winampa.exe

W32/Agobot-GS is an IRC backdoor Trojan and network worm.<br />
<br />
W32/Agobot-GS copies itself to network shares protected by weak passwords.<br />
<br />
When first run W32/Agobot-GS copies itself to the Windows system folder as winampa.exe. The worm will create the following registry entries to ensure it is<br />
run at system logon:<br />
<br />
HKLMSoftwareMicrosoftWindowsCurrentVersionRun<br />
Winampa = winampa.exe<br />
<br />
HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices<br />
Winampa = winampa.exe<br />
<br />
On NT-based version of Windows the worm creates a new service named "Winampa" with the startup property set to automatic, so that the service starts automatically each time Windows is started.<br />
<br />
Each time W32/Agobot-GS is run it attempts to connect to a remote IRC server<br />
and join a specific channel. The worm then runs in the background allowing a remote intruder to issue commands which control the computer via IRC channels.<br />
<br />
W32/Agobot-GS will terminate and disable various anti-virus and security related programs.

Just had Spyware search and destroy and Zone alarm pop up warnings that this file is attempting to change my registry and access the internet, it's location is in the root of the C drive.
I was viewing www.wrc.com and www.notam02.no/~hcholm/altlang/ at the time.
I have no Nullsoft products installed so I'm assuming it's unwanted.