jessica

START::
CMD: net stop wuauserv
CMD: net stop cryptSvc
CMD: net stop bits
CMD: net stop msiserver
CMD: ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
CMD: ren C:\Windows\System32\catroot2 Catroot2.old
CMD: net start wuauserv
CMD: net start cryptSvc
CMD: net start bits
CMD: net start msiserver
Reboot:
END::

START::

StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsoSvc]
"DelayedAutoStart"=dword:00000001
"DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00
"Description"="@%systemroot%\\system32\\usosvc.dll,-102"
"DisplayName"="@%systemroot%\\system32\\usosvc.dll,-101"
"ErrorControl"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
  00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,20,00,2d,00,70,00,00,\
  00
"ObjectName"="LocalSystem"
"PreshutdownTimeout"=dword:0036ee80
"RequiredPrivileges"=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,\
  00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,\
  65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,\
  00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,\
  61,00,74,00,65,00,50,00,61,00,67,00,65,00,46,00,69,00,6c,00,65,00,50,00,72,\
  00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,63,00,\
  62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
  00,41,00,73,00,73,00,69,00,67,00,6e,00,50,00,72,00,69,00,6d,00,61,00,72,00,\
  79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\
  00,67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,\
  6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\
  00,00,00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,\
  75,00,6f,00,74,00,61,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\
  00,00,00,53,00,65,00,53,00,68,00,75,00,74,00,64,00,6f,00,77,00,6e,00,50,00,\
  72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,44,00,65,\
  00,62,00,75,00,67,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
  00,00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,00,72,00,69,00,76,\
  00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,\
  6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
  00,53,00,65,00,53,00,65,00,63,00,75,00,72,00,69,00,74,00,79,00,50,00,72,00,\
  69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,61,00,6b,\
  00,65,00,4f,00,77,00,6e,00,65,00,72,00,73,00,68,00,69,00,70,00,50,00,72,00,\
  69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4c,00,6f,00,61,\
  00,64,00,44,00,72,00,69,00,76,00,65,00,72,00,50,00,72,00,69,00,76,00,69,00,\
  6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4d,00,61,00,6e,00,61,00,67,00,65,\
  00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,\
  65,00,67,00,65,00,00,00,53,00,65,00,53,00,79,00,73,00,74,00,65,00,6d,00,45,\
  00,6e,00,76,00,69,00,72,00,6f,00,6e,00,6d,00,65,00,6e,00,74,00,50,00,72,00,\
  69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,\
  00,61,00,74,00,65,00,53,00,79,00,6d,00,62,00,6f,00,6c,00,69,00,63,00,4c,00,\
  69,00,6e,00,6b,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
  00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,42,00,61,00,\
  73,00,65,00,50,00,72,00,69,00,6f,00,72,00,69,00,74,00,79,00,50,00,72,00,69,\
  00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"ServiceSidType"=dword:00000001
"Start"=dword:00000002
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsoSvc\Parameters]
"ServiceDll"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
  00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  75,00,73,00,6f,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceMain"="ServiceMain"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsoSvc\Security]
"Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,48,00,03,00,00,00,00,00,14,00,9d,00,02,00,01,01,00,00,00,00,00,\
  05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,05,12,00,00,00,01,\
EndRegedit:
Reboot:
END::

Update Orchestrator Service | Usługa koordynatora aktualizacji [wcześniej Update Orchestrator Service for Windows Update]

[Zmodyfikowana w Wersji 1903. Polska nazwa dodana w Wersji 2004.]
R2 UsoSvc; C:\WINDOWS\system32\usosvc.dll [567296 2021-03-11] (Microsoft Windows -> Microsoft Corporation)

[W starszych Wersjach usługa kieruje na usocore.dll]

R2 UsoSvc; C:\WINDOWS\system32\usocore.dll [887808 2019-05-28] (Microsoft Windows -> Microsoft Corporation)

START::
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wuauserv\Parameters]
"ServiceDll"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
  00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  77,00,75,00,61,00,75,00,65,00,6e,00,67,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UsoSvc\Parameters]
"ServiceDll"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
  00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  75,00,73,00.6F,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
EndRegedit:

EmptyEventLogs: 
EmptyTemp:
END::

START::
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Ograniczenia <==== UWAGA
EmptyEventLogs: 
EmptyTemp:
END::

WaaSMedicSvc Service is not running. Error while attempting to start WaaSMedicSvc:
Nazwa usugi jest nieprawidowa.

Dost©pne sĄ dalsze informacje Pomocy; aby je uzyska†, wpisz NET HELPMSG 2185.

Checking service configuration:
Checking Start type of WaaSMedicSvc: ATTENTION!=====> Unable to open WaaSMedicSvc registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open WaaSMedicSvc registry key. The service key does not exist.
Checking ServiceDll of WaaSMedicSvc: ATTENTION!=====> Unable to open WaaSMedicSvc registry key. The service key does not exist.

ATTENTION!=====> C:\Windows\System32\WaaSMedicSvc.dll FILE IS MISSING.

START::
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Ograniczenia <==== UWAGA
SearchScopes: HKU\S-1-5-21-3563797008-3845598522-1844387788-1001 -> DefaultScope {799F6E90-2249-4D88-AB0A-2930119D432D} URL =
SearchScopes: HKU\S-1-5-21-3563797008-3845598522-1844387788-1001 -> {799F6E90-2249-4D88-AB0A-2930119D432D} URL =
Toolbar: HKLM - Brak nazwy - {b60873b9-51aa-4566-b2fc-c16de2ec8bff} -  Brak pliku
Toolbar: HKLM-x32 - Brak nazwy - {b60873b9-51aa-4566-b2fc-c16de2ec8bff} -  Brak pliku
C:\Windows\Reimage.ini
S3 cpuz143; \??\C:\Windows\temp\cpuz143\cpuz143_x64.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
U4 DiagTrack; Brak ImagePath
S3 hwdatacard; \SystemRoot\system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbfake; \SystemRoot\system32\DRIVERS\ewusbfake.sys [X]
S3 hwusb_wwanecm; \SystemRoot\system32\DRIVERS\ew_wwanecm.sys [X]
S3 panda_url_filteringd; \??\C:\Program Files\Panda Security URL Filtering\panda_url_filteringd.sys [X]
S3 rsDwf; \SystemRoot\system32\DRIVERS\rsDwf.sys [X]
S3 semav6msr64; \??\C:\Windows\system32\drivers\semav6msr64.sys [X]
S2 dcpm-notify; "C:\Program Files\Dell\CommandPowerManager\NotifyService.exe" [X]
S4 RNDBWM; "C:\Program Files\Rivet Networks\SmartByte\RNDBWMService.exe" [X]
S2 SmartByte Network Service x64; "C:\Program Files\Rivet Networks\SmartByte\SmartByteNetworkService.exe" [X]
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [Brak pliku]
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [Brak pliku]
FF Plugin HKU\S-1-5-21-3563797008-3845598522-1844387788-1001: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Brak pliku]
FF Plugin HKU\S-1-5-21-3563797008-3845598522-1844387788-1001: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Brak pliku]
FF Plugin HKU\S-1-5-21-3563797008-3845598522-1844387788-1001: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Brak pliku]
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Brak pliku]
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Brak pliku]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <==== UWAGA
Task: {E2A5D8C0-8C4D-4277-9E4A-82581A8B05B6} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => C:\Program Files\CUAssistant\culauncher.exe (Brak pliku)
Task: {AAEED40D-07A4-4515-A6B3-812723D68E69} - Brak ścieżki do pliku
Task: {9E85FDBD-9259-4C46-BDE5-C3AE6018FA1B} - Brak ścieżki do pliku
IFEO\RAVBg64.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare\AutoReactivator.exe
IFEO\RtkAudioService64.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare\AutoReactivator.exe
IFEO\RtkNGUI64.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare\AutoReactivator.exe
IFEO\RtlUpd64.exe: [Debugger] C:\Program Files (x86)\IObit\Advanced SystemCare\AutoReactivator.exe
HKLM-x32\...\Run: [] => [X]
EmptyEventLogs: 
EmptyTemp:
END::

START::
Task: {1B04832D-E4D0-436D-9DDE-A7A162A7E691} - System32\Tasks\tokanofine\{319A79F3-1D0C-58D8-86D8-591C29013583} => C:\PROGRA~1\COMMON~1\NEROGE~1\TOKANO~1.EXE /Porola (Brak pliku)
Task: {3E9F1181-B6B1-4E51-953F-B97303866140} - System32\Tasks\{FA426DD0-8F2B-4987-9DBD-6AA1B3032EC2} => C:\Windows\system32\pcalua.exe -a C:\Autodesk\AutoCAD_2010_Polish_SLD_WIN_32bit\setup.exe -d C:\Users\GEOtest\Desktop -c "C:\Users\GEOtest\Desktop\inw_pkp_06.08.2018_(paliki wykryte przez ekipe pkp).dwg"
Task: {42F65B5C-8907-418D-8D60-45197EC5B1B0} - System32\Tasks\{F9062037-5CFB-40A2-B7BC-A58EA19A1008} => C:\Windows\system32\pcalua.exe -a C:\Users\GEOtest\AppData\Local\Temp\Temp1_Mapa_SG-12.zip\Mapa_SG-12\Setup.exe <==== UWAGA
Task: {5073DA5B-0584-4693-A826-13B5C7976A97} - System32\Tasks\{78B6B1EB-93E9-4988-A284-2A880293E557} => C:\Windows\system32\pcalua.exe -a C:\Instalki\Mapa_SG-12\Setup.exe -d C:\Instalki\Mapa_SG-12
Task: {603B21C4-B014-4CB2-8F3D-64911AC16165} - System32\Tasks\{54C34E77-05E7-4CE7-9154-D0A35B2C07D1} => C:\Windows\system32\pcalua.exe -a C:\Users\GEOtest\Downloads\JavaUninstallTool.exe -d C:\Users\GEOtest\Downloads
FF user.js: detected! => C:\Users\GEOtest\AppData\Roaming\Mozilla\Firefox\Profiles\52jyaa3w.default-1546411552481\user.js [2023-01-23]
CHR HomePage: Default -> hxxp://www.nav-pl.com/
C:\Users\GEOtest\AppData\Local\CPAUTO.tmp.*
RemoveDirectory: C:\found.000
EmptyEventLogs: 
HKLM\...\.scr:  =>  <==== UWAGA
SearchScopes: HKU\S-1-5-21-3939378201-523280795-2232624445-1000 -> {54E517B8-5DA8-46B2-9777-AC98250AAB06} URL = hxxp://www.nav-pl.com/search?q={searchTerms}
irewallRules: [{341740B1-0579-4990-A18C-C230E99EAFEB}] => (Allow) C:\Users\GEOtest\Downloads\AnyDesk (1).exe => Brak pliku
FirewallRules: [{3A5C4E81-C367-458E-BDB4-BA42F819286C}] => (Allow) C:\Users\GEOtest\Downloads\AnyDesk (1).exe => Brak pliku
FirewallRules: [{7C7CE83D-200E-4F67-9555-6082D0306A37}] => (Allow) C:\Users\GEOtest\Downloads\AnyDesk (1).exe => Brak pliku
FirewallRules: [{572FD437-F489-4E68-9B67-48B8559D250F}] => (Allow) C:\Users\GEOtest\Downloads\AnyDesk (1).exe => Brak pliku
FirewallRules: [{E4FDD350-9666-4DBB-827D-F26DBC809BC9}] => (Allow) C:\Users\GEOtest\Downloads\AnyDesk (1).exe => Brak pliku
FirewallRules: [{321B7068-8926-44C5-B0AF-FC3BF50C8458}] => (Allow) C:\Users\GEOtest\Downloads\AnyDesk (1).exe => Brak pliku
EmptyTemp:
END::

Error: (03/11/2023 01:51:12 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: Model DCOM odebrał błąd 1068 podczas próby uruchomienia usługi BITS z argumentami  w celu uruchomienia serwera:
{BB6DF56B-CACE-11DC-9992-0019B93A3A84}

Error: (03/11/2023 01:50:35 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: Model DCOM odebrał błąd 1084 podczas próby uruchomienia usługi VSS z argumentami  w celu uruchomienia serwera:
{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}

Error: (03/11/2023 01:49:39 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Usługa Usługa listy sieci zależy od usługi Rozpoznawanie lokalizacji w sieci, której nie można uruchomić z powodu następującego błędu: 
Uruchomienie usługi zależności lub grupy nie powiodło się.

START::
HKU\S-1-5-21-3658810115-1074333133-829773096-1001\...\Run: [Win32 Home] => C:\ProgramData\Win32 Home System\Win32 Home.exe [1331744256 2023-03-08] (Win32) [Brak podpisu cyfrowego]
C:\ProgramData\Win32 Home System\Win32 Home.exe
EmptyEventLogs: 
EmptyTemp:
END::

START::
HKU\S-1-5-21-3658810115-1074333133-829773096-1001\...\Run: [system_updater] => C:\Users\divof\AppData\Roaming\Microsoft\config\system.exe [2428293634 2023-03-07] () [Brak podpisu cyfrowego] <==== UWAGA
C:\Users\divof\AppData\Roaming\Microsoft\config\system.exe
Task: {295E2D7E-7742-4256-9CEA-387A3278DEF4} - System32\Tasks\system_updater => C:\Users\divof\AppData\Roaming\Microsoft\config\system.exe [2428293634 2023-03-07] () [Brak podpisu cyfrowego] <==== UWAGA
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\WINDOWS\System32\MbaeParserTask.exe (Brak pliku)
Task: {CF1CC6B3-F109-402F-8469-4CC9F7CD4D79} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => C:\WINDOWS\system32\MusNotification.exe /RunOnAC RebootDialog (Brak pliku)
Task: {D3E87602-E251-4759-A7F5-8F3BC35EB5C3} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe --automatic (Brak pliku)
Task: {DCAEECF9-D6FF-464B-A616-16139071C8C0} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => "C:\Windows\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs"
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => C:\WINDOWS\system32\MusNotification.exe (Brak pliku)
S3 BraveElevationService; "C:\Program Files\BraveSoftware\Brave-Browser\Application\110.1.48.171\elevation_service.exe" [X]
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
GroupPolicy: Ograniczenia ? <==== UWAGA
Policies: C:\ProgramData\NTUSER.pol: Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Ograniczenia <==== UWAGA
C:\WINDOWS\system32\default_error_stack-000053-000000.txt
C:\WINDOWS\system32\default_error_stack-000052-000000.txt
C:\WINDOWS\system32\default_error_stack-000051-000000.txt
EmptyEventLogs: 
EmptyTemp:
END::

START::
AutoConfigURL: [S-1-5-21-929241179-32002084-1731227500-1001] => 2019 <==== UWAGA
ManualProxies: 02019 <==== UWAGA
Task: {CF1FEE77-953C-4437-940B-71859659B39A} - \Microsoft\Windows\UNP\RunCampaignManager -> Brak pliku <==== UWAGA
Task: {E8AACF29-C143-4C12-820D-4ED86A225F5E} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe --cistrayUI (Brak pliku)
Task: {EBA04807-C1BD-417E-B687-221AD3ED720F} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => C:\Windows\system32\rundll32.exe C:\Windows\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0)"
Task: {EC657766-C2A3-44B7-8EFE-6B508CB1A015} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => C:\Program Files\CUAssistant\culauncher.exe (Brak pliku)
Task: {28C47E06-F650-4465-ABB4-73459CB70BA2} - System32\Tasks\Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_WeeklyTask => %windir%\System32\reg.exe add hklm\SOFTWARE\Lenovo\SystemUpdatePlugin\scheduler /v start /t reg_dword /d 1 /f /reg:32
Startup: C:\Users\Paweł\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\up.lnk [2021-01-28]
ShortcutTarget: up.lnk -> C:\Users\Default\AppData\Roaming\h.js () [Brak podpisu cyfrowego]
Startup: C:\Users\Paweł\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\upd.lnk [2021-01-28]
ShortcutTarget: upd.lnk -> C:\Users\Default\AppData\Local\b.js () [Brak podpisu cyfrowego]
GroupPolicy: Ograniczenia ? <==== UWAGA
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
ShortcutTarget: My DDT2000 Quick Menu.lnk -> C:\Program Files (x86)\DDT2000\DDT2000_menu.exe (Brak pliku)
HKLM\...\Print\Monitors\Canon BJ Language Monitor MG5700 series: CNMLMCS.DLL (Brak pliku)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\MRT: Ograniczenia <==== UWAGA
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [711288 2023-01-09] (Oracle America, Inc. -> Oracle Corporation)
C:\Users\Paweł\AppData\Roaming\winserver.exe
C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\APPDATA\ROAMING\WINSERVER.EXE
C:\USERS\DEFAULT\APPDATA\ROAMING\WINSERVER.EXE
C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\ROAMING\WINSERVER.EXE
C:\USERS\DEFAULT\APPDATA\LOCAL\WINHOST.EXE
C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\LOCAL\WINHOST.EXE
C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\APPDATA\LOCAL\WINHOST.EXE
C:\USERS\PAWEł\APPDATA\LOCAL\WINHOST.EXE
FirewallRules: [{002E62C9-2648-4428-93BC-C6167A2D079A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe => Brak pliku
HKU\S-1-5-21-929241179-32002084-1731227500-1001\...\StartupApproved\StartupFolder: => "upd.lnk"
HKU\S-1-5-21-929241179-32002084-1731227500-1001\...\StartupApproved\StartupFolder: => "up.lnk"
HKU\S-1-5-21-929241179-32002084-1731227500-1001\...\StartupApproved\StartupFolder: => "DDT2000 Quick Menu.lnk"
HKU\S-1-5-21-929241179-32002084-1731227500-1001\...\StartupApproved\StartupFolder: => "My DDT2000 Quick Menu.lnk"
HKU\S-1-5-21-929241179-32002084-1731227500-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo15.msn.com/?pc=LCTE
HKU\S-1-5-21-929241179-32002084-1731227500-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo15.msn.com/?pc=LCTE
HKU\S-1-5-21-929241179-32002084-1731227500-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.lenovo.com
SearchScopes: HKU\S-1-5-21-929241179-32002084-1731227500-1001 -> DefaultScope {F45DCA7E-0A6A-4BBD-AF86-54CB878FC265} URL = 
SearchScopes: HKU\S-1-5-21-929241179-32002084-1731227500-1001 -> {F45DCA7E-0A6A-4BBD-AF86-54CB878FC265} URL = 
R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [349480 2016-04-27] (McAfee, Inc. -> McAfee, Inc.)
S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [83608 2016-04-27] (Microsoft Windows Early Launch Anti-malware Publisher -> McAfee, Inc.)
R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [493352 2016-04-27] (McAfee, Inc. -> McAfee, Inc.)
R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [843048 2016-04-27] (McAfee, Inc. -> McAfee, Inc.)
R0 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [243488 2016-04-27] (McAfee, Inc. -> McAfee, Inc.)
C:\WINDOWS\System32\drivers\mfeavfk.sys
C:\WINDOWS\System32\drivers\mfeelamk.sys 
C:\WINDOWS\System32\drivers\mfefirek.sys
C:\WINDOWS\System32\drivers\mfehidk.sys
C:\WINDOWS\System32\drivers\mfewfpk.sys
S3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [78632 2016-04-27] (McAfee, Inc. -> McAfee, Inc.)
C:\WINDOWS\System32\drivers\cfwids.sys
S3 mfevtp; C:\Windows\system32\mfevtps.exe [277744 2016-04-26] (McAfee, Inc. -> McAfee, Inc.)
C:\Windows\system32\mfevtps.exe
EmptyEventLogs: 
EmptyTemp:
END::

START::
AlternateDataStreams: C:\ProgramData:err [1100]
AlternateDataStreams: C:\Users\All Users:err [1100]
AlternateDataStreams: C:\ProgramData\Dane aplikacji:err [1100]
AlternateDataStreams: C:\ProgramData\sldh.dat:136096DD5B [3434]
AlternateDataStreams: C:\ProgramData\sldh.dat:A18AAFCFAA [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [3434]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk:F20EF51E1F [3434]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [4056]
AlternateDataStreams: C:\Users\Public\Documents\sldh.dat:440BDC81C7 [3434]
AlternateDataStreams: C:\Users\Tomas\Dane aplikacji:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\Tomas\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394]
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Ograniczenia <==== UWAGA
EmptyEventLogs: 
FirewallRules: [{CC0DEF34-6D8B-4BAD-9E22-99AB8167B6B1}] => (Allow) C:\asmdata\Servers\Server1\ShooterGame\Binaries\Win64\ShooterGameServer.exe => Brak pliku
FirewallRules: [{806765D2-5A89-48FB-A1EA-8E599FFE9F32}] => (Allow) C:\asmdata\Servers\Server1\ShooterGame\Binaries\Win64\ShooterGameServer.exe => Brak pliku
FirewallRules: [{48032F5F-83D4-44A0-B700-6708FE54A48F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Cycle\Prospect\Binaries\Win64\Prospect-Win64-Shipping.exe => Brak pliku
FirewallRules: [{7DE4AA94-A9B4-441A-A820-F79F6FC3FB4D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Cycle\Prospect\Binaries\Win64\Prospect-Win64-Shipping.exe => Brak pliku
FirewallRules: [{745679A8-4179-4EBE-BA76-C97CFA305D40}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Cycle\Prospect\Binaries\Win64\Prospect-Win64-Shipping.exe => Brak pliku
FirewallRules: [{3A1E2DB4-7B54-426C-84AD-24B1758AA707}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Cycle\Prospect\Binaries\Win64\Prospect-Win64-Shipping.exe => Brak pliku
EmptyTemp:
S1 CTIIO; \??\C:\WINDOWS\system32\drivers\CtiIo64.sys [X]
S3 HWiNFO_171; \??\C:\Users\Tomas\AppData\Local\Temp\HWiNFO64A_171.SYS [X] <==== UWAGA
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
END::

StandardProfile\AuthorizedApplications: [C:\Ross-Tech\VCDS-AKP\VCDSLoader.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [G:\Steam\Steam.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Lenovo\VeriFace\VerifyHost.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Garmin\Express\express.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\windows\SysWOW64\runonce.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\windows\SysWOW64\RunDll32.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Garmin\Express\CefSharp.BrowserSubprocess.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe] => Enabled:ipsec
StandardProfile\AuthorizedApplications: [C:\Windows\SysWOW64\Codecs\CodecUACManager.exe] => Enabled:ipsec

START::
HKU\S-1-5-21-3459599840-621481774-3675611063-1001\...\Run: [AMDNoiseSuppression] => "C:\Windows\system32\AMD\ANR\AMDNoiseSuppression.exe" (Brak pliku)
EmptyEventLogs: 
GroupPolicy: Ograniczenia ? <==== UWAGA
Policies: C:\ProgramData\NTUSER.pol: Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Edge: Ograniczenia <==== UWAGA
EmptyTemp:
END::

START::
S3 cpuz154; \??\C:\WINDOWS\temp\cpuz154\cpuz154_x64.sys [X]
S3 HWiNFO_164; \??\C:\Users\acb23\AppData\Local\Temp\HWiNFO64A_164.SYS [X] <==== UWAGA
S3 WinRing0_1_2_0; \??\C:\Users\acb23\AppData\Local\Temp\tmp5FA.tmp [X] <==== UWAGA
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
HKLM\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Program Files\Microsoft OneDrive\Update\OneDriveSetup.exe" (Brak pliku)
HKLM\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Program Files\Microsoft OneDrive\StandaloneUpdater\OneDriveSetup.exe" (Brak pliku)
Edge DefaultSuggestURL: Default -> hxxps://ss-sym.search.ask.com/ss?limit=10&li=ff&hl=pl&q={searchTerms}
FirewallRules: [{A1386BC7-CE14-4476-BF93-39938A239F66}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.185.895.0_x86__zpdnekdrzrea0\Spotify.exe => Brak pliku
FirewallRules: [{A57DA588-8887-46E4-B086-DEC0DF5A00A4}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.185.895.0_x86__zpdnekdrzrea0\Spotify.exe => Brak pliku
FirewallRules: [{D87EC4C0-0F55-43F1-A55F-9F9B97404E61}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.185.895.0_x86__zpdnekdrzrea0\Spotify.exe => Brak pliku
FirewallRules: [{26EAB317-9539-4A2D-9649-18C96D28B794}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.185.895.0_x86__zpdnekdrzrea0\Spotify.exe => Brak pliku
FirewallRules: [{948047A1-86E9-4ED1-95B9-8817B86A67E8}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.185.895.0_x86__zpdnekdrzrea0\Spotify.exe => Brak pliku
FirewallRules: [{E81B84A5-5795-4328-A16C-B7D7327EB864}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.185.895.0_x86__zpdnekdrzrea0\Spotify.exe => Brak pliku
FirewallRules: [{E3936A1B-DE72-48D3-A510-CA485597DD1D}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.185.895.0_x86__zpdnekdrzrea0\Spotify.exe => Brak pliku
FirewallRules: [{02B7EAF9-C402-4F33-9F51-3D2B488F7D17}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.185.895.0_x86__zpdnekdrzrea0\Spotify.exe => Brak pliku
EmptyEventLogs: 
EmptyTemp:
END::

START::
Task: {180989D7-F580-4FB4-8003-3150B157BAF6} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => "C:\WINDOWS\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs"
Task: {2652A120-620E-418C-8343-48DC3866FD9B} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\WINDOWS\System32\MbaeParserTask.exe (Brak pliku)
Task: {33A262D9-7BAF-418E-A529-EB82FA4D40AA} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => C:\WINDOWS\system32\MusNotification.exe /RunOnBattery ReadyToReboot (Brak pliku)
Task: {5B4B1A8A-445B-4D79-B76D-545BC288B5F7} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => C:\WINDOWS\system32\MusNotification.exe /RunOnAC ReadyToReboot (Brak pliku)
Task: {7AE536DA-FE8D-41C1-BE0A-336C20966CB7} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe --automatic (Brak pliku)
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => C:\WINDOWS\system32\MusNotification.exe (Brak pliku)
S1 nordlwf; \SystemRoot\system32\DRIVERS\nordlwf.sys [X]
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
EmptyTemp:
END::