[Jaxryley]

hxxp://arraytor.com/newload.php?ids=MDAC
g2412a.exe - Result: 15/42 (35.71%)
http://www.virustotal.com/analisis/7484 ... 1269005602

These microjoin exploits seem to very hard to cleanup. After executing the one below in an XP VM many other exploits are dropped including not one but two rogues in Antivirus Soft and Antimalware Doctor.

After running a couple of cleanup tools many exploits are found but on reboot the XP VM boots into a bsod then on reset I need to select "Last known config that worked" in order to boot.

A few errors pop up at reboot.

g2412a.exe needs to be left running for a while to get all the downloads and many pron sites may show up as well.

Pass infected
hxxp://rapidshare.com/files/365655806/g2412a.rar
Size: 2018 KB

[EP_X0FF]

Hello,

if somebody interested, in attach you will find teste_p1.exe dropped and executed by this trojan.

[Jaxryley]

Just to update - I ran this exploit again today and it's only downloading one rogue "User Protection" which is new variant of "Paladin Antivirus".

[kmd]

can you attach this fake av also in pass-protected archive?
thank you.

[EP_X0FF]

Hi,

is it the same Paladin AV fake http://forum.sysinternals.com/rootkit-t ... din#116379 I have mentioned on sysinternals?



If so, I doubt request of sample if it is available :)

Thanks.

[Jaxryley]

User Protection installers and Programs Folder below.

Pass infected
hxxp://rapidshare.com/files/365765096/User_Protection.rar
Size: 8228 KB

[Jaxryley]

Paladin Antivirus installer with a virut embedded.

Also installers for Antivirus Soft and Antimalware Doctor that were dropped by the microjoin exploit yesterday.

Pass infected
hxxp://rapidshare.com/files/365769579/Rogues.rar
Size: 1321 KB

[EP_X0FF]

Thank you for links :)