2sms virus

gistfile1.txt

# curl -v http://2sms.ru/mms631 
> GET http://2sms.ru/mms631 HTTP/1.1
> User-Agent: curl/7.22.0 (i686-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: 2sms.ru
> Accept: */*
> Proxy-Connection: Keep-Alive
> 
* HTTP 1.0, assume close after body
< HTTP/1.0 302 Moved Temporarily
< Server: nginx
< Date: Thu, 05 Jul 2012 11:58:02 GMT
< Content-Type: text/html; charset=windows-1251
< X-Powered-By: PHP/5.2.8
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
< Pragma: no-cache
< Set-Cookie: PHPSESSID=4751a5415924151b17148e3cf1a07969; path=/
< Location: http://rusload.com/opera_mini/4154/opera_mini.auto
< Content-Length: 0
* HTTP/1.0 connection set to keep alive!
< Connection: keep-alive
* HTTP/1.0 proxy connection set to keep alive!
< Proxy-Connection: keep-alive
< 
* Closing connection #0