a variant of Win32/ExpressDownloader.J

See: https://www.virustotal.com/nl/url/264df4f33b885e61adb065df213a6802c1abc81669a9c9a9611cfc6a6efdd671/analysis/1411663177/
BitDefender TrafficLight blocks - avast does not!
Web Server Details
Scan for: htxp://dll512.retailfile.biz
Hostname: dll512.retailfile dot biz
IP address: 50.7.29.78

System Details:
Running on: nginx/0.7.67
Powered by: PHP/5.3.3-7+squeeze14
Outdated Web Server Nginx Found: nginx/0.7.67

See: https://www.virustotal.com/nl/ip-address/50.7.29.78/information/ & http://www.herdprotect.com/ip-address-50.7.29.78.aspx
& http://support.clean-mx.de/clean-mx/viruses.php?ip=50.7.29.78&sort=id%20DESC & http://www.urlquery.net/report.php?id=1411570874696

Only known alive version: http://dll512.loadarchive.biz/j5GWfkz3hX5Vmr9eeJ6lMDON4XYj9eBzL/zoaWm9gzp68dRnG%2BHYfVa1nytEvYM8R7jIUxSUiwpQgpQMZZx4A1vRPFEhnGAYLck8WT6cYtwmk2bzb3N06iRwauo4aUXgcG9K%2BkRkTeg5d0LqBGxD2lNWeIEHQQTtMAJRyEdNL5UdTTGKthY5yelQONz%2BZzinsw5ztfMuPfandmT8om4V7vdqDrLbbQvtwGBU6pNhQNPKbUfRhlRMj9AHSI6MC%2BCSiVW3kfYS

polonus