntiVir – 7.11.20.128 20120103
Antiy-AVL – 2.0.3.7 20120103
Avast – 6.0.1289.0 20120102
AVG – 10.0.0.1190 20120102
BitDefender – 7.2 20120103
ByteHero Trojan.Malware.Win32.xPack.i 1.0.0.1 20111231
CAT-QuickHeal – 12.00 20120103
ClamAV – 0.97.3.0 20120103
Commtouch – 5.3.2.6 20120103
Comodo UnclassifiedMalware 11174 20120103
DrWeb – 5.0.2.03300 20120103
Emsisoft Adware.Win32.Yontoo.AMN!A2 5.1.0.11 20120103
eSafe Win32.Trojan 7.0.17.0 20120102
eTrust-Vet – 37.0.9660 20120103
F-Prot – 4.6.5.141 20120102
F-Secure – 9.0.16440.0 20120103
Fortinet – 4.3.388.0 20120103
GData – 22.329/22.621 20120103
Ikarus – T3.1.1.109.0 20111231
Jiangmin – 13.0.900 20120103
K7AntiVirus – 9.123.5838 20120102
Kaspersky – 9.0.0.837 20120103
McAfee – 5.400.0.1158 20120103
McAfee-GW-Edition – 2010.1E 20120102
Microsoft – 1.7903 20120103
NOD32 a variant of Win32/Adware.Yontoo.A 6762 20120103
Norman – 6.07.13 20120102
nProtect – 2012-01-02.01 20120102
Panda – 10.0.3.5 20120102
PCTools – 8.0.0.5 20120103
Prevx – 3.0 20120103
Rising – 23.90.05.01 20111231
Sophos – 4.72.0 20120103
SUPERAntiSpyware – 4.40.0.1006 20111230
Symantec – 20111.2.0.82 20120103
TheHacker – 6.7.0.1.370 20120103
TrendMicro – 9.500.0.1008 20120103
TrendMicro-HouseCall – 9.500.0.1008 20120103
VBA32 – 3.12.16.4 20120102
VIPRE Yontoo (v) 11343 20120103
ViRobot – 2012.1.3.4860 20120103
VirusBuster – 14.1.146.0 20120102
Dicha version del ELISTARA 24.64 que lo detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 12-1-2012