UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50
UA: Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
Dziwne że mam dwa logi z OTL`a ?
:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain ... &bmod=TSEH
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://192.168.0.104:8080/index.html
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dlldlowiec\AppData\Roaming\XemiComputers... File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
O4 - HKCU..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun File not found
[2011-10-09 01:44:03 | 000,001,042 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2011-10-09 01:40:00 | 000,001,074 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3550554470-2227251786-3245613526-1000UA.job
[2011-10-09 01:38:48 | 000,001,038 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2011-10-04 10:40:00 | 000,001,022 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3550554470-2227251786-3245613526-1000Core.job
[2011-09-16 17:47:18 | 000,000,296 | ---- | M] () -- C:\windows\tasks\RealUpgradeScheduledTaskS-1-5-21-3550554470-2227251786-3245613526-1004.job
[2011-09-16 17:47:18 | 000,000,288 | ---- | M] () -- C:\windows\tasks\RealUpgradeLogonTaskS-1-5-21-3550554470-2227251786-3245613526-1004.job
:Files
C:\Users\handlowiec\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"00TCrdMain"=-
"AdobeCS5ServiceManager"=-
"SmartFaceVWatcher"=-
"SmoothView"=-
"Teco"=-
"TosSENotify"=-
"TosWaitSrv"=-
"TFPUService"=-
"TOSDCR"=-
"TNRotate"=-
"Toshiba TEMPRO"=-
:Commands
[clearallrestorepoints]
[emptytemp]
UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50
UA: Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
Dodatkowo zauważyłe dziwny proces w Menadzerze zadań.
UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50
UA: Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
Ten proces to csrss.exe (nie bylo info że to system ani zadnego podpisu wiec wydawal mi sie dziwny)
:OTL
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe File not found
O4 - HKU\S-1-5-19..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun File not found
O4 - HKU\S-1-5-20..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun File not found
[2011-10-09 15:20:18 | 000,000,006 | -H-- | M] () -- C:\windows\tasks\SA.DAT
:Files
C:\Users\Andrzej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
C:\Users\Andrzej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"=-
"ToshibaServiceStation"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]
"TOSHIBA Online Product Information"=-
:Commands
[clearallrestorepoints]
[emptytemp]
UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50
UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50
UA: Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
:OTL
[2011-10-09 17:04:09 | 000,000,006 | -H-- | M] () -- C:\windows\tasks\SA.DAT
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HSON"=-
:Commands
[clearallrestorepoints]
UA: Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/20100101 Firefox/8.0
UA: Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
mati8898 napisał(a):To samo co OTC robi funkcja Sprzątanie w OTL.
UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50
UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50
UA: Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50
Zarejestrowani użytkownicy: Bing [Bot]