DROPPERS DE VARIANTES DE FAKE TOOLS WINDOWS RECOVERY

Cazados por la heuristica del ELISTARA se han recibido estas tres variantes de DROPPER de dicha familia, que oculta todo el disco duro
El preanalisia de virusTotal muestra los siguientes informes
File name: GQDBPXKGEMOE.EXE.Muestra EliStartPage v23.93
Submission date: 2011-09-23 10:11:02 (UTC)
Current status: finished
Result: 16 /44 (36.4%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.09.22.02 2011.09.22 –
AntiVir 7.11.15.18 2011.09.23 –
Antiy-AVL 2.0.3.7 2011.09.23 –
Avast 4.8.1351.0 2011.09.22 –
Avast5 5.0.677.0 2011.09.22 –
AVG 10.0.0.1190 2011.09.23 Generic25.HG
BitDefender 7.2 2011.09.23 Trojan.Generic.KD.363089
ByteHero 1.0.0.1 2011.09.23 Trojan.Win32.Heur.Gen
CAT-QuickHeal 11.00 2011.09.23 –
ClamAV 0.97.0.0 2011.09.23 –
Commtouch 5.3.2.6 2011.09.23 –
Comodo 10212 2011.09.23 –
DrWeb 5.0.2.03300 2011.09.23 –
Emsisoft 5.1.0.11 2011.09.23 Trojan.Win32.FakeSysdef!IK
eSafe 7.0.17.0 2011.09.20 –
eTrust-Vet 36.1.8577 2011.09.23 –
F-Prot 4.6.2.117 2011.09.23 –
F-Secure 9.0.16440.0 2011.09.23 Trojan.Generic.KD.363089
Fortinet 4.3.370.0 2011.09.23 –
GData 22 2011.09.23 Trojan.Generic.KD.363089
Ikarus T3.1.1.107.0 2011.09.23 Trojan.Win32.FakeSysdef
Jiangmin 13.0.900 2011.09.22 –
K7AntiVirus 9.113.5179 2011.09.22 –
Kaspersky 9.0.0.837 2011.09.23 Trojan.Win32.FraudPack.cxwu
McAfee 5.400.0.1158 2011.09.23 –
McAfee-GW-Edition 2010.1D 2011.09.22 –
Microsoft 1.7702 2011.09.23 –
NOD32 6487 2011.09.23 a variant of Win32/Kryptik.TCN
Norman 6.07.11 2011.09.23 –
nProtect 2011-09-23.01 2011.09.23 –
Panda 10.0.3.5 2011.09.22 Trj/CI.A
PCTools 8.0.0.5 2011.09.23 Trojan.FakeAV!rem
Prevx 3.0 2011.09.23 –
Rising 23.76.04.01 2011.09.23 –
Sophos 4.69.0 2011.09.23 Mal/FakeAV-LS
SUPERAntiSpyware 4.40.0.1006 2011.09.23 Trojan.Agent/Gen-FraudAS
Symantec 20111.2.0.82 2011.09.23 Trojan.FakeAV
TheHacker 6.7.0.1.307 2011.09.23 –
TrendMicro 9.500.0.1008 2011.09.23 –
TrendMicro-HouseCall 9.500.0.1008 2011.09.23 –
VBA32 3.12.16.4 2011.09.22 –
VIPRE 10555 2011.09.23 Trojan.Win32.Generic.pak!cobra
ViRobot 2011.9.23.4685 2011.09.23 Trojan.Win32.FakeAV.461824.G
VirusBuster 14.0.227.0 2011.09.22 –
Additional informationShow all
MD5   : d9f97b7bea90fdd7a91ceb19c7e838fa
SHA1  : 80f251818283184b336090c1f496b0599eddc434

File size : 459776 bytes

publisher….: NetPlay Software
copyright….: Copyright (C) 2002-2007
product……: Instant Demo
description..: Instant Demo Application
original name: InstantDemo.EXE
internal name: InstantDemo
file version.: 6, 50, 56, 0

_________
File name: UNIHMVVRTPI.EXE.Muestra EliStartPage v23.93
Submission date: 2011-09-23 09:35:23 (UTC)
Current status: finished
Result: 4 /44 (9.1%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.09.18.00 2011.09.18 –
AntiVir 7.11.14.224 2011.09.18 –
Antiy-AVL 2.0.3.7 2011.09.18 –
Avast 4.8.1351.0 2011.09.18 –
Avast5 5.0.677.0 2011.09.18 –
AVG 10.0.0.1190 2011.09.18 –
BitDefender 7.2 2011.09.18 –
ByteHero 1.0.0.1 2011.09.13 Trojan.Win32.Heur.Gen
CAT-QuickHeal 11.00 2011.09.18 –
ClamAV 0.97.0.0 2011.09.18 –
Commtouch 5.3.2.6 2011.09.18 –
Comodo 10158 2011.09.18 –
DrWeb 5.0.2.03300 2011.09.18 –
Emsisoft 5.1.0.11 2011.09.18 –
eSafe 7.0.17.0 2011.09.18 –
eTrust-Vet 36.1.8566 2011.09.17 –
F-Prot 4.6.2.117 2011.09.18 –
F-Secure 9.0.16440.0 2011.09.18 –
Fortinet 4.3.370.0 2011.09.18 –
GData 22 2011.09.18 –
Ikarus T3.1.1.107.0 2011.09.18 –
Jiangmin 13.0.900 2011.09.18 –
K7AntiVirus 9.113.5150 2011.09.17 –
Kaspersky 9.0.0.837 2011.09.18 –
McAfee 5.400.0.1158 2011.09.18 Artemis!0184FC3BDB42
McAfee-GW-Edition 2010.1D 2011.09.18 Artemis!0184FC3BDB42
Microsoft 1.7604 2011.09.18 –
NOD32 6474 2011.09.18 –
Norman 6.07.11 2011.09.18 –
nProtect 2011-09-18.01 2011.09.18 –
Panda 10.0.3.5 2011.09.18 Trj/CI.A
PCTools 8.0.0.5 2011.09.18 –
Prevx 3.0 2011.09.23 –
Rising 23.75.04.02 2011.09.16 –
Sophos 4.69.0 2011.09.18 –
SUPERAntiSpyware 4.40.0.1006 2011.09.17 –
Symantec 20111.2.0.82 2011.09.18 –
TheHacker 6.7.0.1.298 2011.09.17 –
TrendMicro 9.500.0.1008 2011.09.18 –
TrendMicro-HouseCall 9.500.0.1008 2011.09.18 –
VBA32 3.12.16.4 2011.09.16 –
VIPRE 10515 2011.09.18 –
ViRobot 2011.9.17.4674 2011.09.18 –
VirusBuster 14.0.219.0 2011.09.18 –
Additional informationShow all
MD5   : 0184fc3bdb4289d5b9c5af29f05a024e
SHA1  : 19321debe545ededf27a856112c173235fb9f341

File size : 451584 bytes

publisher….: NetPlay Software
copyright….: Copyright (C) 2002-2007
product……: Instant Demo
description..: Instant Demo Application
original name: InstantDemo.EXE
internal name: InstantDemo
file version.: 6, 50, 56, 0

__________
File name: XHBGIEEAJCIKWU.EXE.Muestra EliStartPage v23.93
Submission date: 2011-09-23 10:32:15 (UTC)
Current status: queued (#2) queued analysing finished
Result: 18/ 44 (40.9%)
VT Community

not reviewed
Safety score: –
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.09.22.02 2011.09.22 –
AntiVir 7.11.15.18 2011.09.23 –
Antiy-AVL 2.0.3.7 2011.09.23 –
Avast 4.8.1351.0 2011.09.22 –
Avast5 5.0.677.0 2011.09.22 –
AVG 10.0.0.1190 2011.09.23 Generic25.HG
BitDefender 7.2 2011.09.23 Trojan.Generic.KD.362935
ByteHero None 2011.09.23 Trojan.Win32.Heur.Gen
CAT-QuickHeal 11.00 2011.09.23 –
ClamAV 0.97.0.0 2011.09.23 –
Commtouch 5.3.2.6 2011.09.23 –
Comodo 10215 2011.09.23 UnclassifiedMalware
DrWeb 5.0.2.03300 2011.09.23 –
Emsisoft 5.1.0.11 2011.09.23 Trojan.Win32.FakeSysdef!IK
eSafe 7.0.17.0 2011.09.20 –
eTrust-Vet 36.1.8577 2011.09.23 –
F-Prot 4.6.2.117 2011.09.23 –
F-Secure 9.0.16440.0 2011.09.23 Trojan.Generic.KD.362935
Fortinet 4.3.370.0 2011.09.23 –
GData 22 2011.09.23 Trojan.Generic.KD.362935
Ikarus T3.1.1.107.0 2011.09.23 Trojan.Win32.FakeSysdef
Jiangmin 13.0.900 2011.09.22 –
K7AntiVirus 9.113.5179 2011.09.22 –
Kaspersky 9.0.0.837 2011.09.23 –
McAfee 5.400.0.1158 2011.09.23 Downloader-CPD
McAfee-GW-Edition 2010.1D 2011.09.22 Artemis!728AD7492B28
Microsoft 1.7702 2011.09.23 –
NOD32 6487 2011.09.23 a variant of Win32/Kryptik.TCN
Norman 6.07.11 2011.09.23 –
nProtect 2011-09-23.01 2011.09.23 –
Panda 10.0.3.5 2011.09.22 Trj/CI.A
PCTools 8.0.0.5 2011.09.23 Trojan.FakeAV!rem
Prevx 3.0 2011.09.23 –
Rising 23.76.04.01 2011.09.23 –
Sophos 4.69.0 2011.09.23 Mal/FakeAV-LS
SUPERAntiSpyware 4.40.0.1006 2011.09.23 Trojan.Agent/Gen-FraudAS
Symantec 20111.2.0.82 2011.09.23 Trojan.FakeAV
TheHacker 6.7.0.1.307 2011.09.23 –
TrendMicro 9.500.0.1008 2011.09.23 –
TrendMicro-HouseCall 9.500.0.1008 2011.09.23 –
VBA32 3.12.16.4 2011.09.22 –
VIPRE 10555 2011.09.23 Trojan.Win32.Generic.pak!cobra
ViRobot 2011.9.23.4685 2011.09.23 Trojan.Win32.FakeAV.461824.G
VirusBuster 14.0.227.0 2011.09.22 –
Additional informationShow all
MD5   : 728ad7492b282f376ec8aad0f749b412
SHA1  : 3f0424354f39be7c562dfa99ab6e40f10cb03a55
SHA256: acb1ee4eaa6d44f3ce4fab8f7879c198c0450220862d78fa489bb004ccf00f7e
ssdeep: 12288:kG6sLvWzAS6RTl/7oYLQzadWVcRrg2gk2:QsL+EBLlbrg2gk
File size : 456192 bytes
First seen: 2011-09-22 19:07:52
Last seen : 2011-09-23 10:32:15
TrID:
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: NetPlay Software
copyright….: Copyright (C) 2002-2007
product……: Instant Demo
description..: Instant Demo Application
original name: InstantDemo.EXE
internal name: InstantDemo
file version.: 6, 50, 56, 0
Dicha version del ELISTARA 23.94 que los detecta y elimina, estará disponible en nuestra web a partir de las 15 h CEST de hoy

saludos

ms, 23-9-2011