SillyDI DIC supuesto trojano en C:\autorun.inf (SOLUCIONADO)

[Claudia34]

Hola a todos.



Estoy escribiendo este tema, porque ayer despues de escanear la pc con los antivirus online como rutina que hago una vez a la semana, cuando estaba escaneando por ultimo en la pagina online de CA antivirus en la parte que es para escanear los spywares, hay una herramienta llamada eTrust PestPatrol, que me detecto un trojano en C:\autorun.inf llamado SillyDI DIC del cual la fecha en que fue descubierta por primera vez era en octubre del 2007 (dejo abajo mas detalles del informe).

Analize con virus total los archivos que hay dentro de autorun.inf que son Protect.sat y Test.sat y al parecer estaban limpios, los antivirus online que en total son unos 7 los que utilize antes del eTrust PestPatrol no encontraron nada, con respecto al elistara y elitrip tampoco encontraron nada sospechoso (todo estaba limpio) y por lo tanto creo que esto puede ser un falso positivo, aunque igual como siempre no bajo la guardia en estos aspectos.



Saludos y desde ya se agradece la ayuda que se me pueda brindar al respecto.



Dejo a continuacion el informe de Pest patrol:







United States - English [Change]

Search Form



All of CA About Us Education Insights News and Events Partners Products Security Advisor Small and Medium Business Solutions

How to Buy Insights

Thought Leadership Success Stories White Papers On-Demand Webcasts Blogs Podcasts Partners

Channel Partners Service & Consulting Partners OEM Partners Strategic Alliances Partner Locator Partner Portal Support

Technical Support Service Center User Groups Security Advisor Education

Courses Learning Options Learning Paths Business Solutions Certification Policies Promotions Partners Solutions

ITIL EITM Capability Solutions Industry Solutions Services Products

Product Categories

Application Development & Databases Application Performance Management Database Management Governance, Risk & Compliance for IT Infrastructure & Operations Management IT Service & Asset Management Mainframe Project, Portfolio & Financial Management Security Management Storage & Information Governance Product List Trials Demos Special Offers

Home > Support View my documents (0)



SillyDl DIC

Date Published:

Thursday, October 25, 2007

Threat Assessment



Overall Risk: High

Privacy: Medium

Productivity: Medium

System Integrity: Medium Characteristics

Category: Trojan



Immediate Protection Info



DAT Release Product DAT Version

Original eTrust PestPatrol v5

CA Antispyware v9

eTrust PestPatrol v8

11 15 2007

11 15 2007

11 15 2007



Latest eTrust PestPatrol v5

CA Antispyware v9

eTrust PestPatrol v8

03 13 2008

03 13 2008

03 13 2008







Scan for Spyware

Submit a Sample







Description

Origins

Operation

Removal

Research



Description

Category



Trojan: Any program with a hidden intent. Trojans are one of the leading causes of breaking into machines. If you pull down a program from a chat room, new group, or even from unsolicited e-mail, then the program is likely trojaned with some subversive purpose. The word Trojan can be used as a verb: To trojan a program is to add subversive functionality to an existing program. For example, a trojaned login program might be programmed to accept a certain password for any user's account that the hacker can use to log back into the system at any time. Rootkits often contain a suite of such trojaned programs.











Back to top

Origins

Author



Unknown





Others By This Author



Carpe Diem B

Generic Keylogger

Hupigon A

IRC.Flood B

Chepvil N

Lineage VK

Lineage VJ

LdPinch Z

LdPinch X

Agent AKK

Bancos ETW

QQHelper B

Dowque B

Dowque A

Privato

Pigeon AWE

VBDownloader A

Insmenta.A

BHO.NOVO

Zaptusk B

Generic_KeyLogger

SillyProxy AP

Orctudo A

Duiskbot A

Pigeon IL

Generic Key Logger





Date of Origin



date of origin: October, 2007









Back to top

Operation







SillyDl DIC: at least SillyDl DICKB







Back to top

Removal

Detections:



true



Executable Files:



true



Files:



sbl.exe

%system%\1.inf

%systemdrive%\autorun.inf

sbl.exe









File Analysis





SillyDl DIC







Back to top

Research

AllTheWeb

AltaVista

AOL Search

Ask Jeeves

Google

HotBot

Lycos

LookSmart

MSN

Yahoo!



Computer Associates eTrust PestPatrol







Back to top







Buy

CA Anti-Spyware



Small and Medium Business

Home and Home Office

GLOBAL SECURITY ADVISOR

Current threat condition:



Low

Documents and Tools

Scan for spyware

Scan for viruses

Receive threat advisories

Install threat dashboard

Submit a sample



Instructions

Virus/Spyware

Statistical reports

Scorecard criteria

Cookie scorecard

Spyware encyclopedia

Browse glossary

Security Advisor Resources



FIND THREATS

Viruses Spyware



Vulnerabilities All





Security Resources

Analyst Reports

Gartner Magic Quadrant for Web Access Management, 2H07

Finding a Comprehensive Password Management Solution: The Initial Piece of the Identity and Access Management Puzzle (237 KB PDF)

More

News

Privacy alert: Cookie variants can be used to skirt blockers, anti-spyware tools

Beacon's user tracking extends beyond Facebook, CA says

More

Press

CA Security Business Leader Dave Hansen to Keynote at RSA Conference on Evolving Role of the Security Professional

CA Internet Security Report Forecasts Top Online Threats for 2008

More

Events

Cross-Platform Identity and Access Management From The Mainframe to The Web: Integrating z/Series Security

Achieving Compliance With CA Security Management Solutions for Mainframe

More

Insights

On-Demand Webcasts

Optimizing Visual Studio Development With CA Software Change Manager for Distributed

CA SOA Security Manager R12 Technical Update

More

Podcasts

West Corporation Align's IT Resources and Manages Growth

Security IAM Series — Security and Compliance for Mainframe IAM



Page ToolsPrintEmailRate About Us | News and Events | Contact Us | RSS Feeds Sitemap | Privacy | Legal | Copyright © 2008 CA

[msc hotline sat]

No te fies de un solo antivirus, subelo al VirusTOtal que son 32 y posteanos el resultado, gracias:



https://www.virustotal.com/es/



saludos



ms, 10-04-2008

[Claudia34]

En realidad ya lo habia hecho en ese mismo momento (subirlo a virus total) y me indico que estaba limpio, o sea los 2 archivos que indique arriba estan limpios ninguno de los 32 antivirus detecto algo fuera de lo usual.



Lo que si me llama la atencion es que el pestpatrol me indico una infeccion en la carpeta autorun.inf, pero no indico una infeccion en un archivo especifico como suele ocurrir normalmente.

Estoy perpleja no se que pueda ser en realidad, un trojano o un falso positivo, tambien quiero recalcar que he hecho escaneo con varias herramientas de seguridad como suelo hacer usualmente y ninguno detecto nada (avg antispyware, spybot search and destroy, a adware 2007, doctor web, super antispyware, a squared,antivirus antivir, nod 32 y spysweeper).

Los antivirus online que utilice son: bit defender, norton, mc afee, trend micro, f-seure, ca antivirus, kaspersk y pest patrol de ca antivirus.



Saludos.

[Claudia34]

File Test.sat received on 04.10.2008 16:12:29 (CET)

Current status: finished

Result: 0/31 (0.00%)

Compact Compact

Print results Print results

Antivirus Version Last Update Result

AhnLab-V3 2008.4.10.2 2008.04.10 -

AntiVir 7.6.0.81 2008.04.10 -

Authentium 4.93.8 2008.04.10 -

Avast 4.8.1169.0 2008.04.10 -

AVG 7.5.0.516 2008.04.10 -

BitDefender 7.2 2008.04.10 -

CAT-QuickHeal 9.50 2008.04.10 -

ClamAV 0.92.1 2008.04.10 -

DrWeb 4.44.0.09170 2008.04.10 -

eTrust-Vet 31.3.5687 2008.04.10 -

Ewido 4.0 2008.04.10 -

F-Prot 4.4.2.54 2008.04.08 -

F-Secure 6.70.13260.0 2008.04.10 -

FileAdvisor 1 2008.04.10 -

Fortinet 3.14.0.0 2008.04.10 -

Ikarus T3.1.1.26 2008.04.10 -

Kaspersky 7.0.0.125 2008.04.10 -

McAfee 5270 2008.04.09 -

Microsoft 1.3408 2008.04.10 -

NOD32v2 3016 2008.04.10 -

Norman 5.80.02 2008.04.10 -

Panda 9.0.0.4 2008.04.10 -

Prevx1 V2 2008.04.10 -

Rising 20.39.32.00 2008.04.10 -

Sophos 4.28.0 2008.04.10 -

Sunbelt 3.0.1032.0 2008.04.08 -

Symantec 10 2008.04.10 -

TheHacker 6.2.92.271 2008.04.10 -

VBA32 3.12.6.4 2008.04.06 -

VirusBuster 4.3.26:9 2008.04.10 -

Webwasher-Gateway 6.6.2 2008.04.10 -

Additional information

File size: 94 bytes

MD5...: 64928662bafce2820359d4938b566569

SHA1..: aa02b62fdb6c91108ffbf06fbec30cf6c88470ff

SHA256: 65edd49d9f454be64e06f5f69cbb01b75c0fa3676890d74f516851eb8575f3f4

SHA512: a624b7489f8967806642e0935583ea9e90e4e3846e38ab83e32cfe51944dc6c1

0d7685fc06977da9e590b74b44c1b1050cef336354a7295839259602f8d737c0

PEiD..: -

PEInfo: -





File Protect.sat received on 04.10.2008 23:47:28 (CET)

Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED

Result: 0/32 (0%)

Loading server information...

Your file is queued in position: 2.

Estimated start time is between 42 and 61 seconds.

Do not close the window until scan is complete.

The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.

If you are waiting for more than five minutes you have to resend your file.

Your file is being scanned by VirusTotal in this moment,

results will be shown as they're generated.

Compact Compact

Print results Print results

Your file has expired or does not exists.

Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.



You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.

Email:



Antivirus Version Last Update Result

AhnLab-V3 2008.4.10.2 2008.04.10 -

AntiVir 7.6.0.81 2008.04.10 -

Authentium 4.93.8 2008.04.10 -

Avast 4.8.1169.0 2008.04.10 -

AVG 7.5.0.516 2008.04.10 -

BitDefender 7.2 2008.04.10 -

CAT-QuickHeal 9.50 2008.04.10 -

ClamAV 0.92.1 2008.04.10 -

DrWeb 4.44.0.09170 2008.04.10 -

eSafe 7.0.15.0 2008.04.09 -

eTrust-Vet 31.3.5687 2008.04.10 -

Ewido 4.0 2008.04.10 -

F-Prot 4.4.2.54 2008.04.10 -

F-Secure 6.70.13260.0 2008.04.10 -

FileAdvisor 1 2008.04.10 -

Fortinet 3.14.0.0 2008.04.10 -

Ikarus T3.1.1.26.0 2008.04.10 -

Kaspersky 7.0.0.125 2008.04.10 -

McAfee 5271 2008.04.10 -

Microsoft 1.3408 2008.04.10 -

NOD32v2 3017 2008.04.10 -

Norman 5.80.02 2008.04.10 -

Panda 9.0.0.4 2008.04.10 -

Prevx1 V2 2008.04.10 -

Rising 20.39.32.00 2008.04.10 -

Sophos 4.28.0 2008.04.10 -

Sunbelt 3.0.1032.0 2008.04.08 -

Symantec 10 2008.04.10 -

TheHacker 6.2.92.272 2008.04.10 -

VBA32 3.12.6.4 2008.04.06 -

VirusBuster 4.3.26:9 2008.04.10 -

Webwasher-Gateway 6.6.2 2008.04.10 -

Additional information

File size: 94 bytes

MD5...: 64928662bafce2820359d4938b566569

SHA1..: aa02b62fdb6c91108ffbf06fbec30cf6c88470ff

SHA256: 65edd49d9f454be64e06f5f69cbb01b75c0fa3676890d74f516851eb8575f3f4

SHA512: a624b7489f8967806642e0935583ea9e90e4e3846e38ab83e32cfe51944dc6c1

0d7685fc06977da9e590b74b44c1b1050cef336354a7295839259602f8d737c0

PEiD..: -

PEInfo: -

[msc hotline sat]

Buenoooooo !



Lo que estás mirando no es un fichero AUTORUN.INF, sino la carpeta del mismo nombre, que el ELIPEN crea con los ficheros TEST.SAT y PROTECT.SAT (SAT de SATINFO) , para evitar que los virus que se propagan por pendrive, puedan crear un fichero AUTORUN.INF en dichos pendrives o unidades de disco que de procesen con dicha proteccion.



No sé lo que indujo a PestPatrol a considerar ello como virus... pero en cualquier caso es un FALSO POSITIVO, olvidate de ello, claro !



Dichos ficheros contienen un texto en ASCII que reza:


[quote]TEST DE SEGURIDAD PARA PROTECCION ANTIPROPAGACION DE VIRUS EN ESTE PENDRIVE



SATINFO 2007.[/quote]

(a título de información de lo que son... no sé donde ven el virus :roll: )



De todas formas ha ido bien que nos lo dijeras, para saberlo, ya que nadie nos lo habia dicho antes... Buscando cinco pies al gato, a veces se encuentra :lol: :lol: :lol:



saludos



ms, 11-04-2008

[Claudia34]

Pues si estas situaciones en las que una herramienta de seguridad encuentra algun falso positivo en otra herramienta de seguridad es pues algo cotidiano, espero que haya servido de experiencia para algun otro usuario que se llegue a encontrar en estas circunstancias especificas. Desde ya agradesco la colaboracion brindada, y de mi parte se puede cerrar el tema.



Saludos.

[msc hotline sat]

De acuerdo, pues nos sirve de conocimiento por si alguien mas lo dice.



Y dando por solucionado el Tema, procedemos a cerrarlo



saludos



ms, 11-04-2008