Variantes de dropper y scanner de FAKE TOOLS SYSTEM RESTORE

Ya controlados por actual ELISTARA 24.64

Los preanalisis de virustpotal ofrecen estos informes:
DROPPER:

NOMBRE FICHERO TFKQDQPMLLVS.EXE.Muestra EliStartPage v24.12
SHA256: 2acba0e5ce57818c17210a1d2655c7ce08d2d9220c4474a5c63430b4dd2e8617
SHA1: 333e487fa44583b68bb0fe4782616c1cfb5a059f
MD5: 8df66428f1a3c4ddf8fa3cf9b48114f4
File size: 496.0 KB ( 507904 bytes )
File type: Win32 EXE
Detection ratio: 35 / 43
Analysis date: 2011-12-16 20:07:45 UTC ( 3 weeks, 5 days ago )

00Antivirus Result Version Update
AhnLab-V3 Trojan/Win32.Jorik 2011.12.16.04 20111216
AntiVir TR/Crypt.XPACK.Gen 7.11.19.153 20111216
Antiy-AVL Trojan/Win32.Jorik.gen 2.0.3.7 20111216
Avast Win32:MalOb-GY [Cryp] 6.0.1289.0 20111216
AVG Downloader.Zlob.BDGW 10.0.0.1190 20111216
BitDefender Trojan.Generic.KDV.383212 7.2 20111216
ByteHero Trojan.Win32.Heur.Gen 1.0.0.1 20111207
CAT-QuickHeal Trojan.FakeAV 12.00 20111216
ClamAV – 0.97.3.0 20111216
Commtouch – 5.3.2.6 20111216
Comodo UnclassifiedMalware 10980 20111216
DrWeb Trojan.DownLoad2.39057 5.0.2.03300 20111216
Emsisoft Trojan-Downloader!IK 5.1.0.11 20111216
eSafe – 7.0.17.0 20111215
eTrust-Vet – 37.0.9627 20111216
F-Prot – 4.6.5.141 20111216
F-Secure Trojan.Generic.KDV.383212 9.0.16440.0 20111216
Fortinet W32/FakeAV.OP!tr 4.3.388.0 20111216
GData Trojan.Generic.KDV.383212 22.309/22.581 20111216
Ikarus Trojan-Downloader T3.1.1.109.0 20111216
Jiangmin Trojan/FakeDefrag.il 13.0.900 20111216
K7AntiVirus Trojan 9.119.5696 20111215
Kaspersky Trojan.Win32.FakeDefrag.nb 9.0.0.837 20111216
McAfee FakeAlert-SysDef.b 5.400.0.1158 20111216
McAfee-GW-Edition FakeAlert-SysDef.b 2010.1E 20111216
Microsoft Trojan:Win32/FakeSysdef 1.7903 20111216
NOD32 a variant of Win32/Kryptik.UGI 6718 20111216
Norman W32/FakeAV.AETR 6.07.13 20111216
nProtect Trojan/W32.Agent.507904.GU 2011-12-16.01 20111216
Panda Generic Trojan 10.0.3.5 20111216
PCTools Trojan.Gen 8.0.0.5 20111216
Prevx – 3.0 20111216
Rising – 23.88.03.02 20111216
Sophos Mal/FakeAV-OP 4.72.0 20111216
SUPERAntiSpyware Trojan.Agent/Gen-RogueAntiSpy 4.40.0.1006 20111216
Symantec Trojan.Gen.2 20111.2.0.82 20111216
TheHacker Trojan/Kryptik.ugi 6.7.0.1.360 20111216
TrendMicro TROJ_KRYPTK.SMUF 9.500.0.1008 20111216
TrendMicro-HouseCall TROJ_KRYPTK.SMUF 9.500.0.1008 20111216
VBA32 Trojan.FakeDefrag.mv 3.12.16.4 20111214
VIPRE Trojan.Win32.Fakeav.op (v) 11263 20111216
ViRobot – 2011.12.16.4829 20111216
VirusBuster Trojan.Kryptik!Ss48s6H3p4s 14.1.120.0 20111216

_________

SCANNER:

Nombre fichero  6DSS92C31APGJK.EXE.Muestra EliStartPage v24.12

SHA256: a7355551db5f5bd347882f3d58d7909b08356d0e284aa33c266e7813a555a9b2
SHA1: 0d7c53dc5a1b9e867abf7b68c8188149696e836b
MD5: 0e027c781f2e3e14373a82657607bf0c
File size: 384.0 KB ( 393216 bytes )
File type: Win32 EXE
Detection ratio: 22 / 43
Analysis date: 2011-10-24 11:11:41 UTC ( 2 months, 2 weeks ago )

00Antivirus Result Version Update
AhnLab-V3 Trojan/Win32.Jorik 2011.10.24.00 20111024
AntiVir TR/Fakealert.TZ 7.11.16.125 20111024
Antiy-AVL Trojan/Win32.Jorik.gen 2.0.3.7 20111024
Avast Win32:FakeAlert-BHX [Trj] 6.0.1289.0 20111024
AVG Downloader.Zlob.BDGW 10.0.0.1190 20111024
BitDefender – 7.2 20111024
ByteHero Trojan.Win32.Heur.Gen 1.0.0.1 20110923
CAT-QuickHeal (Suspicious) – DNAScan 11.00 20111024
ClamAV – 0.97.3.0 20111024
Commtouch – 5.3.2.6 20111023
Comodo – 10543 20111024
DrWeb Trojan.Packed.189 5.0.2.03300 20111024
Emsisoft Trojan-Downloader!IK 5.1.0.11 20111024
eSafe – 7.0.17.0 20111017
eTrust-Vet – 36.1.8636 20111024
F-Prot – 4.6.5.141 20111023
F-Secure – 9.0.16440.0 20111024
Fortinet – 4.3.370.0 20111024
GData Win32:FakeAlert-BHX  22 20111024
Ikarus Trojan-Downloader T3.1.1.107.0 20111024
Jiangmin – 13.0.900 20111023
K7AntiVirus – 9.116.5326 20111022
Kaspersky Trojan.Win32.FakeDefrag.nb 9.0.0.837 20111024
McAfee FakeAlert-SysDef.b 5.400.0.1158 20111024
McAfee-GW-Edition FakeAlert-SysDef.b 2010.1D 20111024
Microsoft Trojan:Win32/FakeSysdef 1.7801 20111024
NOD32 a variant of Win32/Kryptik.UGI 6569 20111024
Norman W32/FakeAV.AETR 6.07.13 20111024
nProtect – 2011-10-24.01 20111024
Panda – 10.0.3.5 20111023
PCTools Trojan.Gen 8.0.0.5 20111024
Prevx – 3.0 20111024
Rising – 23.81.00.01 20111024
Sophos Mal/FakeAV-OP 4.70.0 20111024
SUPERAntiSpyware Trojan.Agent/Gen-RogueAntiSpy 4.40.0.1006 20111022
Symantec Trojan.Gen 20111.2.0.82 20111024
TheHacker – 6.7.0.1.330 20111024
TrendMicro – 9.500.0.1008 20111024
TrendMicro-HouseCall – 9.500.0.1008 20111024
VBA32 – 3.12.16.4 20111024
VIPRE Trojan.Win32.Generic.pak!cobra 10858 20111024
ViRobot – 2011.10.24.4735 20111024
VirusBuster – 14.1.27.0 20111024
Ambos son detectados y eliminados por el actual ELISTARA 24.63 YA DISPONIBLE EN NUESTRA WEB

saludos

ms, 12-1-2012