[General Questions and Answers] woprr:
my android trojan desaster recovery continued

Not possible, the setup wizard after factory reset + reboot on this marvel HTC Wildfire S requires google + htc sense account access to have the google and htc apps configured and working correctly (there's a warning in the manual not to disable that),

and this will auto-restore all settings and apps to the desaster state far before you get the chance to disable the auto-restore and sync in settings, surely including the trojan,

You notice that behaviour first if you changed your wlan AP key for desaster recovery and a few minutes after setup wizard run your old wlan key is silently restored despite explicitly disabled sync + auto restore settings:

01.08.11	01:49:00	WLAN-Gerät Anmeldung gescheitert (2,4 GHz): ungültiger WLAN-Schlüssel. Name: htc.
01.08.11	01:48:48	WLAN-Gerät Anmeldung gescheitert (2,4 GHz): ungültiger WLAN-Schlüssel. Name: htc.
01.08.11	01:48:45	WLAN-Gerät angemeldet, WLAN wird mit voller Leistung reaktiviert (2,4 GHz).
01.08.11	01:38:52	Kein WLAN-Gerät mehr angemeldet, Stromverbrauch wird reduziert (2,4 GHz).
01.08.11	01:36:39	WLAN-Gerät Anmeldung gescheitert (2,4 GHz): ungültiger WLAN-Schlüssel. Name: htc.
01.08.11	01:36:28	WLAN-Gerät hat sich abgemeldet (2,4 GHz). Name: htc.
01.08.11	01:27:42	WLAN-Gerät angemeldet (2,4 GHz). Name: htc, Geschwindigkeit 54 Mbit/s.
01.08.11	01:27:42	WLAN-Gerät angemeldet, WLAN wird mit voller Leistung reaktiviert (2,4 GHz).

"ungültiger WLAN-Schlüssel" means invalid EAP-PSK, sorry avm.de is uncapable of english language.

The attackers possibly compromised my AVM fritzbox router, too, they tried to download a malware firmware image to it over the marvel (web management showed warning about failed firmware update yesterday morning) or the newly setup AVM VPN access is insecure , had to factory reset and reinstall the firmware for another desaster recovery,

but I don't know if they managed to have the device memory still compromised using one of the methods known by ip-phone-forum.de to debrand the product, etc.

And well, it's very hard to get a verified clean genuine firmware image file over a possibly compromised and redirecting router from a manufacturer not supporting https certificate auth or crypto signed software on his servers, had to verify sha1sums with another guy over phone before download the image to the box..

Another trojan verification evidence is that the hackers incoming phone/sms account +493394991625 where the sms was sent is no longer reachable or my provider has got wrong data in costs logs.

01.08.11	14:49:55	Internettelefonie mit 03394991625@sip.qsc.de über sip.qsc.de war nicht erfolgreich. Ursache: Not Found (404)
01.08.11	14:49:41	Internettelefonie mit 00493394991625@sip.12voip.com über sip.12voip.com war nicht erfolgreich. Ursache: User not found (404)

Theres neither a way to remove marvel configuration data from your google account or htc sync account, this is absolutely not acceptable,

The only desaster recovery option this marvel accepts is to enable accept of official market apps only, so some apps from appbrain.com were hopefully left out from the auto-restore, is this rechecked?