NUEVA VARIANTE DE ROOTKIT DORKBOT CAZADO POR LA HEURISTICA DEL ELISTARA

Nueva variante de este rootkit que pasa a ser controlado especificamente a partir del ELISTARA 24.59 de hoy

El preanalisis de virustotal muestra este informe:
File name: VTJOJJ.EXE.Muestra EliStartPage v24.58
Submission date: 2012-01-04 03:42:44 (UTC)
Current status: finished
Result: 29 /38 (76.3%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.03.00 2012.01.03 Trojan/Win32.VB
AntiVir 7.11.20.137 2012.01.04 TR/VB.Inject.GJ
Antiy-AVL 2.0.3.7 2012.01.04 Trojan/Win32.VB.gen
Avast 6.0.1289.0 2012.01.03 Win32:VB-WRG [Trj]
AVG 10.0.0.1190 2012.01.03 Dropper.Generic3.BXMM
BitDefender 7.2 2012.01.04 Trojan.VB.Inject.AD
CAT-QuickHeal 12.00 2012.01.03 –
ClamAV 0.97.3.0 2012.01.04 –
Commtouch 5.3.2.6 2012.01.04 –
Comodo 11189 2012.01.04 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2012.01.04 Trojan.Siggen3.14380
Emsisoft 5.1.0.11 2012.01.04 Trojan.Win32.VB!IK
eSafe 7.0.17.0 2012.01.03 Win32.VirToolVBInjec
eTrust-Vet 37.0.9662 2012.01.04 –
F-Prot 4.6.5.141 2012.01.03 –
F-Secure 9.0.16440.0 2012.01.03 Trojan.VB.Inject.AD
Fortinet 4.3.388.0 2012.01.04 W32/VB.ASFA!tr
GData 22 2012.01.04 Trojan.VB.Inject.AD
Ikarus T3.1.1.109.0 2011.12.31 Trojan.Win32.VB
Jiangmin 13.0.900 2012.01.03 Trojan/VB.jxw
McAfee 5.400.0.1158 2012.01.04 Generic.tra!a
McAfee-GW-Edition 2010.1E 2012.01.03 Generic.dx!zvf
Microsoft 1.7903 2012.01.03 Trojan:Win32/VB
Norman 6.07.13 2012.01.03 W32/Suspicious_Gen2.dam
nProtect 2012-01-03.01 2012.01.04 Backdoor/W32.IRCBot.113163
PCTools 8.0.0.5 2012.01.04 Trojan.IRCBot!rem
Prevx 3.0 2012.01.04 –
Rising 23.90.05.01 2011.12.31 –
Sophos 4.72.0 2012.01.04 Mal/Jorik-H
SUPERAntiSpyware 4.40.0.1006 2012.01.04 –
Symantec 20111.2.0.82 2012.01.04 W32.IRCBot
TheHacker 6.7.0.1.371 2012.01.03 –
TrendMicro 9.500.0.1008 2012.01.03 WORM_DORKBOT.K
TrendMicro-HouseCall 9.500.0.1008 2012.01.04 WORM_DORKBOT.K
VBA32 3.12.16.4 2012.01.03 SScope.Trojan.VBRA.18641
VIPRE 11347 2012.01.04 Trojan.Win32.Buzus (v)
ViRobot 2012.1.3.4861 2012.01.03 Trojan.Win32.VB.113163
VirusBuster 14.1.148.0 2012.01.03 VirTool.VBInject!TIKGgUAh6lk

Additional informationShow all
MD5   : 5b2aeb48d5e8b5b5fd7b1e39c7200dd1
SHA1  : f914a5d457429276284b35c704784ade3f5192a3

File size : 113163 bytes

publisher….:
copyright….: n/a
product……: iuuu
description..: n/a
original name: f5433g.g44
internal name: andara
file version.: 1.00

Dicha version del ELISTARA 24.59 que lom detecta y elimina, estará disponible en nuestra web a p’artir de las 19 h CEST de hoy

saludos

ms, 4-1-2012