jessica

HKU\S-1-5-21-3849012455-3380392251-1068259123-1000\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist "C:\Users\Deadman\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" ( start /MIN "" "C:\Users\Deadman\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
RemoveDirectory: C:\Users\Deadman\AppData\Roaming\Microsoft\SoundMixer
Task: {75376322-9251-49FD-A80A-9A688BD23979} - System32\Tasks\Microsoft\Windows\Application Experience\StartupCheckLibrary => C:\WINDOWS\system32\StartupCheck.vbs [392 2018-05-07] () [Brak podpisu cyfrowego]
FF user.js: detected! => C:\Users\Deadman\AppData\Roaming\Mozilla\Firefox\Profiles\97cgcs32.default\user.js [2019-10-25]
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl]
EmptyTemp:

HKU\S-1-5-21-280685973-2141685113-2535121551-1001\...\Winlogon: [Shell] %comspec% <==== UWAGA
HKU\S-1-5-21-280685973-2141685113-2535121551-1001\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist ( start /MIN "" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
SearchScopes: HKU\S-1-5-21-280685973-2141685113-2535121551-1001 -> {4AE4B81F-EA79-410B-88FA-789C5935CF5B} URL = hxxp://www.nav-pl.com/search?q={searchTerms}
Edge HomeButtonPage: HKU\S-1-5-21-280685973-2141685113-2535121551-1001 -> hxxp://www.nav-pl.com/
CHR StartupUrls: Profile 1 -> "hxxp://www.istartsurf.com/?type=hp&ts=1447441855&z=de7f12586f3c71fffda6ddfg3z4z8m6zfz5g1w5wdb&from=cor&uid=SAMSUNGXHM321HI_S26VJ9FZ910999","hxxp://www.google.com/","","hxxp://www.searchnu.com/419?appid=0","www.wp.pl/?src01=dp220140816","hxxp://www.sweet-page.com/?type=hp&ts=1408300007&from=sof&uid=SAMSUNGXHM321HI_S26VJ9FZ910999","www.wp.pl/?src01=dp220140826","hxxp://www.google.com"
CHR Session Restore: Profile 1 -> [funkcja włączona]
CHR Extension: (Ask Web Search) - C:\Users\smiet\AppData\Local\Google\Chrome\User Data\Default\Extensions\eocnnoackodjagdbaoddhjbkpjabimed [2019-12-20]
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
FirewallRules: [{7308D8DB-E971-4C53-BD8B-A754D3466676}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe Brak pliku
FirewallRules: [{6C52755C-B863-407B-B9F7-EC43D54E2B63}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe Brak pliku
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
Task: {BB005E04-C357-43E2-BB73-DD381AA74FE9} - System32\Tasks\Microsoft\Windows\Application Experience\StartupCheckLibrary => rundll32.exe StartupCheckLibrary.dll,DllMainRunLibrary <==== UWAGA
S3 ClientAnalyticsService; "C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe" [X]
S2 McAPExe; "C:\Program Files\Common Files\McAfee\VSCore_19_7\McApExe.exe" [X]
S3 McAWFwk; c:\PROGRA~1\COMMON~1\mcafee\actwiz\mcawfwk.exe [X]
S2 mccspsvc; "C:\Program Files\Common Files\McAfee\CSP\3.2.117.0\\McCSPServiceHost.exe" [X]
S3 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe" [X]
S2 mfemms; "C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe" [X]
S3 mfevtp; "C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe" [X]
S2 ModuleCoreService; "C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe" [X]
S2 PEFService; "C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe" [X]
S3 H2OFFT; \SystemRoot\System32\drivers\H2OFFT64.sys [X]
EmptyTemp:

HKU\S-1-5-21-2396012584-1682684127-3418686497-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nav-pl.com/
SearchScopes: HKU\S-1-5-21-2396012584-1682684127-3418686497-1001 -> DefaultScope {4AE4B81F-EA79-410B-88FA-789C5935CF5B} URL = hxxp://www.nav-pl.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2396012584-1682684127-3418686497-1001 -> {4AE4B81F-EA79-410B-88FA-789C5935CF5B} URL = hxxp://www.nav-pl.com/search?q={searchTerms}
CHR HomePage: Default -> hxxp://www.nav-pl.com/
CHR DefaultSearchURL: Default -> hxxp://www.nav-pl.com/search?q={searchTerms}
C:\Users\KOMPUTER\Desktop\xznfxcqshajyhj.txt
FirewallRules: [{3ED80FAB-BC95-4BC6-BDD2-6AFF63E95B63}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.112.449.0_x86__zpdnekdrzrea0\Spotify.exe Brak pliku
FirewallRules: [{C371E83D-D1D2-4E81-B9EC-D55616BF45B9}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.112.449.0_x86__zpdnekdrzrea0\Spotify.exe Brak pliku
FirewallRules: [{E9F45CFF-49AF-4AE0-8484-4A97F82F4546}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.112.449.0_x86__zpdnekdrzrea0\Spotify.exe Brak pliku
FirewallRules: [{55EDFCA9-FA41-401D-BF59-A2A10097AAB1}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.112.449.0_x86__zpdnekdrzrea0\Spotify.exe Brak pliku
FirewallRules: [{1B884E98-2D62-436B-A242-5D803E0B7582}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.112.449.0_x86__zpdnekdrzrea0\Spotify.exe Brak pliku
FirewallRules: [{8F88C6F9-647F-4E42-A523-82484280E060}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.112.449.0_x86__zpdnekdrzrea0\Spotify.exe Brak pliku
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
FirewallRules: [{9BC5EC67-18EA-4102-9D2F-DD6A566180D0}] => (Allow) %systemroot%\system32\alg.exe Brak pliku
FirewallRules: [{8D58F44C-BF7C-49E7-91F1-3557DE8E2930}] => (Allow) %systemroot%\system32\alg.exe Brak pliku
FirewallRules: [{F2734AFE-9122-47FC-B050-7357466FA206}] => (Allow) %systemroot%\system32\alg.exe Brak pliku
EmptyTemp:

Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
HKU\S-1-5-21-9491765-2927453260-2743771413-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.web-pl.com/
SearchScopes: HKU\S-1-5-21-9491765-2927453260-2743771413-1001 -> DefaultScope {22B1715F-FD64-41DE-AC67-27233CD4DB06} URL = hxxp://www.web-pl.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-9491765-2927453260-2743771413-1001 -> {22B1715F-FD64-41DE-AC67-27233CD4DB06} URL = hxxp://www.web-pl.com/search?q={searchTerms}
CHR HomePage: Default -> hxxp://www.web-pl.com/
CHR StartupUrls: Default -> "hxxp://google.pl/"
CHR DefaultSearchURL: Default -> hxxp://www.web-pl.com/search?q={searchTerms}
CHR DefaultSearchKeyword: Default -> szukaj
CHR Notifications: Default -> hxxps://hellopushworld.com; hxxps://www1.lucienmann.pro
S2 AMDRyzenMasterDriver; \??\C:\Program Files\AMD\Performance Profile Client\RyzenMaster\AMDRyzenMasterDriver.sys [X]
C:\Users\ziomi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CNext.lnk
EmptyTemp:

HKU\S-1-5-21-586042850-1794787906-4032504049-1001\...\Winlogon: [Shell] %comspec% <==== UWAGA
HKU\S-1-5-21-586042850-1794787906-4032504049-1001\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist " ( start /MIN "" " & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
HKU\S-1-5-21-586042850-1794787906-4032504049-1001\...\Run: [ASRock A-Tuning] => [X]
ShortcutTarget: BackupRemind.lnk -> C:\Program Files (x86)\Wondershare\dr.fone toolkit for Android\Addins\AndroidBackupRestore\BackupRemind.exe (Brak pliku)
S2 WsDrvInst; C:\Program Files (x86)\Wondershare\dr.fone toolkit for Android\Library\DriverInstaller\DriverInstall.exe [X]
EmptyTemp:

Otworzy się Notatnik - wklej do niego:
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Plants vs Zombies.lnk
EmptyTemp:

HKU\S-1-5-21-1605477994-2647608232-1457068919-1001\...\Winlogon: [Shell] %comspec% <==== UWAGA
HKU\S-1-5-21-1605477994-2647608232-1457068919-1001\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundModule.exe" 2>NUL | find /I /N "SoundModule.exe">NUL && exit & if exist "C:\Users\Tomek\AppData\Roaming\Microsoft\SoundModule\SoundModule.exe" ( start /MIN "" "C:\Users\Tomek\AppData\Roaming\Microsoft\SoundModule\SoundModule.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
RemoveDirectory: C:\Users\Tomek\AppData\Roaming\Microsoft\SoundModule
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
SearchScopes: HKU\S-1-5-21-1605477994-2647608232-1457068919-1001 -> DefaultScope {76C2506C-2681-4728-AA8B-2E612DBC802A} URL =
SearchScopes: HKU\S-1-5-21-1605477994-2647608232-1457068919-1001 -> {801495F2-8FB7-4481-A3C6-59B7F9453BA9} URL =
OPR Extension: (Font Finder) - C:\Users\Tomek\AppData\Roaming\Opera Software\Opera Stable\Extensions\lochgnflibdkeifofbnpoocomcpgokcn [2019-11-12]
S4 UEIPSvc; "C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe" [X]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware\ByteFence Anti-Malware.lnk
RemoveDirectory: C:\Program Files\ByteFence
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software\Avast Free Antivirus.lnk
RemoveDirectory: C:\Program Files\AVAST Software
C:\Users\Kamil\Desktop\SIMSY\The Sims 3.lnk
C:\Users\Kamil\Desktop\SIMSY\The Sims 4.lnk
EmptyTemp:

S3 mracdrv; C:\Windows\System32\drivers\mracdrv.sys [6955760 2018-12-01] (Mail.Ru LLC -> LLC Mail.Ru)
S3 mracsvc; C:\Windows\System32\mracsvc.exe [7690000 2018-12-01] (Mail.Ru LLC -> LLC Mail.Ru)
C:\Windows\System32\drivers\mracdrv.sys
C:\Windows\System32\mracsvc.exe
FirewallRules: [TCP Query User{3B686D66-0F48-410A-86B2-16E24678D005}C:\users\ppp\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\ppp\appdata\local\mycomgames\mycomgames.exe (Mail.Ru, LLC -> MY.COM B.V.)
FirewallRules: [UDP Query User{4DFCC528-252A-41D7-A07D-2908375DBCCB}C:\users\ppp\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\ppp\appdata\local\mycomgames\mycomgames.exe (Mail.Ru, LLC -> MY.COM B.V.)
FirewallRules: [TCP Query User{D859D99D-EC60-4FB4-B2E4-7AD9EFA9479B}C:\users\ppp\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\ppp\appdata\local\mycomgames\mycomgames.exe (Mail.Ru, LLC -> MY.COM B.V.)
FirewallRules: [UDP Query User{3E07F3B0-3C7C-4F98-8315-62A7D8092F04}C:\users\ppp\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\ppp\appdata\local\mycomgames\mycomgames.exe (Mail.Ru, LLC -> MY.COM B.V.)
S2 McAfee WebAdvisor; "C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe" [X]
RemoveDirectory: C:\Program Files\McAfee
RemoveDirectory: C:\Program Files\Common Files\McAfee
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
C:\Users\ppp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ\VirtualDJ 2018.lnk
InternetURL: C:\Users\ppp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My.com Games\Warface My.Com\Warface.url -> URL: mailrugames://play/13.2000076
InternetURL: C:\Users\ppp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My.com Games\Warface My.Com\Удалить Warface.url -> URL: mailrugames://uninstall/13.2000076
FF Extension: (Brak nazwy) - C:\Program Files\McAfee\SiteAdvisor\saffplg.xpi [nie znaleziono]
Task: {C68CA1FC-0AA4-4012-8099-89ED5E5128AD} - System32\Tasks\{69B898C8-DAD3-46EB-AD44-07EB00222CB2} => C:\Windows\system32\pcalua.exe -a "C:\Program Files\TeamSpeak 3 Client\package_inst.exe" -d C:\Users\ppp\Downloads -c "C:\Users\ppp\Downloads\soundboard-1.1b1-win32.ts3_plugin"
Task: {4BF38852-95AE-40DC-81D1-FDC198951A5E} - System32\Tasks\{C071E08B-E301-4BAF-BEF8-E9B66A84C6B5} => C:\Windows\system32\pcalua.exe -a C:\Users\ppp\Downloads\FacebookGameroom.exe -d C:\Users\ppp\Downloads
EmptyTemp:

HKU\S-1-5-21-968159076-530178348-4023363429-1001\...\Winlogon: [Shell] %comspec% <==== UWAGA
HKU\S-1-5-21-968159076-530178348-4023363429-1001\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundModule.exe" 2>NUL | find /I /N "SoundModule.exe">NUL && exit & if exist ( start /MIN "" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
Task: {A5697C56-41F5-402B-97CE-5A6A972322F5} - System32\Tasks\ByteFence => C:\Program Files\ByteFence\ByteFence.exe [3917128 2019-11-20] (Byte Technologies LLC -> Byte Technologies LLC) <==== UWAGA
RemoveDirectory: C:\Program Files\ByteFence
R2 ByteFenceService; C:\Program Files\ByteFence\ByteFenceService.exe [160584 2019-11-20] (Byte Technologies LLC -> Byte Technologies LLC) <==== UWAGA
R2 rtop; c:\program files\bytefence\rtop\bin\rtop_svc.exe [297288 2019-12-02] (Byte Technologies LLC -> Byte Technologies LLC.) <==== UWAGA
2019-12-02 10:06 - 2019-12-02 10:06 - 000001041 _____ C:\Users\Kamil\Desktop\ByteFence Anti-Malware.lnk
2019-12-02 10:06 - 2019-12-02 10:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ByteFence
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ByteFence
HOSTS:
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
Task: {E61C4C3C-7354-4184-B6DB-4004358CE7EB} - System32\Tasks\Microsoft\Windows\Maintenance\InstallWinSAT => C:\Windows\system32\Maintenance.vbs [1131 2018-07-21] () [Brak podpisu cyfrowego]
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> A:\bin\ssv.dll => Brak pliku
HKU\S-1-5-21-968159076-530178348-4023363429-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.global-pl.com/
HKU\S-1-5-21-968159076-530178348-4023363429-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
SearchScopes: HKU\S-1-5-21-968159076-530178348-4023363429-1001 -> DefaultScope {19FB89A4-9E8A-44F5-8046-CED817A05382} URL = hxxp://www.global-pl.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-968159076-530178348-4023363429-1001 -> {19FB89A4-9E8A-44F5-8046-CED817A05382} URL = hxxp://www.global-pl.com/search?q={searchTerms}
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation -> Microsoft Corporation.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation -> Microsoft Corporation.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> A:\bin\dtplugin\npDeployJava1.dll [Brak pliku]
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> A:\bin\plugin2\npjp2.dll [Brak pliku]
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [X]
S2 GamingApp_Service; "D:\Gaming APP\GamingApp_Service.exe" [X]
S2 GamingHotkey_Service; D:\Gaming APP\GamingHotkey_Service.exe [X]
S3 NTIOLib_MBAPI; \??\D:\Gaming APP\Lib\NTIOLib_X64.sys [X]
FirewallRules: [TCP Query User{BEEF588C-28C3-4016-99A0-B3A68B4B61B2}C:\users\kamil\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\kamil\appdata\local\mycomgames\mycomgames.exe Brak pliku
FirewallRules: [UDP Query User{4D589828-8706-4E7D-933A-C5CEF6E1BAB4}C:\users\kamil\appdata\local\mycomgames\mycomgames.exe] => (Allow) C:\users\kamil\appdata\local\mycomgames\mycomgames.exe Brak pliku
FirewallRules: [{D431779C-FA34-4F57-B77F-C9BE6802808C}] => (Block) C:\users\kamil\appdata\local\mycomgames\mycomgames.exe Brak pliku
FirewallRules: [{C988A2C4-75C8-46E8-A0DD-721D9910F935}] => (Block) C:\users\kamil\appdata\local\mycomgames\mycomgames.exe Brak pliku
FirewallRules: [{6333CD2F-CA06-4DAB-B80E-B21DD09535C3}] => (Allow) C:\Program Files (x86)\Origin Games\The Sims 4\Game\Bin_LE\TS4.exe Brak pliku
FirewallRules: [{71E4C671-FD0E-4C8B-9855-1B246AAB7AD3}] => (Allow) C:\Program Files (x86)\Origin Games\The Sims 4\Game\Bin_LE\TS4.exe Brak pliku
FirewallRules: [{E916B9B7-FB62-4298-B63F-062306AD0D3C}] => (Allow) C:\Program Files (x86)\Origin Games\The Sims 4\Game\Bin\TS4_x64.exe Brak pliku
FirewallRules: [{5BCDD3A3-0AB6-466B-843E-2145AE94EDBF}] => (Allow) C:\Program Files (x86)\Origin Games\The Sims 4\Game\Bin\TS4_x64.exe Brak pliku
EmptyTemp:

S3 cpuz148; \??\C:\WINDOWS\temp\cpuz148\cpuz148_x64.sys [X]
Task: {A5552165-B160-47E9-A98D-B17374043F2B} - \Microsoft\Windows\UNP\RunCampaignManager -> Brak pliku <==== UWAGA
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinCDEmu\WinCDEmu Settings.lnk
C:\Users\Błażej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
C:\Users\Błażej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DXGL\Third-party Credits.lnk
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
EmptyTemp:

Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
GroupPolicy: Ograniczenia ? <==== UWAGA
S0 edevmon; system32\DRIVERS\edevmon.sys [X]
S3 MDA_NTDRV; \??\C:\Windows\system32\MDA_NTDRV.sys [X]
FirewallRules: [TCP Query User{17DA4C27-264B-48B6-872A-6C804288AC40}D:\sdi_r1809\sdi_x64_r1809.exe] => (Allow) D:\sdi_r1809\sdi_x64_r1809.exe Brak pliku
FirewallRules: [UDP Query User{746A2703-014D-4FAB-A6A7-B6CF6926EB63}D:\sdi_r1809\sdi_x64_r1809.exe] => (Allow) D:\sdi_r1809\sdi_x64_r1809.exe Brak pliku
FirewallRules: [TCP Query User{E61F9866-1787-4F90-B2D8-A0CF14CA39A4}C:\program files\java\jre1.8.0_151\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_151\bin\javaw.exe Brak pliku
FirewallRules: [UDP Query User{AF201354-78DB-44DF-98A3-35F11428C101}C:\program files\java\jre1.8.0_151\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_151\bin\javaw.exe Brak pliku
FirewallRules: [TCP Query User{8A42084F-1C72-4400-886F-32BEEDB0E9E0}C:\program files\java\jre1.8.0_151\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_151\bin\javaw.exe Brak pliku
FirewallRules: [UDP Query User{68FDE0A7-61C1-45EE-BC2A-778825FBA11A}C:\program files\java\jre1.8.0_151\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_151\bin\javaw.exe Brak pliku
FirewallRules: [TCP Query User{A8C94197-C579-4FA2-B51D-A2170E821780}C:\program files\java\jre1.8.0_191\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_191\bin\javaw.exe Brak pliku
FirewallRules: [UDP Query User{B34BB8EF-9861-445B-B5A0-1FA5D41F3415}C:\program files\java\jre1.8.0_191\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_191\bin\javaw.exe Brak pliku
FirewallRules: [TCP Query User{8453E601-0CF2-4E5E-93D6-70A75201C39D}C:\program files\java\jre1.8.0_191\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_191\bin\javaw.exe Brak pliku
FirewallRules: [UDP Query User{75761E67-9783-4013-B958-6C7B70C3E4C7}C:\program files\java\jre1.8.0_191\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_191\bin\javaw.exe Brak pliku
FirewallRules: [TCP Query User{35F49AC5-F0F1-4991-AF19-AC678196A671}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe Brak pliku
FirewallRules: [UDP Query User{7D557BD5-AA69-47DB-B189-FC920154D161}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe Brak pliku
FirewallRules: [TCP Query User{4471CC59-AB63-4EA6-89BD-3C2D9267B647}D:\idm\sdi_r1811\sdi_x64_r1811.exe] => (Allow) D:\idm\sdi_r1811\sdi_x64_r1811.exe Brak pliku
FirewallRules: [UDP Query User{4EA16007-05E2-46BF-8730-70C81A302B32}D:\idm\sdi_r1811\sdi_x64_r1811.exe] => (Allow) D:\idm\sdi_r1811\sdi_x64_r1811.exe Brak pliku
FirewallRules: [TCP Query User{A4ED5018-2594-4F92-85CD-30F58654933F}D:\idm\sdi_r1811\sdi_x64_r1811.exe] => (Allow) D:\idm\sdi_r1811\sdi_x64_r1811.exe Brak pliku
FirewallRules: [UDP Query User{109352D4-9A98-4A26-B6F9-C0963758D6B0}D:\idm\sdi_r1811\sdi_x64_r1811.exe] => (Allow) D:\idm\sdi_r1811\sdi_x64_r1811.exe Brak pliku
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Universal Media Server.lnk
EmptyTemp:

CHR DefaultSearchURL: Default -> hxxps://pl.search.yahoo.com/search?fr=mcafee_uninternational&type=E211PL826G0&p={searchTerms}
CHR DefaultSearchKeyword: Default -> mcafee
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
EmptyTemp:

FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
Task: {9801C2EA-3A4C-4458-96E5-721EDA6EDAC3} - System32\Tasks\App Explorer => C:\Users\suwer\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [7407784 2019-11-21] (SweetLabs Inc. -> SweetLabs, Inc) <==== UWAGA
C:\Users\suwer\AppData\Local\Host App Service
SearchScopes: HKU\S-1-5-21-1198898253-173381137-3609142154-1001 -> DefaultScope {AB39825B-9FE3-4112-A2E2-64498EA117DD} URL =
SearchScopes: HKU\S-1-5-21-1198898253-173381137-3609142154-1001 -> {A5C06EAF-76F9-4BC8-A476-84A5C5AB1AF1} URL =
EmptyTemp:

HKU\S-1-5-21-742678756-2304139027-1524245951-1001\...\Winlogon: [Shell] %comspec% <==== UWAGA
HKU\S-1-5-21-742678756-2304139027-1524245951-1001\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist ( start /MIN "" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
HKU\S-1-5-21-742678756-2304139027-1524245951-1001\...\Run: [GalaxyClient] => [X]
GroupPolicy: Ograniczenia ? <==== UWAGA
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
S2 CorsairGamingAudioConfig; C:\Windows\System32\CorsairGamingAudioCfgService64.exe [X]
S3 cpuz149; \??\C:\WINDOWS\temp\cpuz149\cpuz149_x64.sys [X]
S3 GPCIDrv; \??\C:\Users\Mateusz\AppData\Local\Temp\7zSEE1B.tmp\N2080_FW_Upgrade_Tool_V003\GPCIDrv64.sys [X] <==== UWAGA
S3 GPUZ-v2; \??\C:\WINDOWS\TEMP\GPUZ-v2.sys [X]
EmptyTemp:

HKU\S-1-5-21-1291418262-3119489752-1109750237-1003\...\Run: [mateu] => cmd.exe /c start www.dinoraptzor.org
Task: {9701FA61-D614-4415-A2FE-35550987834E} - System32\Tasks\mateu => cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v mateu /t REG_SZ /d "cmd.exe /c start www.dinoraptzor.org"
Task: {ED9F881A-C88D-4E32-ACD0-E59713158099} - \Microsoft\Windows\UNP\RunCampaignManager -> Brak pliku <==== UWAGA
HKU\S-1-5-21-1291418262-3119489752-1109750237-1003\...\Policies\Explorer: []
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
Toolbar: HKU\S-1-5-21-1291418262-3119489752-1109750237-1003 -> Brak nazwy - {C500C267-63BF-451F-8797-4D720C9A2ED9} -  Brak pliku
C:\Users\mateu\Documents\American Truck Simulator\readme.rtf.lnk
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
EmptyTemp:

FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\kl_prefs_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.js [2019-12-04] <==== UWAGA (Linkuje do pliku *.cfg)
FF ExtraCheck: C:\Program Files\mozilla firefox\kl_config_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.cfg [2019-12-04] <==== UWAGA
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
FirewallRules: [{08E0254E-3078-4008-ABD3-8AEC6797DE1E}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe Brak pliku
FirewallRules: [{5A5BB27D-1437-41FC-B3A4-E33F29CF7672}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe Brak pliku
S3 SUService; "C:\Program Files (x86)\Lenovo\System Update\SUService.exe" [X]
EmptyTemp:

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.gmx.com/start?src=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=dpduiuxvo0kxaikmoikm96&p_w=y2w35
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.gmx.com/start?src=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=dpduiuxvo0kxaikmoikm96&p_w=y2w35
HKU\S-1-5-21-3906235096-238085844-2236722319-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.web-pl.com/
HKU\S-1-5-21-3906235096-238085844-2236722319-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
HKU\S-1-5-21-3906235096-238085844-2236722319-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://search.gmx.com/web/result?origin=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=dpduiuxvo0kxaikmoikm96&p_w=y2w35&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://search.gmx.com/web/result?origin=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=dpduiuxvo0kxaikmoikm96&p_w=y2w35&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://search.gmx.com/web/result?origin=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=dpduiuxvo0kxaikmoikm96&p_w=y2w35&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://search.gmx.com/web/result?origin=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=dpduiuxvo0kxaikmoikm96&p_w=y2w35&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3906235096-238085844-2236722319-1000 -> DefaultScope {22B1715F-FD64-41DE-AC67-27233CD4DB06} URL = hxxp://www.web-pl.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3906235096-238085844-2236722319-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://search.gmx.com/web/result?origin=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=dpduiuxvo0kxaikmoikm96&p_w=y2w35&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3906235096-238085844-2236722319-1000 -> {22B1715F-FD64-41DE-AC67-27233CD4DB06} URL = hxxp://www.web-pl.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3906235096-238085844-2236722319-1000 -> {8761917A-309A-4c43-B712-37A183700B86} URL = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=1975384696&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=pl&q={searchTerms}
CHR HomePage: Default -> hxxp://www.web-pl.com/
CHR StartupUrls: Default -> "hxxp://www.web-pl.com/"
CHR DefaultSearchURL: Default -> hxxp://www.web-pl.com/search?q={searchTerms}
CHR DefaultSearchKeyword: Default -> Szukaj
Reboot:

HKU\S-1-5-21-955475205-2621069176-4123217926-1001\...\Winlogon: [Shell] explorer.exe,Explorer.exe <==== UWAGA
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
GroupPolicy: Ograniczenia ? <==== UWAGA
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
Task: {03535854-8718-4dc8-a369-dada104efdf0} - Brak ścieżki do pliku
Task: {0c9d0eed-f37e-4093-88ed-6e3c0297eb00} - Brak ścieżki do pliku
Task: {175863e0-7eb8-4c43-ba4e-19a80dc0f62c} - Brak ścieżki do pliku
Task: {19ac116e-d890-4c0c-9a06-cd4ccd3c4242} - Brak ścieżki do pliku
Task: {1bd7cd9a-ca92-475c-b19a-28fc50c2b2d3} - Brak ścieżki do pliku
Task: {238e0869-4b1e-4052-8e34-1d53e0e7398e} - Brak ścieżki do pliku
Task: {2c61474e-f845-413a-8d71-23d6dcd20d59} - Brak ścieżki do pliku
Task: {30b02861-b986-402f-bab3-bcaa35f3cf37} - Brak ścieżki do pliku
Task: {3ad0357c-5943-4bcb-b04d-7b7efcf2636b} - Brak ścieżki do pliku
Task: {400ecef3-b711-4925-843f-d47d314634d9} - Brak ścieżki do pliku
Task: {421e652a-9911-4359-ac35-c6982911cf73} - Brak ścieżki do pliku
Task: {499d197b-41b4-410c-a114-91d6236e75e0} - Brak ścieżki do pliku
Task: {4ebf0628-1b85-4692-846a-c0b9391b3343} - Brak ścieżki do pliku
Task: {50661589-9828-4bca-8e8b-4d318b8c0c7d} - Brak ścieżki do pliku
Task: {5a6d7103-e059-4329-a43f-48126ff7b631} - Brak ścieżki do pliku
Task: {5ca6094e-3527-4542-b35a-3869ba36a8ca} - Brak ścieżki do pliku
Task: {658fb38c-8b59-467f-99e5-6011f15a1a08} - Brak ścieżki do pliku
Task: {66365e98-e0e4-438b-aa89-c87b73bf85dd} - Brak ścieżki do pliku
Task: {695fb407-19d1-4f8f-8a89-8eb4cc8e3d5a} - Brak ścieżki do pliku
Task: {6bb65b06-047e-4b2d-ac87-c220d7e4870e} - Brak ścieżki do pliku
Task: {708edd0a-0489-47e2-b051-9d1503b769e3} - Brak ścieżki do pliku
Task: {783cef67-41be-426b-ac3e-c07055b42a99} - Brak ścieżki do pliku
Task: {7a0d633f-daa4-4dca-a2ed-d8ca7d920ae7} - Brak ścieżki do pliku
Task: {89a108a1-a29f-4855-9248-151d42c810ca} - Brak ścieżki do pliku
Task: {8e6e5998-818c-4ca8-9a44-d1f546b85dd9} - Brak ścieżki do pliku
Task: {928f7b39-ddbe-4b0b-be69-10de6a0b8613} - Brak ścieżki do pliku
Task: {9538dd69-7a69-4c98-aea6-14c103fea9c0} - Brak ścieżki do pliku
Task: {989b7700-22d4-409b-9329-38c8c8b81741} - Brak ścieżki do pliku
Task: {a2353781-4ca5-4120-9709-160902e94fb8} - Brak ścieżki do pliku
Task: {a3a620c1-802e-4139-a6bc-3391cda3a7fc} - Brak ścieżki do pliku
Task: {a5de8a7a-3a87-416a-a70d-0ea62e47ec83} - Brak ścieżki do pliku
Task: {ab0b7cfe-6bb8-4ed5-99a8-95d0863d4c6b} - Brak ścieżki do pliku
Task: {afe5d7f4-0b8b-4963-a4fc-4a55d9c2af1f} - Brak ścieżki do pliku
Task: {bb3d3906-655c-447f-96d1-160b143c59c3} - Brak ścieżki do pliku
Task: {bf089ab9-0845-48e8-9ef5-a0fdb5277455} - Brak ścieżki do pliku
Task: {c71bcd81-e2f8-4629-b034-b595ff169d53} - Brak ścieżki do pliku
Task: {d4b8bf95-474a-47e5-adab-be182f28b81c} - Brak ścieżki do pliku
Task: {d6ce05d5-8a17-43a2-bd01-bda664dc6157} - Brak ścieżki do pliku
Task: {d8b66d5d-0fdd-457c-abcf-0f22255a539c} - Brak ścieżki do pliku
Task: {da7e7a61-d5ce-4e17-aa3e-e1b7db7b5a41} - Brak ścieżki do pliku
Task: {e2f6a1bc-1d5d-49a9-816c-034cbac9d4ec} - Brak ścieżki do pliku
Task: {ef013566-4a44-4701-b2a4-aca80606f7ba} - Brak ścieżki do pliku
Task: {fe2f5608-9c95-4dcc-abaf-a94867d9b3a5} - Brak ścieżki do pliku
BHO: Brak nazwy -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> Brak pliku
BHO: Brak nazwy -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> Brak pliku
Toolbar: HKU\S-1-5-21-955475205-2621069176-4123217926-1001 -> Brak nazwy - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  Brak pliku
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [Brak pliku]
EmptyTemp: