TRES DROPPERS DEL FAKE TOOL SYSTEM CHECK

Ademas de controlar el FAKE TOOL en cuestion, a partir del ELISTARA 24.61 tambien controlamos tres droppers (creadores) de dicho falso antivirus, que es necesario eliminar además del propiamente dicho, para que no se regenere de nuevo tras ser eliminado.

Los preanalisis con el VirusTotal correspondientes de estos tres “creadores” son:

File name: BGIJSBGLNFXPQP.EXE.Muestra EliStartPage v24.60
Submission date: 2012-01-09 15:02:01 (UTC)

Result: 18/ 43 (41.9%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.09.00 2012.01.09 –
AntiVir 7.11.20.200 2012.01.09 TR/Offend.KD.511837.2
Antiy-AVL 2.0.3.7 2012.01.09 –
Avast 6.0.1289.0 2012.01.09 Win32:Rootkit-gen [Rtk]
AVG 10.0.0.1190 2012.01.09 –
BitDefender 7.2 2012.01.09 Trojan.Generic.KD.511837
ByteHero 1.0.0.1 2011.12.31 –
CAT-QuickHeal 12.00 2012.01.09 –
ClamAV 0.97.3.0 2012.01.09 –
Commtouch 5.3.2.6 2012.01.09 –
Comodo 11223 2012.01.09 –
DrWeb 5.0.2.03300 2012.01.09 Trojan.Fakealert.27220
Emsisoft 5.1.0.11 2012.01.09 Trojan.Win32.FakeAV!IK
eSafe 7.0.17.0 2012.01.08 –
eTrust-Vet 37.0.9671 2012.01.09 –
F-Prot 4.6.5.141 2012.01.09 –
F-Secure 9.0.16440.0 2012.01.09 Trojan.Generic.KD.511837
Fortinet 4.3.388.0 2012.01.09 –
GData 22 2012.01.09 Trojan.Generic.KD.511837
Ikarus T3.1.1.109.0 2012.01.09 Trojan.Win32.FakeAV
Jiangmin 13.0.900 2012.01.08 –
K7AntiVirus 9.123.5881 2012.01.06 –
Kaspersky 9.0.0.837 2012.01.09 Trojan.Win32.FakeAV.kfnw
McAfee 5.400.0.1158 2012.01.09 FakeAlert-SysDef.b
McAfee-GW-Edition 2010.1E 2012.01.09 Artemis!710211B21DCA
Microsoft 1.7903 2012.01.09 Trojan:Win32/FakeSysdef
NOD32 6779 2012.01.09 a variant of Win32/Kryptik.YPX
Norman 6.07.13 2012.01.09 –
nProtect 2012-01-09.01 2012.01.09 –
Panda 10.0.3.5 2012.01.08 Trj/CI.A
PCTools 8.0.0.5 2012.01.09 –
Prevx 3.0 2012.01.09 –
Rising 23.92.00.02 2012.01.09 –
Sophos 4.73.0 2012.01.09 Mal/FakeAV-OP
SUPERAntiSpyware 4.40.0.1006 2012.01.07 –
Symantec 20111.2.0.82 2012.01.09 Suspicious.Cloud.5
TheHacker 6.7.0.1.373 2012.01.08 –
TrendMicro 9.500.0.1008 2012.01.09 –
TrendMicro-HouseCall 9.500.0.1008 2012.01.09 TROJ_FAKEAV.BAR
VBA32 3.12.16.4 2012.01.09 –
VIPRE 11374 2012.01.09 Trojan.Win32.Generic.pak!cobra
ViRobot 2012.1.9.4871 2012.01.09 –
VirusBuster 14.1.157.0 2012.01.08 –

Additional informationShow all
MD5   : 710211b21dcab2d83c54683c294f97f7
SHA1  : a0011fd785e661cdeaeeb4472ee2453b0c67b88b

File size : 446146 bytes

publisher….: n/a
copyright….: Copyright (C) 2009-11
product……: Power Csd
description..: Power Cs
original name:
internal name:
file version.: 15, 27, 0, 19
_________
File name: OTSTRGTFBJRYSNJ.EXE.Muestra EliStartPage v24.60
Submission date: 2012-01-09 15:05:36 (UTC)
Result: 13/ 43 (30.2%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.08.00 2012.01.08 –
AntiVir 7.11.20.195 2012.01.08 –
Antiy-AVL 2.0.3.7 2012.01.08 –
Avast 6.0.1289.0 2012.01.08 Win32:Rootkit-gen [Rtk]
AVG 10.0.0.1190 2012.01.08 –
BitDefender 7.2 2012.01.08 Gen:Variant.Kazy.52207
ByteHero 1.0.0.1 2011.12.31 –
CAT-QuickHeal 12.00 2012.01.08 –
ClamAV 0.97.3.0 2012.01.07 –
Commtouch 5.3.2.6 2012.01.07 –
Comodo 11216 2012.01.08 –
DrWeb 5.0.2.03300 2012.01.08 Trojan.Fakealert.27220
Emsisoft 5.1.0.11 2012.01.08 Win32.SuspectCrc!IK
eSafe 7.0.17.0 2012.01.08 –
eTrust-Vet 37.0.9668 2012.01.06 –
F-Prot 4.6.5.141 2012.01.07 –
F-Secure 9.0.16440.0 2012.01.08 Gen:Variant.Kazy.52207
Fortinet 4.3.388.0 2012.01.08 –
GData 22 2012.01.08 Gen:Variant.Kazy.52207
Ikarus T3.1.1.109.0 2012.01.08 Win32.SuspectCrc
Jiangmin 13.0.900 2012.01.08 –
K7AntiVirus 9.123.5881 2012.01.06 –
Kaspersky 9.0.0.837 2012.01.08 Trojan-FakeAV.Win32.FakeRecovery.hr
McAfee 5.400.0.1158 2012.01.08 FakeAlert-SysDef.b
McAfee-GW-Edition 2010.1E 2012.01.08 FakeAlert-SysDef.b
Microsoft 1.7903 2012.01.08 –
NOD32 6777 2012.01.08 Win32/TrojanDownloader.Prodatect.BK
Norman 6.07.13 2012.01.08 –
nProtect 2012-01-08.01 2012.01.08 –
Panda 10.0.3.5 2012.01.08 Trj/CI.A
PCTools 8.0.0.5 2012.01.08 –
Prevx 3.0 2012.01.09 –
Rising 23.91.04.02 2012.01.06 –
Sophos 4.73.0 2012.01.08 –
SUPERAntiSpyware 4.40.0.1006 2012.01.07 –
Symantec 20111.2.0.82 2012.01.08 Suspicious.Cloud.5
TheHacker 6.7.0.1.373 2012.01.08 –
TrendMicro 9.500.0.1008 2012.01.08 –
TrendMicro-HouseCall 9.500.0.1008 2012.01.08 –
VBA32 3.12.16.4 2012.01.06 –
VIPRE 11370 2012.01.08 –
ViRobot 2012.1.7.4869 2012.01.08 –
VirusBuster 14.1.157.0 2012.01.08 –

Additional informationShow all
MD5   : f82ad83c57e7f20b8b2a3c03262aa6aa
SHA1  : 9e29b1cb9b9e5af7237b4cdfa9272046a1ed09e5

File size : 445132 bytes

publisher….: n/a
copyright….: Copyright (C) 2009-11
product……: Power Csd
description..: Power Cs
original name:
internal name:
file version.: 15, 27, 0, 19
________

File name: UEWKKQFYKOLVFJ.EXE.Muestra EliStartPage v24.60
Submission date: 2012-01-09 15:09:24 (UTC)

Result: 17/ 39 (43.6%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2012.01.09.00 2012.01.09 –
AntiVir 7.11.20.200 2012.01.09 TR/Offend.KD.510902.2
Antiy-AVL 2.0.3.7 2012.01.09 –
Avast 6.0.1289.0 2012.01.09 Win32:Downloader-MDU [Trj]
AVG 10.0.0.1190 2012.01.09 Generic26.BJIL
BitDefender 7.2 2012.01.09 Trojan.Generic.KD.510902
CAT-QuickHeal 12.00 2012.01.09 Trojan.FakeAV
ClamAV 0.97.3.0 2012.01.09 –
Commtouch 5.3.2.6 2012.01.09 –
Comodo 11223 2012.01.09 –
DrWeb 5.0.2.03300 2012.01.09 Trojan.Fakealert.27220
Emsisoft 5.1.0.11 2012.01.09 Trojan.Win32.FakeSysdef!IK
eSafe 7.0.17.0 2012.01.08 –
eTrust-Vet 37.0.9671 2012.01.09 –
F-Prot 4.6.5.141 2012.01.09 –
F-Secure 9.0.16440.0 2012.01.09 Trojan.Generic.KD.510902
Fortinet 4.3.388.0 2012.01.09 W32/FakeAV.OZ!tr
GData 22 2012.01.09 Trojan.Generic.KD.510902
Ikarus T3.1.1.109.0 2012.01.09 Trojan.Win32.FakeSysdef
Jiangmin 13.0.900 2012.01.08 –
K7AntiVirus 9.123.5881 2012.01.06 –
Kaspersky 9.0.0.837 2012.01.09 Trojan-FakeAV.Win32.FakeRecovery.hv
Microsoft 1.7903 2012.01.09 Trojan:Win32/FakeSysdef
NOD32 6779 2012.01.09 a variant of Win32/Kryptik.YPJ
Norman 6.07.13 2012.01.09 –
nProtect 2012-01-09.01 2012.01.09 –
Panda 10.0.3.5 2012.01.08 Suspicious file
PCTools 8.0.0.5 2012.01.09 –
Prevx 3.0 2012.01.09 –
Rising 23.92.00.02 2012.01.09 –
Sophos 4.73.0 2012.01.09 Mal/FakeAV-OZ
SUPERAntiSpyware 4.40.0.1006 2012.01.07 –
Symantec 20111.2.0.82 2012.01.09 –
TheHacker 6.7.0.1.373 2012.01.08 –
TrendMicro 9.500.0.1008 2012.01.09 –
TrendMicro-HouseCall 9.500.0.1008 2012.01.09 –
VIPRE 11374 2012.01.09 Trojan.Win32.Generic!BT
ViRobot 2012.1.9.4871 2012.01.09 –
VirusBuster 14.1.157.0 2012.01.08 –

Additional informationShow all
MD5   : e67608c27c5c40ea4a2f5e82f311dbb6
SHA1  : f12f2509841e94d99a7d5f29cdcd093ceeffe030

File size : 446208 bytes

Dicha version del ELISTARA 24.61 QUE LOS DETECTA Y ELIMINA, ESTARÁ DISPONIBLE EN NUESTRA WEB A PARTIR DE LAS 19 H CEST de hoy
saludos

ms, 9-1-2012
NOTA:  Los FAKE ALERT que generan estos droppers son de los que esconde ficheros y escritorio, y si bien el mismo ELISTARA los regenera si conoce y detecta los ficheros infectados, sino  pueden restaurarse, una vez eliminado el troyano, desde una ventana del DOS, entrando ATTRIIB C:\*.* -H /S /D

MS.