See: http://www.virustotal.com/file-scan/report.html?id=f34d62abd55197f5a35159ebd122dcb6c10d2cf2995f848a66f147e61b624e3f-1319988341
So-called high risk page found here: http://siteinspector.comodo.com/public/reports/519786
See: http://urlquery.net/queued.php?id=6571
Ssuspicious see: http://wepawet.iseclab.org/view.php?hash=e8632334bdb93c5846b965541a5759cc&t=1319990299&type=js
See: http://vscan.urlvoid.com/analysis/0d6914b196fc095fe6340e7d487fe6b6/Y29udGFjdHMtZXhl/
Bredolab detection http://amada.abuse.ch/?search=view.oaklandhillsapts.com
In Anubis analysis we find a unnamed file 0x00120028 Performs File Modification and Destruction - WDUF49AN\readme[1].exe typical for Zeus bot infections
MSCTF.Shared.MUTEX.IFG. typical for Zeus Tracker finds
and vhen run, it creates a mutex named “CritOpMutex”
http://anubis.iseclab.org/?action=result&task_id=1ba12c02df70609a49d7dfb65bf72a4ba&format=html
polonus