Read this: http://securityresponse.symantec.com/avcenter/venc/data/trojan.mitglieder.k.html

if i remember correctly it is dropped by a Bagle Variant…