Verschlüsselungstrojaner - Malware Report

All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-2276219615-1642406993-4288748585-1004\Software\Microsoft\Internet Explorer\SearchScopes\{c99fdc39-a1ae-4b24-8d71-e5274f8d7c54}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c99fdc39-a1ae-4b24-8d71-e5274f8d7c54}\ not found.
Prefs.js: "Search the web" removed from browser.search.defaultenginename
Prefs.js: "Search the web" removed from browser.search.order.1
Prefs.js: false removed from browser.search.update
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" removed from keyword.URL
C:\Dokumente und Einstellungen\Systemadministrator\Anwendungsdaten\Mozilla\FireFox\Profiles\5auaia5o.default\user.js moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@checkpoint.com/FFApi\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2276219615-1642406993-4288748585-1004\Software\Microsoft\Windows\CurrentVersion\Run\\POEngine5 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2276219615-1642406993-4288748585-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2276219615-1642406993-4288748585-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF}\ not found.
C:\Programme\PokerStars\PokerStarsUpdate.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
C:\PCW9901\BOOTSEC folder moved successfully.
C:\PCW9901 folder moved successfully.
C:\Dokumente und Einstellungen\Systemadministrator\Anwendungsdaten\CheckPoint\ZoneAlarm LTD Toolbar\TrustChecker folder moved successfully.
C:\Dokumente und Einstellungen\Systemadministrator\Anwendungsdaten\CheckPoint\ZoneAlarm LTD Toolbar\PTPCACHE folder moved successfully.
C:\Dokumente und Einstellungen\Systemadministrator\Anwendungsdaten\CheckPoint\ZoneAlarm LTD Toolbar folder moved successfully.
C:\Dokumente und Einstellungen\Systemadministrator\Anwendungsdaten\CheckPoint folder moved successfully.
C:\Programme\CheckPoint\ZoneAlarm\Help folder moved successfully.
C:\Programme\CheckPoint\ZoneAlarm folder moved successfully.
C:\Programme\CheckPoint folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint\ZoneAlarm\Data folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint\ZoneAlarm folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint folder moved successfully.
C:\WINDOWS\System32\UAs folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temporary Internet Files folder emptied: 205592 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService
->Temp folder emptied: 2194136 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: NetworkService
->Temp folder emptied: 2130376 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: postgres
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: postgres.SYSTEM
->Temp folder emptied: 1203592 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Systemadministrator
->Temp folder emptied: 25216491 bytes
->Temporary Internet Files folder emptied: 21404410 bytes
->Java cache emptied: 225107 bytes
->FireFox cache emptied: 678757499 bytes
->Flash cache emptied: 12695 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 3215 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2664723 bytes
RecycleBin emptied: 482985 bytes
 
Total Files Cleaned = 703,00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
 
User: All Users
 
User: Default User
 
User: LocalService
 
User: NetworkService
 
User: postgres
 
User: postgres.SYSTEM
 
User: Systemadministrator
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.46.1 log created on 06052012_143952

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...