02 Lut 2012, 14:08
02 Lut 2012, 16:08
02 Lut 2012, 19:04
:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
IE - HKU\S-1-5-21-2737013861-4053309714-2827421801-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus.msn.com
IE - HKU\S-1-5-21-2737013861-4053309714-2827421801-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
@Alternate Data Stream - 143 bytesC:\ProgramData\Temp:981884E7
@Alternate Data Stream - 133 bytesC:\ProgramData\Temp:5D458568
@Alternate Data Stream - 120 bytesC:\ProgramData\Temp:3E7393FC
:Files
C:\Program Files (x86)\Google\Update
C:\Windows\tasks\*.job
:Commands
[clearallrestorepoints]
[emptytemp]
02 Lut 2012, 21:20
02 Lut 2012, 22:27
:OTL
@Alternate Data Stream - 143 bytesC:\ProgramData\Temp:981884E7
@Alternate Data Stream - 133 bytesC:\ProgramData\Temp:5D458568
@Alternate Data Stream - 120 bytesC:\ProgramData\Temp:3E7393FC
:Files
C:\Windows\tasks\SA.DAT
:Commands
[clearallrestorepoints]
[emptytemp]
02 Lut 2012, 22:46
02 Lut 2012, 22:49
03 Lut 2012, 21:08
03 Lut 2012, 21:13
03 Lut 2012, 21:35
03 Lut 2012, 21:52
03 Lut 2012, 22:24
03 Lut 2012, 22:43
04 Lut 2012, 13:35
04 Lut 2012, 14:38