Hi Miha,
It makes you wonder indeed, if you fail the one dropper before it starts up for instance through winlogon, the file name is changed in a random arrangement or being reversed or even with a space in between the legit name and the executable, who would notice afterwards. It is like with demons, invite one in and all his friends are coming to stay as well. So there is not really much hope after you have been compromised and the trojan played havoc and contacted outside to do whatever it is programmed to do. So one gram of preventions weighs more than one kilo of cleansing afterwards. Anyway panick has never done anyone any good, and there our friend FwF has a solid point. Better prevent script to run or have it checked, update and patch or better even still - surf between the plag-poles and watch the shark-siren, my dear friend,
Damian
