I was running clamscan and hit a .exe that's a reported trojan.agobot. dug around and found that it came from cori. Apparently they answer electronic cori requests with an email link to an executable file.