TROJ_RANSOM.YMIH
Windows 2000, Windows XP, Windows Server 2003
Tipo de grayware:
Trojan
Destrutivo:
Não
Criptografado:
In the Wild:
Sim
Visão geral
Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.
Löscht sich nach der Ausführung selbst.
Detalhes técnicos
Installation
Erstellt die folgenden Ordner:
- %User Profile%\CryptnetUrlCache\MetaData
- %User Profile%\Microsoft\CryptnetUrlCache
- %User Profile%\CryptnetUrlCache\Content
(Hinweis: %User Profile% ist der Ordner für Benutzerprofile des aktuellen Benutzers, normalerweise C:\Windows\Profile\{Benutzername} unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername} unter Windows NT und C:\Dokumente und Einstellungen\{Benutzername} unter Windows 2000, XP und Server 2003.)
Autostart-Technik
Fügt folgende Registrierungseinträge hinzu, um bei jedem Systemstart automatisch ausgeführt zu werden.
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
bbbfea = "%System Root%\bbbfeac\bbbfeac.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
bbbfeac = "%User Profile%\Application Data\bbbfeac.exe"
Andere Systemänderungen
Ändert die folgenden Dateien:
- %User Profile%\Application Data\Microsoft
- %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD
- %User Profile%\Templates\excel.xls
- %User Profile%\Templates\excel4.xls
- %User Profile%\Templates\powerpnt.ppt
- %User Profile%\Templates\quattro.wb2
- %User Profile%\Templates\winword.doc
- %User Profile%\Templates\winword2.doc
- %User Profile%\Templates\wordpfct.wpd
(Hinweis: %User Profile% ist der Ordner für Benutzerprofile des aktuellen Benutzers, normalerweise C:\Windows\Profile\{Benutzername} unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername} unter Windows NT und C:\Dokumente und Einstellungen\{Benutzername} unter Windows 2000, XP und Server 2003.. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT und C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000, XP und Server 2003.)
Löscht die folgenden Dateien:
- %System Root%\bbbfeac
(Hinweis: %System Root% ist der Stammordner, normalerweise C:\. Dort befindet sich auch das Betriebssystem.)
Fügt die folgenden Registrierungsschlüssel hinzu:
HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345
HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345\
DISKS
HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
Fügt die folgenden Registrierungseinträge hinzu:
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
text = "{random values}"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
html = "{random values}"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
weblink = "{random values}"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
pub = "{random values}"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
start = "1"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DF87C3DE = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4664571E = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
866419F6 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
1207A18F = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A9D246E4 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
6E10B272 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
B6B67ED9 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
180F43DB = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
716A4C5A = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7675AEDA = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C0E2793C = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C4B6F6F6 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
2F213C6C = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
2BF0D7B6 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
8E9E31AA = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DEEE5852 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C2696AAC = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
303CBF3D = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C03E4E3B = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
205181D1 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
821B00E6 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CBB30CFC = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E95DEA19 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
BC82B119 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
88AAB850 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CE5340B9 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E1964A59 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AC86A324 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
ECE59176 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
38E0E841 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
6E4AF06 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
67B018CB = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
1FB0E720 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
21690AB6 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
B6E7C0D9 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
9344454A = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E6B01D60 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3014CA4C = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
9478294F = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F948B772 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F742ACE = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
5BED2262 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E7953DBF = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D62E300F = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AA2817CD = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7119E9E3 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Internet Explorer\brndlog.txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
FDD4E4A4 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
48E704D7 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A77F3530 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E0629E55 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E4EFE2E7 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A36C0861 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
828EA9F0 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3A050C0C = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AC9807D5 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
80C57583 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
36F19BFB = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CEFDA0BD = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E2EDBB9 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
5A9064DD = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
6F9F90B5 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
37A2BE97 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7CA9FC1 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F0999EDB = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
B4656924 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D274A7D3 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
1B2FE48 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
38BD2FA7 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E76A2115 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
48FBD5D8 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4A4787A0 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CD98C648 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
9DCF1BF1 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7D6C68D = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
627A96C3 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
30DDA2CF = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
41137D2D = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\excel.xls = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\excel4.xls = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\powerpnt.ppt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\quattro.wb2 = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\winword.doc = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\winword2.doc = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Templates\wordpfct.wpd = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
45BCBDC6 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4C853E72 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D1674F40 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
8AC53A20 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
86DDB95E = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E2E68DA4 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
595DFA08 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D9E48997 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DD69F525 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
38C650BC = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DF9DBBAF = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C783AA01 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7D0E88B = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C354FB50 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4EBF9B61 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
18E71623 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A7D40527 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D3F0E56B = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
37AA0E77 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A3E892FE = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
92232D0 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E0B9FBF7 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DBC22CFD = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
817BB52E = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7E992925 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
5551E2C = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
287BAF84 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CD17AA70 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C99AD6C2 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
5E983FFE = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
18B2578B = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3A1C3E4D = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
5868ADDB = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
80ABAF5A = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F8319958 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C1435C4 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3D883229 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
2B8C46ED = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
E8BBB80 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
805342C8 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
79881720 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
15AF95C2 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
65B4BB0D = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
99C264C7 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7BB39A2C = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
7832A2B0 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
9C17C390 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4DEC104 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
60710059 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
BF2B6B01 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D73C4A6C = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
121BE978 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
223C63A3 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
31EB1464 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
10183795 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
11866F0C = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CAC2049B = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CE4F7829 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
8E6F0ED0 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
171B0BDC = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C0BDDF95 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
114A3E1 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@atdmt[2].txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@bing[2].txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@c.atdmt[2].txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@c.msn[2].txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@doubleclick[1].txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@microsoft[1].txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@msn[2].txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@scorecardresearch[2].txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@www.bing[2].txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%User Profile%\Cookies\wilbert@www.msn[1].txt = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AB5D0C5B = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
1D69E223 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F4CA74D = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AEC50DAA = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
4171B676 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3B924B39 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
BC19B2F = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
55595B4D = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
72D89494 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
PROTECTED
%Application Data%\Microsoft\Wallpaper1.bmp = "68adfd"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
9275FE9B = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
2A3C3A8F = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C086DA88 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CA236A48 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
A8200A50 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
AE60F13D = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
D806D279 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
F030F216 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
DA9ECC20 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
981331D8 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
2B7031E7 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
1325567F = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
87528C02 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
64D89F62 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
6664CD1A = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
580D6464 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
85AB9DD = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
CA3F3304 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
FFDC253B = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
EB5305F0 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
3DDA59C8 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
C2A0C047 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
258410D1 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
64051A82 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
17FB8455 = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
8BB1D29A = "0"
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
finish = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
B1BC968BD4F49D622AA89A81F2150152A41D829C
Blob = "{random values}"
Ändert die folgenden Registrierungseinträge:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
2F173F7DE99667AFA57AF80AA2D1B12FAC830338
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4C95A9902ABE0777CED18D6ACCC3372D2748381E
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4BA7B9DDD68788E12FF852E1A024204BF286A8F6
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
47AFB915CDA26D82467B97FA42914468726138DD
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4463C531D7CCC1006794612BB656D3BF8257846F
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
43F9B110D5BAFD48225231B0D0082B372FEF9A54
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
43DDB1FFF3B49B73831407F6BC8B975023D07C50
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
4072BA31FEC351438480F62E6CB95508461EAB2F
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
394FF6850B06BE52E51856CC10E180E882B385CC
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
36863563FD5128C7BEA6F005CFE9B43668086CCE
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\CA\Certificates\
E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
284F55C41A1A7A3F8328D4C262FB376ED6096F24
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
273EE12457FDC4F90C55E82B56167F62F532E547
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
23E594945195F2414803B4D564D2A3A3F5D88B8C
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
216B2A29E62A00CE820146D8244141B92511B279
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
209900B63D955728140CD13622D8C687A4EB0085
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
1F55E8839BAC30728BE7108EDE7B0BB0D3298224
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
049811056AFE9FD0F5BE01685AACE6A5D1C4454C
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0483ED3399AC3608058722EDBC5E4600E3BEF9D7
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\AuthRoot\Certificates\
0048F8D37B153F6EA2798C323EF4F318A5624A9E
Blob = "{random values}"
(Note: The default value data of the said registry entry is {random values}.)
Löscht die folgenden Registrierungsschlüssel:
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS
HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\
DISKS\68AD0FD0
Einschleusungsroutine
Schleust die folgenden Dateien ein:
- %System Root%\bbbfeac\bbbfeac.exe
- %User Profile%\Application Data\bbbfeac.exe
- %User Startup%\bbbfeac.exe
- %User Profile%\Microsoft\Crypto
- %User Profile%\Crypto\RSA
- %User Profile%\RSA\S-1-5-21-1645522239-1292428093-682003330-1003
- %User Profile%\Internet Explorer\brndlog.txt.cry
- %User Profile%\Internet Explorer\brndlog.txt
- %User Profile%\Internet Explorer\HOW_DECRYPT.TXT
- %User Profile%\Internet Explorer\HOW_DECRYPT.HTML
- %User Profile%\Internet Explorer\HOW_DECRYPT.URL
- %User Profile%\Microsoft\HOW_DECRYPT.TXT
- %User Profile%\Microsoft\HOW_DECRYPT.HTML
- %User Profile%\Microsoft\HOW_DECRYPT.URL
- %User Profile%\Application Data\HOW_DECRYPT.TXT
- %User Profile%\Application Data\HOW_DECRYPT.HTML
- %User Profile%\Application Data\HOW_DECRYPT.URL
- %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD.cry
- %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.TXT
- %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.HTML
- %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.URL
- %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.TXT
- %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.HTML
- %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.URL
- %Application Data%\Microsoft\HOW_DECRYPT.TXT
- %Application Data%\Microsoft\HOW_DECRYPT.HTML
- %Application Data%\Microsoft\HOW_DECRYPT.URL
- %Application Data%\HOW_DECRYPT.TXT
- %Application Data%\HOW_DECRYPT.HTML
- %Application Data%\HOW_DECRYPT.URL
- %User Profile%\Local Settings\HOW_DECRYPT.TXT
- %User Profile%\Local Settings\HOW_DECRYPT.HTML
- %User Profile%\Local Settings\HOW_DECRYPT.URL
- %User Profile%\Templates\excel.xls.cry
- %User Profile%\Templates\excel4.xls.cry
- %User Profile%\Templates\powerpnt.ppt.cry
- %User Profile%\Templates\quattro.wb2.cry
- %User Profile%\Templates\winword.doc.cry
- %User Profile%\Templates\winword2.doc.cry
- %User Profile%\Templates\wordpfct.wpd.cry
- %User Profile%\Templates\HOW_DECRYPT.TXT
- %User Profile%\Templates\HOW_DECRYPT.HTML
- %User Profile%\Templates\HOW_DECRYPT.URL
- %User Profile%\HOW_DECRYPT.TXT
- %User Profile%\HOW_DECRYPT.HTML
- %User Profile%\HOW_DECRYPT.URL
- %User Profile%\Cookies\wilbert@atdmt[2].txt.cry
- %User Profile%\Cookies\wilbert@atdmt[2].txt
- %User Profile%\Cookies\wilbert@bing[2].txt.cry
- %User Profile%\Cookies\wilbert@bing[2].txt
- %User Profile%\Cookies\wilbert@c.atdmt[2].txt.cry
- %User Profile%\Cookies\wilbert@c.atdmt[2].txt
- %User Profile%\Cookies\wilbert@c.msn[2].txt.cry
- %User Profile%\Cookies\wilbert@c.msn[2].txt
- %User Profile%\Cookies\wilbert@doubleclick[1].txt.cry
- %User Profile%\Cookies\wilbert@doubleclick[1].txt
- %User Profile%\Cookies\wilbert@microsoft[1].txt.cry
- %User Profile%\Cookies\wilbert@microsoft[1].txt
- %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt.cry
- %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt
- %User Profile%\Cookies\wilbert@msn[2].txt.cry
- %User Profile%\Cookies\wilbert@msn[2].txt
- %User Profile%\Cookies\wilbert@scorecardresearch[2].txt.cry
- %User Profile%\Cookies\wilbert@scorecardresearch[2].txt
- %User Profile%\Cookies\wilbert@www.bing[2].txt.cry
- %User Profile%\Cookies\wilbert@www.bing[2].txt
- %User Profile%\Cookies\wilbert@www.msn[1].txt.cry
- %User Profile%\Cookies\wilbert@www.msn[1].txt
- %User Profile%\Cookies\HOW_DECRYPT.TXT
- %User Profile%\Cookies\HOW_DECRYPT.HTML
- %User Profile%\Cookies\HOW_DECRYPT.URL
- %Application Data%\Microsoft\Wallpaper1.bmp.cry
- %Application Data%\Microsoft\Wallpaper1.bmp
- %System Root%\Documents and Settings\HOW_DECRYPT.TXT
- %System Root%\Documents and Settings\HOW_DECRYPT.HTML
- %System Root%\Documents and Settings\HOW_DECRYPT.URL
- %Desktop%\HOW_DECRYPT.TXT
- %Desktop%\HOW_DECRYPT.HTML
- %Desktop%\HOW_DECRYPT.URL
- %User Startup%\HOW_DECRYPT.TXT
- %User Startup%\HOW_DECRYPT.HTML
- %User Startup%\HOW_DECRYPT.URL
- %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
- %User Profile%\Content\2BF68F4714092295550497DD56F57004
- %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
- %User Profile%\Content\94308059B57B3142E455B38A6EB92015
- %User Temp%\Cab9C.tmp
- %User Temp%\Tar9E.tmp
Andere Details
Löscht sich nach der Ausführung selbst.
Solução
Step 1
Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.
Step 2
Im abgesicherten Modus neu starten
Step 3
Diesen Registrierungsschlüssel löschen
Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.
- In HKEY_CURRENT_USER\software
- BBBFEACF8539FC947B9028B6EE760345
- In HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345
- DISKS
- In HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345
- PROTECTED
- In HKEY_CURRENT_USER\software\BBBFEACF8539FC947B9028B6EE760345\DISKS
- 68AD0FD0
Step 4
Diesen Registrierungswert löschen
Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- bbbfea = "%System Root%\bbbfeac\bbbfeac.exe"
- In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- bbbfeac = "%User Profile%\Application Data\bbbfeac.exe"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
- text = "{random values}"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
- html = "{random values}"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
- weblink = "{random values}"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
- pub = "{random values}"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
- start = "1"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- DF87C3DE = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 4664571E = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 866419F6 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 1207A18F = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- A9D246E4 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 6E10B272 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- B6B67ED9 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 180F43DB = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 716A4C5A = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 7675AEDA = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- C0E2793C = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- C4B6F6F6 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 2F213C6C = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 2BF0D7B6 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 8E9E31AA = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- DEEE5852 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- C2696AAC = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 303CBF3D = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- C03E4E3B = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 205181D1 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 821B00E6 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- CBB30CFC = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- E95DEA19 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- BC82B119 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 88AAB850 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- CE5340B9 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- E1964A59 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- AC86A324 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- ECE59176 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 38E0E841 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 6E4AF06 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 67B018CB = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 1FB0E720 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 21690AB6 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- B6E7C0D9 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 9344454A = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- E6B01D60 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 3014CA4C = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 9478294F = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- F948B772 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- F742ACE = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 5BED2262 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- E7953DBF = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- D62E300F = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- AA2817CD = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 7119E9E3 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Internet Explorer\brndlog.txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- FDD4E4A4 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 48E704D7 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- A77F3530 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- E0629E55 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- E4EFE2E7 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- A36C0861 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 828EA9F0 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 3A050C0C = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- AC9807D5 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 80C57583 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 36F19BFB = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- CEFDA0BD = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- E2EDBB9 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 5A9064DD = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 6F9F90B5 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 37A2BE97 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 7CA9FC1 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- F0999EDB = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- B4656924 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- D274A7D3 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 1B2FE48 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 38BD2FA7 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- E76A2115 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 48FBD5D8 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 4A4787A0 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- CD98C648 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 9DCF1BF1 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 7D6C68D = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 627A96C3 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 30DDA2CF = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 41137D2D = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Templates\excel.xls = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Templates\excel4.xls = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Templates\powerpnt.ppt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Templates\quattro.wb2 = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Templates\winword.doc = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Templates\winword2.doc = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Templates\wordpfct.wpd = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 45BCBDC6 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 4C853E72 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- D1674F40 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 8AC53A20 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 86DDB95E = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- E2E68DA4 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 595DFA08 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- D9E48997 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- DD69F525 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 38C650BC = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- DF9DBBAF = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- C783AA01 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 7D0E88B = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- C354FB50 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 4EBF9B61 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 18E71623 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- A7D40527 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- D3F0E56B = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 37AA0E77 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- A3E892FE = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 92232D0 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- E0B9FBF7 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- DBC22CFD = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 817BB52E = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 7E992925 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 5551E2C = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 287BAF84 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- CD17AA70 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- C99AD6C2 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 5E983FFE = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 18B2578B = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 3A1C3E4D = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 5868ADDB = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 80ABAF5A = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- F8319958 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- C1435C4 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 3D883229 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 2B8C46ED = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- E8BBB80 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 805342C8 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 79881720 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 15AF95C2 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 65B4BB0D = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 99C264C7 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 7BB39A2C = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 7832A2B0 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 9C17C390 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 4DEC104 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 60710059 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- BF2B6B01 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- D73C4A6C = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 121BE978 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 223C63A3 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 31EB1464 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 10183795 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 11866F0C = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- CAC2049B = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- CE4F7829 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 8E6F0ED0 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 171B0BDC = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- C0BDDF95 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 114A3E1 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Cookies\wilbert@atdmt[2].txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Cookies\wilbert@bing[2].txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Cookies\wilbert@c.atdmt[2].txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Cookies\wilbert@c.msn[2].txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Cookies\wilbert@doubleclick[1].txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Cookies\wilbert@microsoft[1].txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Cookies\wilbert@msn[2].txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Cookies\wilbert@scorecardresearch[2].txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Cookies\wilbert@www.bing[2].txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %User Profile%\Cookies\wilbert@www.msn[1].txt = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- AB5D0C5B = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 1D69E223 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- F4CA74D = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- AEC50DAA = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 4171B676 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 3B924B39 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- BC19B2F = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 55595B4D = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 72D89494 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\PROTECTED
- %Application Data%\Microsoft\Wallpaper1.bmp = "68adfd"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 9275FE9B = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 2A3C3A8F = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- C086DA88 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- CA236A48 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- A8200A50 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- AE60F13D = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- D806D279 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- F030F216 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- DA9ECC20 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 981331D8 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 2B7031E7 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 1325567F = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 87528C02 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 64D89F62 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 6664CD1A = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 580D6464 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 85AB9DD = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- CA3F3304 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- FFDC253B = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- EB5305F0 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 3DDA59C8 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- C2A0C047 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 258410D1 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 64051A82 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 17FB8455 = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345\DISKS\68AD0FD0
- 8BB1D29A = "0"
- In HKEY_CURRENT_USER\Software\BBBFEACF8539FC947B9028B6EE760345
- finish = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C
- Blob = "{random values}"
Step 5
Diesen geänderten Registrierungswert wiederherstellen
Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
- DisableSR = "1"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2F173F7DE99667AFA57AF80AA2D1B12FAC830338
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4C95A9902ABE0777CED18D6ACCC3372D2748381E
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4BA7B9DDD68788E12FF852E1A024204BF286A8F6
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47AFB915CDA26D82467B97FA42914468726138DD
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4463C531D7CCC1006794612BB656D3BF8257846F
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43DDB1FFF3B49B73831407F6BC8B975023D07C50
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4072BA31FEC351438480F62E6CB95508461EAB2F
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\394FF6850B06BE52E51856CC10E180E882B385CC
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\36863563FD5128C7BEA6F005CFE9B43668086CCE
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\284F55C41A1A7A3F8328D4C262FB376ED6096F24
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\23E594945195F2414803B4D564D2A3A3F5D88B8C
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\216B2A29E62A00CE820146D8244141B92511B279
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\209900B63D955728140CD13622D8C687A4EB0085
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F55E8839BAC30728BE7108EDE7B0BB0D3298224
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\049811056AFE9FD0F5BE01685AACE6A5D1C4454C
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E
- From: Blob = "{random values}"
To: Blob = ""{random values}""
- From: Blob = "{random values}"
Step 6
Diese Dateien suchen und löschen
- %System Root%\bbbfeac\bbbfeac.exe
- %User Profile%\Application Data\bbbfeac.exe
- %User Startup%\bbbfeac.exe
- %User Profile%\Microsoft\Crypto
- %User Profile%\Crypto\RSA
- %User Profile%\RSA\S-1-5-21-1645522239-1292428093-682003330-1003
- %User Profile%\Internet Explorer\brndlog.txt.cry
- %User Profile%\Internet Explorer\brndlog.txt
- %User Profile%\Internet Explorer\HOW_DECRYPT.TXT
- %User Profile%\Internet Explorer\HOW_DECRYPT.HTML
- %User Profile%\Internet Explorer\HOW_DECRYPT.URL
- %User Profile%\Microsoft\HOW_DECRYPT.TXT
- %User Profile%\Microsoft\HOW_DECRYPT.HTML
- %User Profile%\Microsoft\HOW_DECRYPT.URL
- %User Profile%\Application Data\HOW_DECRYPT.TXT
- %User Profile%\Application Data\HOW_DECRYPT.HTML
- %User Profile%\Application Data\HOW_DECRYPT.URL
- %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD.cry
- %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.TXT
- %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.HTML
- %Application Data%\Microsoft\Windows Media\9.0\HOW_DECRYPT.URL
- %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.TXT
- %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.HTML
- %Application Data%\Microsoft\Windows Media\HOW_DECRYPT.URL
- %Application Data%\Microsoft\HOW_DECRYPT.TXT
- %Application Data%\Microsoft\HOW_DECRYPT.HTML
- %Application Data%\Microsoft\HOW_DECRYPT.URL
- %Application Data%\HOW_DECRYPT.TXT
- %Application Data%\HOW_DECRYPT.HTML
- %Application Data%\HOW_DECRYPT.URL
- %User Profile%\Local Settings\HOW_DECRYPT.TXT
- %User Profile%\Local Settings\HOW_DECRYPT.HTML
- %User Profile%\Local Settings\HOW_DECRYPT.URL
- %User Profile%\Templates\excel.xls.cry
- %User Profile%\Templates\excel4.xls.cry
- %User Profile%\Templates\powerpnt.ppt.cry
- %User Profile%\Templates\quattro.wb2.cry
- %User Profile%\Templates\winword.doc.cry
- %User Profile%\Templates\winword2.doc.cry
- %User Profile%\Templates\wordpfct.wpd.cry
- %User Profile%\Templates\HOW_DECRYPT.TXT
- %User Profile%\Templates\HOW_DECRYPT.HTML
- %User Profile%\Templates\HOW_DECRYPT.URL
- %User Profile%\HOW_DECRYPT.TXT
- %User Profile%\HOW_DECRYPT.HTML
- %User Profile%\HOW_DECRYPT.URL
- %User Profile%\Cookies\wilbert@atdmt[2].txt.cry
- %User Profile%\Cookies\wilbert@atdmt[2].txt
- %User Profile%\Cookies\wilbert@bing[2].txt.cry
- %User Profile%\Cookies\wilbert@bing[2].txt
- %User Profile%\Cookies\wilbert@c.atdmt[2].txt.cry
- %User Profile%\Cookies\wilbert@c.atdmt[2].txt
- %User Profile%\Cookies\wilbert@c.msn[2].txt.cry
- %User Profile%\Cookies\wilbert@c.msn[2].txt
- %User Profile%\Cookies\wilbert@doubleclick[1].txt.cry
- %User Profile%\Cookies\wilbert@doubleclick[1].txt
- %User Profile%\Cookies\wilbert@microsoft[1].txt.cry
- %User Profile%\Cookies\wilbert@microsoft[1].txt
- %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt.cry
- %User Profile%\Cookies\wilbert@msnportal.112.2o7[1].txt
- %User Profile%\Cookies\wilbert@msn[2].txt.cry
- %User Profile%\Cookies\wilbert@msn[2].txt
- %User Profile%\Cookies\wilbert@scorecardresearch[2].txt.cry
- %User Profile%\Cookies\wilbert@scorecardresearch[2].txt
- %User Profile%\Cookies\wilbert@www.bing[2].txt.cry
- %User Profile%\Cookies\wilbert@www.bing[2].txt
- %User Profile%\Cookies\wilbert@www.msn[1].txt.cry
- %User Profile%\Cookies\wilbert@www.msn[1].txt
- %User Profile%\Cookies\HOW_DECRYPT.TXT
- %User Profile%\Cookies\HOW_DECRYPT.HTML
- %User Profile%\Cookies\HOW_DECRYPT.URL
- %Application Data%\Microsoft\Wallpaper1.bmp.cry
- %Application Data%\Microsoft\Wallpaper1.bmp
- %System Root%\Documents and Settings\HOW_DECRYPT.TXT
- %System Root%\Documents and Settings\HOW_DECRYPT.HTML
- %System Root%\Documents and Settings\HOW_DECRYPT.URL
- %Desktop%\HOW_DECRYPT.TXT
- %Desktop%\HOW_DECRYPT.HTML
- %Desktop%\HOW_DECRYPT.URL
- %User Startup%\HOW_DECRYPT.TXT
- %User Startup%\HOW_DECRYPT.HTML
- %User Startup%\HOW_DECRYPT.URL
- %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
- %User Profile%\Content\2BF68F4714092295550497DD56F57004
- %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
- %User Profile%\Content\94308059B57B3142E455B38A6EB92015
- %User Temp%\Cab9C.tmp
- %User Temp%\Tar9E.tmp
Step 7
Diese Ordner suchen und löschen
- %User Profile%\CryptnetUrlCache\MetaData
- %User Profile%\Microsoft\CryptnetUrlCache
- %User Profile%\CryptnetUrlCache\Content
Step 8
Führen Sie den Neustart im normalen Modus durch, und durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt nach Dateien, die als TROJ_RANSOM.YMIH entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.
Step 9
Diese Datei über eine Sicherungskopie wiederherstellen Nur Microsoft basierte Dateien werden wiederhergestellt. Falls diese Malware/Grayware/Spyware auch Dateien aus Programmen gelöscht hat, die nicht von Microsoft stammen, installieren Sie diese Programme auf Ihrem Computer bitte neu.
- %User Profile%\Application Data\Microsoft
- %Application Data%\Microsoft\Windows Media\9.0\WMSDKNS.DTD
- %User Profile%\Templates\excel.xls
- %User Profile%\Templates\excel4.xls
- %User Profile%\Templates\powerpnt.ppt
- %User Profile%\Templates\quattro.wb2
- %User Profile%\Templates\winword.doc
- %User Profile%\Templates\winword2.doc
- %User Profile%\Templates\wordpfct.wpd
Participe da nossa pesquisa!