Dos nuevas variantes de AUTORUN VBNA cazadas por la heuristica del ELISTARA

Nuevas muestras cazadas por el sistema heuristico del ELISTARA han resultado ser maliciosas y pasamos a controlarlas especificamente a partir del ELISTARA 24.36 DE HOY

Los preanalisis con el virustotal de ambas muestras, han ofrecido los siguientes informes:
File name: WINLOGON.EXE.Muestra EliStartPage v23.41
Submission date: 2011-11-28 14:52:38 (UTC)
Current status: queued queued analysing finished
Result: 33/ 43 (76.7%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.11.27.00 2011.11.27 Trojan/Win32.VBKrypt
AntiVir 7.11.18.87 2011.11.28 TR/Crypt.XPACK.Gen
Antiy-AVL 2.0.3.7 2011.11.28 –
Avast 6.0.1289.0 2011.11.28 Win32:VBInject [Drp]
AVG 10.0.0.1190 2011.11.28 Dropper.Generic2.AWQD
BitDefender 7.2 2011.11.28 Trojan.Generic.KDV.36633
ByteHero 1.0.0.1 2011.11.14 –
CAT-QuickHeal 12.00 2011.11.28 Worm.Esfury.A
ClamAV 0.97.3.0 2011.11.28 –
Commtouch 5.3.2.6 2011.11.28 –
Comodo 10791 2011.11.27 UnclassifiedMalware
DrWeb 5.0.2.03300 2011.11.28 Trojan.VbCrypt.8
Emsisoft 5.1.0.11 2011.11.28 Virus.Win32.VBInject!IK
eSafe 7.0.17.0 2011.11.28 –
eTrust-Vet 37.0.9590 2011.11.28 Win32/VBInject.D!generic
F-Prot 4.6.5.141 2011.11.27 –
F-Secure 9.0.16440.0 2011.11.28 Trojan.Generic.KDV.36633
Fortinet 4.3.370.0 2011.11.27 W32/VB.WL!tr
GData 22.289/22.535 2011.11.28 Trojan.Generic.KDV.36633
Ikarus T3.1.1.109.0 2011.11.28 Virus.Win32.VBInject
Jiangmin 13.0.900 2011.11.28 Trojan/Generic.lyrx
K7AntiVirus 9.119.5542 2011.11.25 Trojan
Kaspersky 9.0.0.837 2011.11.28 HEUR:Trojan.Win32.Generic
McAfee 5.400.0.1158 2011.11.28 Downloader-CJX.gen.j
McAfee-GW-Edition 2010.1D 2011.11.28 Downloader-CJX.gen.j
Microsoft 1.7801 2011.11.28 VirTool:Win32/VBInject.gen!EN
NOD32 6666 2011.11.28 probably a variant of Win32/Injector.CYO
Norman 6.07.13 2011.11.28 W32/VBKrypt.AA
nProtect 2011-11-28.02 2011.11.28 –
Panda 10.0.3.5 2011.11.27 Generic Trojan
PCTools 8.0.0.5 2011.11.28 Malware.Rontokbro
Prevx 3.0 2011.11.28 –
Rising 23.86.00.01 2011.11.28 Trojan.Win32.Generic.1260424F
Sophos 4.71.0 2011.11.28 Mal/SillyFDC-F
SUPERAntiSpyware 4.40.0.1006 2011.11.26 Trojan.Agent/Gen-Autorun[VB]
Symantec 20111.2.0.82 2011.11.28 W32.Rontokbro!gen1
TheHacker 6.7.0.1.350 2011.11.27 –
TrendMicro 9.500.0.1008 2011.11.28 TROJ_SPNR.07F611
TrendMicro-HouseCall 9.500.0.1008 2011.11.28 TROJ_SPNR.07F611
VBA32 3.12.16.4 2011.11.28 –
VIPRE 11170 2011.11.28 Trojan.Win32.Generic!BT
ViRobot 2011.11.28.4797 2011.11.28 Trojan.Win32.VBInject.159776
VirusBuster 14.1.88.0 2011.11.28 Trojan.Injector!hyPKBuwqk7M
Additional informationShow all
MD5   : 1e3ff65cc78c0d64e7b0235967b9dd3a
SHA1  : ff92a249d4e3693b3764aab5118af0b475a346fc

File size : 159776 bytes

publisher….: n/a
copyright….: n/a
product……: R0c_12d6c
description..: n/a
original name: 18.exe
internal name: 18
file version.: 1.00
__________
y el otro:
File name: WINLOGON.EXE.Muestra EliStartPage v23.69
Submission date: 2011-11-28 15:00:59 (UTC)
Current status: queued queued (#4) analysing finished
Result: 38/ 43 (88.4%)
VT Community

malware
Safety score: 0.0%
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.11.27.00 2011.11.27 Win-Trojan/Xema.variant
AntiVir 7.11.18.87 2011.11.28 TR/VB.dxva
Antiy-AVL 2.0.3.7 2011.11.28 Trojan/Win32.VB.gen
Avast 6.0.1289.0 2011.11.28 Win32:Malware-gen
AVG 10.0.0.1190 2011.11.28 Dropper.Generic2.AOOI
BitDefender 7.2 2011.11.28 Trojan.Generic.4814182
ByteHero 1.0.0.1 2011.11.14 –
CAT-QuickHeal 12.00 2011.11.28 Worm.VBNA.gen
ClamAV 0.97.3.0 2011.11.28 Trojan.VB-20032
Commtouch 5.3.2.6 2011.11.28 W32/VB.CF.gen!Eldorado
Comodo 10791 2011.11.27 UnclassifiedMalware
DrWeb 5.0.2.03300 2011.11.28 Trojan.Siggen3.5607
Emsisoft 5.1.0.11 2011.11.28 Trojan.Click!IK
eSafe 7.0.17.0 2011.11.28 Win32.TRVB.Dxva
eTrust-Vet 37.0.9590 2011.11.28 –
F-Prot 4.6.5.141 2011.11.27 W32/VB.CF.gen!Eldorado
F-Secure 9.0.16440.0 2011.11.28 Trojan.Generic.4814182
Fortinet 4.3.370.0 2011.11.27 W32/VB.fam
GData 22.289/22.535 2011.11.28 Trojan.Generic.4814182
Ikarus T3.1.1.109.0 2011.11.28 Trojan.Click
Jiangmin 13.0.900 2011.11.28 Trojan/VB.fqt
K7AntiVirus 9.119.5542 2011.11.25 Trojan
Kaspersky 9.0.0.837 2011.11.28 Trojan.Win32.VB.ajvg
McAfee 5.400.0.1158 2011.11.28 Generic.dx!top
McAfee-GW-Edition 2010.1D 2011.11.28 Generic.dx!top
Microsoft 1.7801 2011.11.28 VirTool:Win32/VBInject.gen!EL
NOD32 6666 2011.11.28 a variant of Win32/Injector.EMG
Norman 6.07.13 2011.11.28 W32/Suspicious_Gen2.GJQNZ
nProtect 2011-11-28.02 2011.11.28 –
Panda 10.0.3.5 2011.11.27 W32/Brontok.LB
PCTools 8.0.0.5 2011.11.28 Email-Worm.Rontokbro!rem
Prevx 3.0 2011.11.28 –
Rising 23.86.00.01 2011.11.28 Trojan.Win32.Generic.123C44B2
Sophos 4.71.0 2011.11.28 Mal/SillyFDC-F
SUPERAntiSpyware 4.40.0.1006 2011.11.26 –
Symantec 20111.2.0.82 2011.11.28 tokbro@mm”>W32.Rontokbro@mm
TheHacker 6.7.0.1.350 2011.11.27 Trojan/VB.ajvg
TrendMicro 9.500.0.1008 2011.11.28 WORM_VBNA.SMY
TrendMicro-HouseCall 9.500.0.1008 2011.11.28 WORM_VBNA.SMY
VBA32 3.12.16.4 2011.11.28 Trojan.VB.Schmidti
VIPRE 11170 2011.11.28 Trojan.Win32.Generic!BT
ViRobot 2011.11.28.4797 2011.11.28 Trojan.Win32.VB.126976.AE
VirusBuster 14.1.88.0 2011.11.28 Trojan.VB!nmXhHO5WUyc
Additional informationShow all
MD5   : e8fcd519a90e1863c0e83f4f836933a2
SHA1  : 0258fc5477cb41ec9ae3d52de43157722034eb86

File size : 126976 bytes

publisher….: n/a
copyright….: n/a
product……: j2e_1cmb0_28_0a
description..: n/a
original name: 5.exe
internal name: 5
file version.: 1.00

Dicha version del ELISTARA 24.36 que los detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 28-11-2011