New Trojan????

[Dave Woods <dave () TECHWEAVERS NET>]

One of our computers here recently became infected with something I have
never seen before.

When the computer starts up (winME) it opens up 2 copies of the
FreeExtractor prog that exctracts the following files:
mirc.ini
mirc2.ini
mirc3.ini
pri.ini
20139.txt
gates.txt
temp.exe
temp2.exe
whvlxd.dat
temp.scr

gates.txt contains a lot of ip's / domains in it that look to be possibly
infected hosts that this "program" is creating as some of them are isp
accounts ie port200.hs.ip.com
temp.scr does not run (says not a valid win32 app)

I have attached the files in a zip with a password of pass101

If anyone has seen or knows what this is or how to remove it let me know.

Sincerely,
David Woods
Techweavers Inc.
dave () techweavers net
www.techweavers.net
Phone: (780)-423-3952
Fax: (780)-432-3220

Attachment: unkown.zip
Description: