NUEVA VARIANTE DE AUTORUN ANTIAV, impide la ejecucion del algunos antivirus

A partir del ELISTARA 29.09 de hoy, pasamos a controlar esta nueva variante de malware

EL AUTORUN.INF que crea contiene las siguientes instrucciones:
[AutoRun]
Open=sms.exe
Shell\Open=´ò¿ª(&O)
Shell\Open\Command=sms.exe
Shell\Open\Default=1
Shell\Explore=×ÊÔ´¹ÜÀíÆ÷(&X)
Shell\Explore\Command=sms.exe
El preanalisis de virustotal ofrece este informe:

MD5 0cd938ee5334de9344cedd6d45b11ae0
SHA1 528a1febb9b262c4569bfbe434801e1a87252878
File size 87.0 KB ( 89088 bytes )
SHA256: dc005c2f0a691a856a938b730957c9f4c52ad2cafee40a3ea6edb5cb79d44094
Nombre: sms.exe
Detecciones: 46 / 48
Fecha de análisis: 2014-01-07 17:17:47 UTC ( hace 0 minutos )

0 1 Análisis File detail Información adicional Comentarios Votos
Antivirus Resultado Actualización
AVG Worm/Generic2.AZEK 20140107
Ad-Aware Trojan.Generic.2903510 20140107
Agnitum Worm.AutoRun!YeUKllHOv0E 20140107
AhnLab-V3 Worm/Win32.AutoRun 20140107
AntiVir TR/Hijacker.Gen 20140107
Antiy-AVL Worm/Win32.AutoRun.gen 20140107
Avast Win32:Perkesh-D [Rtk] 20140107
Baidu-International Worm.Win32.AutoRun.aAM 20131213
BitDefender Trojan.Generic.2903510 20140107
Bkav W32.Bobosadc.Worm 20140107
CAT-QuickHeal Worm.Yeltminky.A9 20140107
ClamAV Win.Trojan.Autorun-833 20140107
Commtouch W32/Agent.S.gen!Eldorado 20140107
Comodo TrojWare.Win32.TrojanDownloader.Delf.gen 20140107
DrWeb Win32.HLLW.Autoruner.45767 20140107
ESET-NOD32 a variant of Win32/AutoRun.Delf.EP 20140107
Emsisoft Trojan.Generic.2903510 (B) 20140107
F-Prot W32/Agent.S.gen!Eldorado 20140107
F-Secure Trojan.Generic.2903510 20140107
Fortinet W32/AutoRun.BCC!worm 20140107
GData Trojan.Generic.2903510 20140107
Ikarus Trojan-PWS.Win32.Lmir 20140107
Jiangmin Worm/AutoRun.vug 20140107
K7AntiVirus EmailWorm ( 003c03451 ) 20140107
K7GW EmailWorm ( 003c03451 ) 20140107
Kaspersky Worm.Win32.AutoRun.gchc 20140107
Kingsoft Win32.Troj.DownSAT.89088 20130829
McAfee BackDoor-DOQ.gen.y 20140107
McAfee-GW-Edition BackDoor-DOQ.gen.y 20140107
MicroWorld-eScan Trojan.Generic.2903510 20140107
Microsoft Worm:Win32/Yeltminky.A 20140107
NANO-Antivirus Trojan.Win32.AutoRun.thwry 20140107
Norman Killav.BPLK 20140107
Panda Generic Trojan 20140107
Rising PE:Trojan.Win32.Generic.12DF2FF6!316616694 20140107
SUPERAntiSpyware Trojan.Agent/Gen-AutoRun 20140107
Sophos Troj/Buzus-FX 20140107
Symantec Trojan.Dropper 20140106
TheHacker W32/AutoRun.bbvg 20140107
TotalDefense Win32/Runotua.H 20140107
TrendMicro Mal_Otorun9 20140107
TrendMicro-HouseCall TROJ_GEN.F47V0107 20140107
VBA32 BScope.P2P-Worm.Palevo 20140105
VIPRE Worm.Win32.AutoRun.bbtf (v) 20140107
ViRobot Worm.Win32.A.AutoRun.89088 20140107
nProtect Worm/W32.AutoRun.89088.B 20140107
ByteHero  20131227
Malwarebytes  20140107
Dicha version del ELISTARA 29.09 que lo detecta y elimina, estará disponible en nuestra web a partir de las 19 h CEST de hoy

saludos

ms, 7-1-2014