http://{BLOCKED}sionhunter.ru/sexy/file.php

This URL is included in the configuration file of WORM_ZBOT.GJ. This worm attempts to steal sensitive online banking information, such as user names and passwords. WORM_ZBOT.GJ is notable for its autoupdate and self-propagation routines.