Here is the log from my mbam scan: Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 7016 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 7/4/2011 3:18:26 AM mbam-log-2011-07-04 (03-18-26).txt Scan type: Quick scan Objects scanned: 167000 Time elapsed: 3 minute(s), 0 second(s) Memory Processes Infected: 3 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 3 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 4 Memory Processes Infected: c:\Users\Nhat\AppData\Local\Temp\0.8828415472678759.exe (Spyware.Passwords.XGen) -> 6904 -> Unloaded process successfully. c:\Users\Nhat\AppData\Roaming\dwm.exe (Trojan.Backdoor.Gen) -> 7592 -> Unloaded process successfully. c:\Users\Nhat\AppData\Local\Temp\csrss.exe (Trojan.Backdoor.Gen) -> 7372 -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Spyware.Passwords.XGen) -> Value: conhost -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Value: Load -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell.Gen) -> Value: Shell -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Backdoor.Gen) -> Bad: (C:\Users\Nhat\AppData\Local\Temp\csrss.exe) Good: () -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: c:\Users\Nhat\AppData\Local\Temp\0.8828415472678759.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully. c:\Users\Nhat\AppData\Roaming\dwm.exe (Trojan.Backdoor.Gen) -> Quarantined and deleted successfully. c:\Users\Nhat\AppData\Local\Temp\csrss.exe (Trojan.Backdoor.Gen) -> Quarantined and deleted successfully. c:\Users\Nhat\AppData\Roaming\microsoft\conhost.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
