winagent.exe

* Submission details:
o Submission received: 31 August 2009, 18:26:26
o Processing time: 8 min 38 sec
o Submitted sample:
+ File MD5: 0x5EE26F43139A2CDB3A79A835574285A0
+ File SHA-1: 0x43933885866F58D3ABC8147CA79CB8F161957542
+ Filesize: 76,288 bytes
+ Alias:
# Trojan Horse [Symantec]
# Trojan-Downloader.Win32.Agent.chgu [Kaspersky Lab]
# Generic PWS.y [McAfee]
# Mal/Generic-A [Sophos]
# TrojanSpy:Win32/Mbdis.A [Microsoft]
# Trojan-Spy.Win32.Mbdis [Ikarus]
# Win-Trojan/Mbdis.76288 [AhnLab]

* The data identified by the following URLs was then requested from the remote web server:
o http://butirat.com/confirm.php?num=1240972&rev=26&code=1
o localhost
o http://freehotpornru.com/confirm.php?num=1240972&rev=26&code=1
o http://secure123.org/confirm.php?num=1240972&rev=26&code=1
o http://lnnskxvckj.net/confirm.php?num=1240972&rev=26&code=1
o http://butirat.com/confirm.php?num=1240972&rev=26&code=4
o http://freehotpornru.com/confirm.php?num=1240972&rev=26&code=4
o http://secure123.org/confirm.php?num=1240972&rev=26&code=4
o http://lnnskxvckj.net/confirm.php?num=1240972&rev=26&code=4
o http://butirat.com/job.php?num=24&rev=26
o http://freehotpornru.com/job.php?num=24&rev=26
o http://secure123.org/job.php?num=24&rev=26


BELOW IS WERE YOU WILL FIND IN ON YOUR SYSTEM!!!!!!!!!!
Fucking Company adWare!!!!!!!!!!!!!!!!
winagent.exe %System%\winagent.exe