[Win32:Virut]

Sorry, it's Live Security Professional fakeav.

[Xylitol]

Sorry, it's Live Security Professional fakeav.

From your last post ? no it's Reveton confirmed.

I can't attach sample because the uploader is broken for the moment so here are videos
Cool Exploit Kit leading to Reveton: http://www.youtube.com/watch?v=BitCYj2GExE
Unpacking the sample grabbed + lolav: http://www.youtube.com/watch?v=HA6FzT-e4nU

[Win32:Virut]

Sorry, it's Live Security Professional fakeav.

From your last post ? no it's Reveton confirmed.

I can't attach sample because the uploader is broken for the moment so here are videos
Cool Exploit Kit leading to Reveton: http://www.youtube.com/watch?v=BitCYj2GExE
Unpacking the sample grabbed + lolav: http://www.youtube.com/watch?v=HA6FzT-e4nU

I tested it while ago, it's Live Security Professional.

[EP_X0FF]

rundll32.exe path,XFG00

https://www.virustotal.com/en/file/90b6 ... 375267929/

I was just browsing some websites and got infected, maybe some site was infected.

Reveton. In attach decrypted.

https://www.virustotal.com/en/file/4f2e ... 375377166/

[Win32:Virut]

@EP_X0FF and Xylitol

How do you run it?

I use WIN + R, then rundll32.exe path-to-file,XFG00

and Live Security Professional.

[EP_X0FF]

Any log or dump? Because there is no FakeAV observed not in dropper not in infected machine. Only Reveton crap https://www.virustotal.com/en/file/43f2 ... 375409885/

http://anubis.iseclab.org/?action=resul ... ormat=html

[S!Ri]

Hello,

Unpacked is the dropper (X:\PGP\Programming\JimmMonsterNew\ServerWinlock\Source\SysUtils.pas) :twisted:
Just rename to *.cpl and double click

dump is the rogue binary (dll, not executable, not rebuilt)
(many references to "OPG Security")

[EP_X0FF]

(X:\PGP\Programming\JimmMonsterNew\ServerWinlock\Source\SysUtils.pas)

Seen earlier here http://www.kernelmode.info/forum/viewto ... 149#p17149

[thisisu]

https://www.virustotal.com/en/file/014f ... 375475881/

MD5 : df50510b6bac36f7b8901796b618ef8f

PC was infected with Pihar.C, ZeroAccess Recycler, and looks like this is ransomware but it never displayed for me (sorry no pic).

Legit service used for startup:

Code: Select all

S2 Winmgmt; C:\Windows\system32\config\SYSTEM~1\3950568.dll [204800 2013-02-05] (Microsoft Corporation)

[Horgh]

Trojan:Win32/Reveton.N