NTdelay09 leftovers

O4 - HKUS\S-1-5-19\.. \RunOnce: [NTLDelay09] cmd /C del /F "%localappdata%\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\.. \RunOnce: [HttpAcceptLanguageOptOut] REG ADD "HKCU\Control Panel\International\User Profile" /v "HttpAcceptLanguageOptOut" /t REG_DWORD /f /d 1 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\.. \RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\.. \RunOnce: [NTLDelay09] cmd /C del /F "%localappdata%\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\.. \RunOnce: [NTLDelay09] cmd /C del /F "%localappdata%\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\.. \RunOnce: [NTLDelay09] cmd /C del /F "%localappdata%\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk" (User 'Default user')
Click to expand...

Why are you removing links for Service accounts?? They never logon in a desktop, and don't inherit anything copied to Default User's profile.
And why is Local Service account running a mail client?
 
Well, what you see is entries created by NTlite. Nothing was created by myself.

What you see was after a host refresh, no software was installed!!
 
Those commands would fail, no such files to delete & Local Service has no admin rights (it's the same as UNIX "nobody").
If you're trying report a Host Refresh bug, call it out to nuhi specifically. With a preset.
 
You must log in or register to reply here.
Back
Top