[markusg]

hehe, in german forums we have to tell bad news since 8 months :d

[thisisu]

Topic I am working here was infected by same encryption.

Traces of the ransom but file not found:

Code: Select all

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\oenoxsjo.exe) - File not found
O20 - HKU\S-1-5-21-1177238915-789336058-725345543-1003 Winlogon: Shell - (C:\DOCUME~1\Steve\LOCALS~1\Temp\zrzilhrxsjo.exe) - File not found

[markusg]

In germany we se such infection via e-mail, ask him perhaps for an mail from unknown person with attachment.

[thisisu]

In germany we se such infection via e-mail, ask him perhaps for an mail from unknown person with attachment.

I asked. It was from adult website.