Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-07-2020
Ran by Kalinow (administrator) on KALINOW-PC (23-07-2020 22:03:13)
Running from C:\Users\Kalinow\Downloads\frst
Loaded Profiles: Kalinow
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Angielski (Stany Zjednoczone)
Internet Explorer Version 11 (Default browser: "C:\PROGRAMY\Comodo\Dragon\dragon.exe" -- "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Systems, Incorporated -> Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Beijing Qihu Technology Co., Ltd. -> Qihoo 360 Technology Co. Ltd.) C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
(Beijing Qihu Technology Co., Ltd. -> Qihoo 360 Technology Co. Ltd.) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
(Beijing Qihu Technology Co., Ltd. -> Qihoo 360 Technology Co. Ltd.) C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
(Comodo Security Solutions -> Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(Even Balance, Inc. -> ) C:\Windows\SysWOW64\PnkBstrA.exe
(HUAWEI Technologies Co., Ltd. -> ) C:\ProgramData\DatacardService\HWDeviceService64.exe
(HUAWEI Technologies Co., Ltd. -> ) C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(HUAWEI Technologies Co., Ltd. -> Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Microsoft Corporation -> Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation -> Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <4>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\prevhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe <13>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe <2>
(Podatnik S.A. -> Podatnik S.A.) C:\Program Files (x86)\Podatnik.info\PIT pro 2019\pproupd.exe
(Podatnik S.A. -> Podatnik S.A.) C:\Program Files (x86)\Podatnik.info\PIT pro 2019\Widget.exe
(Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve -> Valve Corporation) C:\PROGRAMY\Steam\bin\cef\cef.win7x64\steamwebhelper.exe <7>
(Valve -> Valve Corporation) C:\PROGRAMY\Steam\steam.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [QHSafeTray] => C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe [1914720 2019-09-25] (Beijing Qihu Technology Co., Ltd. -> Qihoo 360 Technology Co. Ltd.)
HKLM-x32\...\Run: [WidgetPodatnikInfo] => C:\Program Files (x86)\Podatnik.info\PIT pro 2019\Widget.exe [263560 2020-04-03] (Podatnik S.A. -> Podatnik S.A.)
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\MountPoints2: H - "H:\X-Plane 11 Installer.exe"
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\MountPoints2: I - I:\LANLauncher.exe
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\MountPoints2: {08812525-fb79-11e5-8158-0026185a9105} - H:\AutoRun.exe
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\MountPoints2: {0881254c-fb79-11e5-8158-0026185a9105} - H:\AutoRun.exe
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\MountPoints2: {5c236cf5-8861-11e7-b039-0026185a9105} - H:\HiSuiteDownLoader.exe
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\MountPoints2: {80f6f1e1-b1e9-11e4-a954-0026185a9105} - "E:\X-Plane 11 Installer.exe"
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\MountPoints2: {a8511675-b2f6-11e6-b771-0026185a9105} - H:\autorun.exe
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\MountPoints2: {c25a620d-4c3c-11e5-80fb-0026185a9105} - G:\AutoRun.exe
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\MountPoints2: {c25a621b-4c3c-11e5-80fb-0026185a9105} - G:\AutoRun.exe
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\MountPoints2: {c25a6227-4c3c-11e5-80fb-0026185a9105} - G:\AutoRun.exe
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\MountPoints2: {c25a6232-4c3c-11e5-80fb-0026185a9105} - G:\AutoRun.exe
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\Winlogon: [Shell] C:\Windows\Explorer.exe [3231232 2016-04-09] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\Command Processor: @mode 15,1 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist "C:\Users\Kalinow\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" ( start /MIN "" "C:\Users\Kalinow\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== ATTENTION
HKLM\...\Windows x64\Print Processors\hpfpp70w: C:\Windows\System32\spool\prtprocs\x64\hpfpp70w.dll [249856 2009-04-16] (Microsoft Windows Hardware Compatibility Publisher -> Hewlett-Packard Corporation)
HKLM\...\Print\Monitors\hpf3l70w.dll: C:\Windows\system32\hpf3l70w.dll [136704 2009-04-16] (Microsoft Windows Hardware Compatibility Publisher -> Hewlett-Packard Company)
HKLM\...\Print\Monitors\Wondershare PDFelement Monitor: C:\Windows\system32\WSPDFelementMonitor.dll [271360 2017-10-19] (Wondershare Software) [File not signed]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{2D46B6DC-2207-486B-B523-A557E6D54B47}] -> C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\Installer\chrmstp.exe [2020-07-21] (Google LLC -> Google LLC)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{2D46B6DC-2207-486B-B523-A557E6D54B47}] -> C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> "C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
HKLM\Software\...\Authentication\Credential Providers: [{F8A0B131-5F68-486c-8040-7E8FC3C85BB6}] -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDCREDPROV.DLL [2012-07-17] (Microsoft Corporation -> Microsoft Corp.)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {01F45AE8-9484-4025-B905-A6A30D27AD53} - System32\Tasks\Informacja_PIT_Format_20_04 => C:\PIT Format 2018\pfp.exe [943272 2019-03-20] (FORMSOFT sp. z o.o. sp. k. -> BIS Format)
Task: {0B8F2690-5434-4578-9FDE-1B32E18D0214} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154440 2016-04-11] (Google Inc -> Google Inc.)
Task: {0B9B359F-7D0B-49F6-B221-14FE915FD5B2} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {11C6FCF3-22F9-4F7C-85BA-FA05753DCFC5} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\Overseer.exe [1660520 2020-02-27] (Avast Software s.r.o. -> Avast Software)
Task: {11E109A5-3E72-47FD-8DB0-66BE1D60CCBB} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfigAndContent
Task: {11E109A5-3E72-47FD-8DB0-66BE1D60CCBB} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [358400  [358400 2016-05-20]] (Microsoft Windows -> Microsoft Corporation)
Task: {147B9DF3-8F35-436B-AEDA-967386195AAE} - \{BF47A92B-74F2-D0A0-5B68-03A49340035B} -> No File <==== ATTENTION
Task: {2CC3A717-0D2E-491D-8A72-D089214FBF7B} - System32\Tasks\{163EB802-9352-48F0-BC88-57158CC0A978} => C:\Windows\system32\pcalua.exe -a E:\Install.exe -d E:\
Task: {36979D2F-8D0A-498A-AA85-02E1A1CF501E} - System32\Tasks\Mozilla\Firefox Default Browser Agent E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe [124112 2020-07-10] (Mozilla Corporation -> Mozilla Foundation)
Task: {3C9814E2-7582-445A-90EB-353AB9850251} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => Command(1): %windir%\system32\GWX\GWXUXWorker.exe -> /ScheduleUpgradeReminderTime
Task: {3C9814E2-7582-445A-90EB-353AB9850251} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [358400  [358400 2016-05-20]] (Microsoft Windows -> Microsoft Corporation)
Task: {3F0691BC-ACA1-403B-B456-34BFB379FC7F} - System32\Tasks\Informacja_PIT_Format_20_02 => C:\PIT Format 2018\pfp.exe [943272 2019-03-20] (FORMSOFT sp. z o.o. sp. k. -> BIS Format)
Task: {4178062C-B0C3-475D-974B-E7ED6F7FB5D9} - \{DCFA04BD-7185-473B-8F36-97B94A343619} -> No File <==== ATTENTION
Task: {6487FA7E-F22D-48BA-837B-B8F667CDD811} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154440 2016-04-11] (Google Inc -> Google Inc.)
Task: {6A124136-BA1C-4172-A008-83D0E5CFC0AD} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfig
Task: {6A124136-BA1C-4172-A008-83D0E5CFC0AD} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [358400  [358400 2016-05-20]] (Microsoft Windows -> Microsoft Corporation)
Task: {912D4439-0D48-4DB2-A427-7BBAE694DE20} - System32\Tasks\Informacja_PIT_Format_20_01 => C:\PIT Format 2018\pfp.exe [943272 2019-03-20] (FORMSOFT sp. z o.o. sp. k. -> BIS Format)
Task: {94046E01-3A09-49FB-AAC2-76016B31C5EB} - \LuckyBrowse -> No File <==== ATTENTION
Task: {A323D010-9223-48F3-8918-3E4E4D5DAB3D} - System32\Tasks\e-pity2016a_styczen => C:\Program Files (x86)\e-file\e-pity\Assets\signxml.exe [1215456 2017-04-13] (e-file sp. z o.o. -> e-file sp. z o.o. sp. k.)
Task: {B51904D5-6A8A-461B-AB14-65FA7E0D12C6} - \{06AAEFFA-FC6F-A5AC-57C2-3DA9E0D2DC39} -> No File <==== ATTENTION
Task: {D51DA723-8C7A-45F3-A90E-18757CA75984} - System32\Tasks\Opera scheduled Autoupdate 1423689122 => C:\Program Files (x86)\Opera\launcher.exe [975656 2017-12-18] (Opera Software AS -> Opera Software)
Task: {DA7AF94C-C27E-44F7-9B7C-14F097924FC4} - System32\Tasks\e-pity2016a_kwiecien => C:\Program Files (x86)\e-file\e-pity\Assets\signxml.exe [1215456 2017-04-13] (e-file sp. z o.o. -> e-file sp. z o.o. sp. k.)
Task: {E45E841C-8E62-48B0-A325-576A43FB908B} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfig
Task: {E45E841C-8E62-48B0-A325-576A43FB908B} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(2): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshContent
Task: {E45E841C-8E62-48B0-A325-576A43FB908B} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(3): C:\Windows\system32\GWX\GWXDetector.exe [358400  [358400 2016-05-20]] (Microsoft Windows -> Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 07 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145648 2012-07-17] (Microsoft Corporation -> Microsoft Corp.)
Winsock: Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145648 2012-07-17] (Microsoft Corporation -> Microsoft Corp.)
Winsock: Catalog5-x64 07 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171760 2012-07-17] (Microsoft Corporation -> Microsoft Corp.)
Winsock: Catalog5-x64 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171760 2012-07-17] (Microsoft Corporation -> Microsoft Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{2DDB85C7-67B9-4450-BE09-D884BA535926}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{659505AC-AB5F-4811-8ECC-AF86A5F4A4FD}: [NameServer] 194.204.159.1 194.204.152.34
Tcpip\..\Interfaces\{659505AC-AB5F-4811-8ECC-AF86A5F4A4FD}: [DhcpNameServer] 194.204.159.1 194.204.152.34
Tcpip\..\Interfaces\{68661B24-388F-4458-B4E8-EC9A2B34E832}: [NameServer] 194.204.159.1 194.204.152.34
Tcpip\..\Interfaces\{E88EC137-2C15-4967-912E-8AF1F1CBB020}: [NameServer] 194.204.159.1 194.204.152.34

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131248158055214727&GUID=00000000-0000-0000-0000-000000000000
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131248158105377596&GUID=00000000-0000-0000-0000-000000000000
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.key-find.com/web/?type=dspp&ts=1423688905&from=cor&uid=HitachiXHDT721010SLA360_STF607MS032JHK032JHKX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://v9.com/?type=hp&ts=1450263622&from=mych123&uid=hitachixhdt721010sla360_stf607ms032jhk032jhkx&z=7109365c2671bba66a5ec10gaz8w6efo0q4c9q2o5c
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.key-find.com/web/?type=dspp&ts=1423688905&from=cor&uid=HitachiXHDT721010SLA360_STF607MS032JHK032JHKX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131248158105417599&GUID=00000000-0000-0000-0000-000000000000
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://v9.com/?type=hp&ts=1450263622&from=mych123&uid=hitachixhdt721010sla360_stf607ms032jhk032jhkx&z=7109365c2671bba66a5ec10gaz8w6efo0q4c9q2o5c
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131248158105437600&GUID=00000000-0000-0000-0000-000000000000
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://v9.com/?type=hp&ts=1450263622&from=mych123&uid=hitachixhdt721010sla360_stf607ms032jhk032jhkx&z=7109365c2671bba66a5ec10gaz8w6efo0q4c9q2o5c
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131248158105447600&GUID=00000000-0000-0000-0000-000000000000
SearchScopes: HKLM -> OldSearch URL = hxxp://www.key-find.com/web/?type=dspp&ts=1423688905&from=cor&uid=HitachiXHDT721010SLA360_STF607MS032JHK032JHKX&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfVoPBw5GEwAXbVtbBQlcFVcReBQBBV8QDARCJQ0PBF9HGFETcB9aFQQTSEcFME0FCFwEURNNfWlXElAFSENGBlBWBUo=&q={searchTerms}
SearchScopes: HKLM -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.key-find.com/web/?type=dspp&ts=1423688905&from=cor&uid=HitachiXHDT721010SLA360_STF607MS032JHK032JHKX&q={searchTerms}
SearchScopes: HKLM-x32 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://v9.com/web?type=ds&ts=1450263622&from=zzgbkk123&uid=hitachixhdt721010sla360_stf607ms032jhk032jhkx&z=7109365c2671bba66a5ec10gaz8w6efo0q4c9q2o5c&q={searchTerms}
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-1089871727-2613707379-2673470617-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-1089871727-2613707379-2673470617-1001 -> OldSearch URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1089871727-2613707379-2673470617-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1089871727-2613707379-2673470617-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfVoPBw5GEwAXbVtbBQlcFVcReBQBBV8QDARCJQ0PBF9HGFETcB9aFQQTSEcFME0FCFwEURNNfWlXElAFSENGBlBWBUo=&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1089871727-2613707379-2673470617-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfVoPBw5GEwAXbVtbBQlcFVcReBQBBV8QDARCJQ0PBF9HGFETcB9aFQQTSEcFME0FCFwEURNNfWlXElAFSENGBlBWBUo=&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1089871727-2613707379-2673470617-1001 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://v9.com/web?type=ds&ts=1450263622&from=zzgbkk123&uid=hitachixhdt721010sla360_stf607ms032jhk032jhkx&z=7109365c2671bba66a5ec10gaz8w6efo0q4c9q2o5c&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1089871727-2613707379-2673470617-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1089871727-2613707379-2673470617-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
BHO: Expressivo -> {85F685C3-20D9-4943-95E4-EB4224056C3F} -> C:\Program Files (x86)\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer_x64.dll => No File
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corporation -> Microsoft Corp.)
BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\360\Total Security\safemon\safemon64.dll [2019-03-06] (QIHU 360 SOFTWARE CO. LIMITED -> Qihu 360 Software Co., Ltd.)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22] (Hewlett-Packard Company -> Hewlett-Packard Co.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_181\bin\ssv.dll [2018-08-03] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Expressivo -> {85F685C3-20D9-4943-95E4-EB4224056C3F} -> C:\Program Files (x86)\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer.dll => No File
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corporation -> Microsoft Corp.)
BHO-x32: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\360\Total Security\safemon\safemon.dll [2019-03-06] (Qihoo 360 Software (Beijing) Company Limited -> Qihu 360 Software Co., Ltd.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_181\bin\jp2ssv.dll [2018-08-03] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22] (Hewlett-Packard Company -> Hewlett-Packard Co.)
Toolbar: HKLM - Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files (x86)\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer_x64.dll No File
Toolbar: HKLM-x32 - Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files (x86)\ivo\Expressivo\integr\ih-iexplorer\IH_iexplorer.dll No File
StartMenuInternet: IEXPLORE.EXE - c:\program files\internet explorer\iexplore.exe hxxp://www.yoursearching.com/?type=sc&ts=1456513507&z=864d3c9036b5bf85157f4ebg0z5w6q4w3geccw2e6m&from=face&uid=HitachiXHDT721010SLA360_STF607MS032JHK032JHKX

FireFox:
========
FF DefaultProfile: 9smkhkar.default
FF DefaultProfile: kww6x2m2.default
FF ProfilePath: C:\Users\Kalinow\AppData\Roaming\Mozilla\Firefox\Profiles\9smkhkar.default [2020-07-23]
FF Notifications: Mozilla\Firefox\Profiles\9smkhkar.default -> hxxps://www.meczyki.pl
FF ProfilePath: C:\Users\Kalinow\AppData\Roaming\Comodo\IceDragon\Profiles\kww6x2m2.default [2019-08-28]
FF Homepage: Comodo\IceDragon\Profiles\kww6x2m2.default -> hxxps://www.google.com/
FF NetworkProxy: Comodo\IceDragon\Profiles\kww6x2m2.default -> autoconfig_url", "data:text/javascript,%2F*windscribe*%2Ffunction%20FindProxyForURL(url%2C%20host)%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20if%20(isPlainHostName(host)%20%7C%7C%20%20shExpMatch(host%2C%20%22*.local%22)%20%7C%7C%20shExpMatch(host%2C%20%22*.int%22)%20%7C%7C%20shExpMatch(url%2C%20%22*%3A%2F%2Fapi.windscribe.com%2F*%22))%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20return%20%22DIRECT%22%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20var%20lanIps%20%3D%20%2F(%5E127.)%7C(%5E192.168.)%7C(%5E10.)%7C(%5E172.1%5B6-9%5D.)%7C(%5E172.2%5B0-9%5D.)%7C(%5E172.3%5B0-1%5D.)%2F%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20if(lanIps.test(host))%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20return%20%22DIRECT%22%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20if%20(url.substring(0%2C%205)%20%3D%3D%20'http%3A'%20%7C%7C%20url.substring(0%2C%206)%20%3D%3D%20'https%3A'%20%7C%7C%20url.substring(0%2C%204)%20%3D%3D%20'ftp%3A'%20%7C%7C%20url.substring(0%2C%203)%20%3D%3D%20'ws%3A')%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20return%20%22HTTPS%20ext-start.windscribe.com%22%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20return%20'DIRECT'%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D"
FF Extension: (Windscribe) - C:\Users\Kalinow\AppData\Roaming\Comodo\IceDragon\Profiles\kww6x2m2.default\Extensions\@windscribeff.xpi [2017-12-19] [Legacy]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: (HP Smart Web Printing) - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2015-06-26] [Legacy] [not signed]
FF HKU\S-1-5-21-1089871727-2613707379-2673470617-1001\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_32_0_0_321.dll [2020-01-22] (Adobe Inc. -> )
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2015-02-09] (Tracker Software Products (Canada) Ltd -> Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2015-02-09] (Tracker Software Products (Canada) Ltd -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_321.dll [2020-01-22] (Adobe Inc. -> )
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-02-09] (Tracker Software Products (Canada) Ltd -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @java.com/DTPlugin,version=11.181.2 -> C:\Program Files (x86)\Java\jre1.8.0_181\bin\dtplugin\npDeployJava1.dll [2018-08-03] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.181.2 -> C:\Program Files (x86)\Java\jre1.8.0_181\bin\plugin2\npjp2.dll [2018-08-03] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2015-02-09] (Tracker Software Products (Canada) Ltd -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems, Incorporated -> Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1089871727-2613707379-2673470617-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Kalinow\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2016-03-11] (Unity Technologies SF -> Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-1089871727-2613707379-2673470617-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2017-10-23] (Ubisoft Entertainment Sweden AB -> )

Chrome: 
=======
CHR Profile: C:\Users\Kalinow\AppData\Local\Google\Chrome\User Data\Default [2020-07-23]
CHR Extension: (Dokumenty Google) - C:\Users\Kalinow\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-04-16]
CHR Extension: (Tampermonkey) - C:\Users\Kalinow\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2018-08-16]
CHR Extension: (360 Internet Protection) - C:\Users\Kalinow\AppData\Local\Google\Chrome\User Data\Default\Extensions\glcimepnljoholdmjchkloafkggfoijh [2017-01-25]
CHR Extension: (ScriptMonkey) - C:\Users\Kalinow\AppData\Local\Google\Chrome\User Data\Default\Extensions\lblbnlfhhblmfconjalikamamlgoobbe [2018-08-16]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Kalinow\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-25]
CHR Extension: (e-pity - dodatek) - C:\Users\Kalinow\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofoeigeaodhbjogdigckajfhjbonaofg [2017-06-01]
CHR Extension: (Chrome Media Router) - C:\Users\Kalinow\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-25]
CHR HKLM-x32\...\Chrome\Extension: [glcimepnljoholdmjchkloafkggfoijh]
CHR HKLM-x32\...\Chrome\Extension: [ofoeigeaodhbjogdigckajfhjbonaofg]

Opera: 
=======
OPR Extension: (AdBlock) - C:\Users\Kalinow\AppData\Roaming\Opera Software\Opera Stable\Extensions\aobdicepooefnbaeokijohmhjlleamfj [2016-05-19]
OPR Extension: (Szafir SDK Web) - C:\Users\Kalinow\AppData\Roaming\Opera Software\Opera Stable\Extensions\bikmiknjdohdfmehchjpbiemekemgndp [2018-08-03]
OPR Extension: (Tampermonkey) - C:\Users\Kalinow\AppData\Roaming\Opera Software\Opera Stable\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2019-04-01]
OPR Extension: (Positive Finds) - C:\Users\Kalinow\AppData\Roaming\Opera Software\Opera Stable\Extensions\egapfbaioaiglchfcnppigfgflndcejn [2016-04-02]
OPR Extension: (ScriptMonkey) - C:\Users\Kalinow\AppData\Roaming\Opera Software\Opera Stable\Extensions\lblbnlfhhblmfconjalikamamlgoobbe [2018-08-16]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [238080 2013-04-30] (Microsoft Windows Hardware Compatibility Publisher -> AMD)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [8469592 2020-03-08] (BattlEye Innovations e.K. -> )
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2016-04-25] (BitRaider LLC -> BitRaider, LLC)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2060848 2016-02-05] (Comodo Security Solutions -> Comodo)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] (HUAWEI Technologies Co., Ltd. -> )
S3 IceDragonUpdater; C:\Program Files (x86)\Comodo\IceDragon\icedragon_updater.exe [1985688 2016-04-05] (Comodo Security Solutions -> )
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [655744 2012-06-28] (HUAWEI Technologies Co., Ltd. -> )
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2466608 2019-11-19] (Electronic Arts, Inc. -> Electronic Arts)
S2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3344176 2019-11-19] (Electronic Arts, Inc. -> Electronic Arts)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2016-12-29] (Even Balance, Inc. -> )
R2 pproupd; C:\Program Files (x86)\Podatnik.info\PIT pro 2019\pproupd.exe [57736 2020-04-03] (Podatnik S.A. -> Podatnik S.A.)
R2 QHActiveDefense; C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe [961888 2019-09-20] (Beijing Qihu Technology Co., Ltd. -> Qihoo 360 Technology Co. Ltd.)
S3 Rockstar Service; C:\Program Files\Rockstar Games\Launcher\RockstarService.exe [1705088 2020-05-12] (Rockstar Games, Inc. -> Rockstar Games)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [752224 2017-01-16] (Samsung Electronics CO., LTD. -> DEVGURU Co., LTD.)
S2 SwOffScheduler; C:\Program Files\Airytec\Switch Off\swoff.exe [173056 2014-09-23] (Airytec) [File not signed]
S2 SwOffWeb; C:\Program Files\Airytec\Switch Off\swoff.exe [173056 2014-09-23] (Airytec) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Windows -> Microsoft Corporation)
R2 wlidsvc; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2292480 2012-07-17] (Microsoft Corporation -> Microsoft Corp.)
S2 browserServer_2015.11.03.12.05.41; C:\Program Files (x86)\ghokswa Browser\ghokswa\bin\browserServer.exe [X]
S2 MapcarP; "C:\ProgramData\Mapcar\Mapcar.exe" [X]
S2 MapcarU; "C:\Program Files (x86)\Mapcar\Update\MapcarUpdate.exe" [X]

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [190384 2019-06-13] (Beijing Qihu Technology Co., Ltd. -> 360.cn)
S3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [86248 2019-03-06] (Qihoo 360 Software (Beijing) Company Limited -> 360.cn)
S3 360AvFlt; C:\Windows\SysWOW64\DRIVERS\360AvFlt.sys [86248 2019-03-06] (Qihoo 360 Software (Beijing) Company Limited -> 360.cn)
R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [335280 2019-06-27] (Beijing Qihu Technology Co., Ltd. -> 360.cn)
S3 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [49088 2017-05-17] (Qihoo 360 Software (Beijing) Company Limited -> 360.cn)
R1 360FsFlt; C:\Windows\System32\DRIVERS\360FsFlt.sys [454208 2019-03-06] (Beijing Qihu Technology Co., Ltd. -> 360.cn)
R1 360netmon; C:\Windows\System32\DRIVERS\360netmon.sys [87672 2018-01-12] (Qihoo 360 Software (Beijing) Company Limited -> 360.cn)
S3 amdkmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [11922944 2013-04-30] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
S3 amdkmdap; C:\Windows\System32\DRIVERS\atikmpag.sys [359936 2013-04-30] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW76.sys [94720 2013-12-19] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices)
R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [217520 2019-06-05] (Beijing Qihu Technology Co., Ltd. -> 360.cn)
S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2016-04-25] (BitRaider -> BitRaider)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [131712 2017-01-16] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2015-02-11] (Disc Soft Ltd -> Disc Soft Ltd)
S3 ew_hwusbdev; C:\Windows\System32\DRIVERS\ew_hwusbdev.sys [117248 2010-07-27] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 ew_usbenumfilter; C:\Windows\System32\DRIVERS\ew_usbenumfilter.sys [13952 2010-03-20] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
R3 hidkmdf; C:\Windows\System32\DRIVERS\hidkmdf.sys [26192 2016-12-07] (SteelSeries ApS -> Windows (R) Win 7 DDK provider)
S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [104960 2012-08-20] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
R3 huawei_enumerator; C:\Windows\System32\DRIVERS\ew_jubusenum.sys [90112 2012-08-20] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [30720 2012-08-20] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [239104 2012-09-18] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 MotioninJoyXFilter; C:\Windows\System32\DRIVERS\MijXfilt.sys [121416 2012-05-12] (Shenzhen Saikeware Technology Co., Ltd. -> MotioninJoy)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] (Microsoft Windows Hardware Compatibility Publisher -> )
R3 ssdevfactory; C:\Windows\System32\DRIVERS\ssdevfactory.sys [41816 2016-11-03] (SteelSeries ApS -> SteelSeries ApS)
R3 sshid; C:\Windows\System32\DRIVERS\sshid.sys [52960 2016-12-07] (SteelSeries ApS -> SteelSeries ApS)
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [165504 2017-01-16] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 ss_conn_usb_driver; C:\Windows\System32\Drivers\ss_conn_usb_driver.sys [43648 2017-01-16] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 StkCMini; C:\Windows\System32\Drivers\StkCMini.sys [1816968 2010-04-16] (Syntek Semiconductor Co., Ltd. -> Syntek)
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2012-10-11] (Microsoft Corporation) [File not signed]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Windows -> Microsoft Corporation)
S1 MPCKpt; system32\DRIVERS\MPCKpt.sys [X] <==== ATTENTION
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ===================

(If an entry is included in the fixlist, the file/folder will be moved.)

2020-07-23 21:43 - 2020-07-23 22:03 - 000000000 ____D C:\FRST
2020-07-23 21:33 - 2020-07-23 22:03 - 000000000 ____D C:\Users\Kalinow\Downloads\frst
2020-07-23 21:32 - 2020-07-23 21:32 - 000000000 ____D C:\Users\Kalinow\Downloads\FRST-OlderVersion
2020-07-23 21:20 - 2009-07-14 06:49 - 000000262 _____ C:\Users\Kalinow\Desktop\Run.lnk
2020-07-23 20:38 - 2020-07-23 20:38 - 000000000 ____D C:\Windows\CheckSur
2020-07-23 20:31 - 2020-07-23 20:33 - 564744309 _____ C:\Users\Kalinow\Downloads\Windows6.1-KB947821-v34-x64.msu
2020-07-23 20:11 - 2020-07-23 20:24 - 000000000 ____D C:\Users\Kalinow\Documents\ATSMP
2020-07-23 20:05 - 2020-07-23 20:11 - 000000000 ____D C:\ProgramData\TruckersMP
2020-07-23 20:04 - 2020-07-23 20:04 - 000000889 _____ C:\Users\Public\Desktop\TruckersMP.lnk
2020-07-23 20:04 - 2020-07-23 20:04 - 000000889 _____ C:\ProgramData\Desktop\TruckersMP.lnk
2020-07-23 20:04 - 2020-07-23 20:04 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TruckersMP Launcher
2020-07-23 20:04 - 2020-07-23 20:04 - 000000000 ____D C:\Program Files\TruckersMP Launcher
2020-07-23 19:59 - 2020-07-23 19:59 - 000667351 _____ C:\Users\Kalinow\Downloads\launcher_1004.zip
2020-07-23 17:15 - 2020-07-23 17:15 - 000000211 _____ C:\Users\Kalinow\Desktop\American Truck Simulator.url
2020-07-23 17:14 - 2020-07-23 17:15 - 000000000 ____D C:\Users\Kalinow\Desktop\Zapisy AMERICAN TRUCk SYMULATOR
2020-07-14 12:09 - 2020-07-14 12:09 - 000011475 _____ C:\Users\Kalinow\Downloads\0190163-FV_0721324_2020_OPER_WARC.pdf
2020-07-14 12:08 - 2020-07-14 12:08 - 000110109 _____ C:\Users\Kalinow\Downloads\Z_21744_06_20.pdf
2020-07-14 12:05 - 2020-07-14 12:05 - 000701965 _____ C:\Users\Kalinow\Downloads\87834391_202007.pdf
2020-07-14 12:04 - 2020-07-14 12:04 - 000275810 _____ C:\Users\Kalinow\Downloads\O01_Faktura_zbiorowa_000-048-2774-3363_20_07_F007_U2007031114152557408.pdf
2020-07-14 12:03 - 2020-07-14 12:03 - 000315563 _____ C:\Users\Kalinow\Downloads\FAKTURA-P-8013316-20060650181690-00020392.pdf
2020-07-10 11:01 - 2020-07-10 11:01 - 000000000 ____D C:\Windows\system32\Tasks\Mozilla
2020-07-10 00:27 - 2020-07-10 12:33 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2020-06-25 16:52 - 2020-06-25 16:52 - 000123861 _____ C:\Users\Kalinow\Downloads\semer_fa_2020____462_w.pdf
2020-06-25 16:50 - 2020-06-25 16:50 - 000103019 _____ C:\Users\Kalinow\Downloads\Faktura VAT SP-BI238140620.pdf

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2020-07-23 21:57 - 2016-11-02 11:28 - 000000000 ____D C:\Users\Kalinow\AppData\LocalLow\360WD
2020-07-23 21:54 - 2009-07-14 06:45 - 000026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2020-07-23 21:54 - 2009-07-14 06:45 - 000026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2020-07-23 21:51 - 2017-03-09 02:08 - 000000000 ____D C:\Users\Kalinow\AppData\LocalLow\Mozilla
2020-07-23 21:50 - 2018-07-13 19:02 - 000000000 ____D C:\Users\Kalinow\Documents\American Truck Simulator
2020-07-23 21:46 - 2019-12-12 18:04 - 000000000 ____D C:\ProgramData\NVIDIA
2020-07-23 21:46 - 2015-10-25 15:00 - 000843264 ___SH C:\Users\Kalinow\Desktop\Thumbs.db
2020-07-23 21:46 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2020-07-23 21:38 - 2015-05-11 23:34 - 000000008 __RSH C:\ProgramData\ntuser.pol
2020-07-23 21:37 - 2019-04-11 09:08 - 000000000 ____D C:\Users\Kalinow\AppData\LocalLow\Temp
2020-07-23 21:34 - 2009-07-14 05:20 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2020-07-23 21:34 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\SysWOW64\GroupPolicy
2020-07-23 16:21 - 2017-09-21 16:40 - 000000000 ____D C:\Users\Kalinow\Documents\Euro Truck Simulator 2
2020-07-22 02:05 - 2019-01-24 23:28 - 000000000 ____D C:\Users\Kalinow\AppData\Roaming\Discord
2020-07-21 11:58 - 2015-02-11 19:28 - 000000000 ____D C:\Users\Kalinow\AppData\Roaming\uTorrent
2020-07-21 10:27 - 2009-07-14 07:08 - 000032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2020-07-20 15:19 - 2015-05-04 12:00 - 000000000 ___RD C:\Users\Kalinow\Desktop\seriale
2020-07-16 00:56 - 2016-11-02 11:28 - 000000000 ____D C:\ProgramData\360safe
2020-07-14 13:17 - 2019-06-04 20:53 - 000003586 _____ C:\Program Files (x86)\Session.conf
2020-07-14 13:16 - 2019-11-29 18:56 - 000000347 _____ C:\Program Files (x86)\RF4Launcher.conf
2020-07-14 13:16 - 2019-06-04 20:53 - 000000000 ____D C:\Program Files (x86)\Game
2020-07-14 13:11 - 2019-06-04 19:39 - 000000000 ____D C:\Program Files (x86)\Update
2020-07-10 12:33 - 2016-04-18 18:05 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2020-07-02 11:38 - 2016-04-29 12:12 - 000000000 ____D C:\PIT Format 2015
2020-06-30 13:53 - 2019-03-03 17:32 - 000000660 _____ C:\Users\Kalinow\Desktop\antcenter.txt
2020-06-23 17:15 - 2016-03-17 23:32 - 000000000 ____D C:\Users\Kalinow\Desktop\telefon

==================== Files in the root of some directories ========

2015-11-27 11:26 - 2016-02-28 13:29 - 000000074 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2019-06-04 19:38 - 2018-11-16 19:16 - 001274368 _____ (The OpenSSL Project, http://www.openssl.org/) C:\Program Files (x86)\libeay32.dll
2019-06-04 19:38 - 2020-07-14 13:17 - 000037659 _____ () C:\Program Files (x86)\log.txt
2019-06-04 19:38 - 2020-07-10 13:55 - 000609547 _____ () C:\Program Files (x86)\log_prev.txt
2019-06-04 19:38 - 2019-02-25 17:54 - 004892160 _____ (The Qt Company Ltd.) C:\Program Files (x86)\Qt5Core.dll
2019-06-04 19:38 - 2018-11-26 12:18 - 005198336 _____ (The Qt Company Ltd.) C:\Program Files (x86)\Qt5Gui.dll
2019-06-04 19:38 - 2018-11-26 12:18 - 000984576 _____ (The Qt Company Ltd.) C:\Program Files (x86)\Qt5Network.dll
2019-06-04 19:38 - 2018-11-26 12:22 - 004429312 _____ (The Qt Company Ltd.) C:\Program Files (x86)\Qt5Widgets.dll
2019-06-04 19:38 - 2018-11-26 15:48 - 000233984 _____ (The Qt Company Ltd.) C:\Program Files (x86)\Qt5WinExtras.dll
2019-11-29 18:56 - 2020-07-14 13:16 - 000000347 _____ () C:\Program Files (x86)\RF4Launcher.conf
2019-06-04 19:38 - 2019-11-29 12:38 - 005687960 _____ (Russian Fishing LLC) C:\Program Files (x86)\RF4Launcher.exe
2019-06-04 20:53 - 2020-07-14 13:17 - 000003586 _____ () C:\Program Files (x86)\Session.conf
2019-06-04 19:38 - 2018-11-16 19:16 - 000279040 _____ (The OpenSSL Project, http://www.openssl.org/) C:\Program Files (x86)\ssleay32.dll
2020-02-03 23:19 - 2018-12-01 10:07 - 000000437 _____ () C:\Program Files (x86)\update-fifa19.bat
2018-01-16 14:28 - 2015-08-16 20:52 - 000000431 _____ () C:\Program Files (x86)\update-LifeIsStrange.bat
2018-01-16 14:28 - 2013-10-13 07:47 - 000000732 _____ () C:\Program Files (x86)\visit-www.nosteam.ro.html
2009-07-14 03:14 - 2009-07-14 03:14 - 000073216 ____N (Microsoft Corporation) C:\Program Files (x86)\Common Files\CYPqYinCiOOOK.exe
2015-05-19 22:01 - 2015-08-01 23:05 - 000000024 _____ () C:\Users\Kalinow\AppData\Roaming\appdataFr25.bin
2017-01-12 14:25 - 2017-01-30 20:38 - 000000052 _____ () C:\Users\Kalinow\AppData\Roaming\die.bat
2016-02-11 15:15 - 2018-11-03 14:10 - 000000058 _____ () C:\Users\Kalinow\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2018-08-16 14:05 - 2018-08-16 14:05 - 000000002 _____ () C:\Users\Kalinow\AppData\Local\imw.ini
2016-08-22 20:39 - 2016-08-22 20:39 - 000000000 ___SH () C:\Users\Kalinow\AppData\Local\LumaEmu
2017-04-28 17:42 - 2017-04-28 17:42 - 000003556 _____ () C:\Users\Kalinow\AppData\Local\recently-used.xbel
2016-11-16 14:06 - 2019-11-27 20:06 - 000007597 _____ () C:\Users\Kalinow\AppData\Local\Resmon.ResmonCfg
2020-02-01 16:50 - 2020-02-01 17:01 - 000000093 _____ () C:\Users\Kalinow\AppData\Local\X-Plane 11 Preferences.prf
2020-04-11 16:31 - 2020-04-11 16:31 - 000000037 _____ () C:\Users\Kalinow\AppData\Local\X-Plane Installer.prf
2020-02-01 16:50 - 2020-02-01 17:15 - 000000015 _____ () C:\Users\Kalinow\AppData\Local\X-Plane_drm_11.prf
2020-02-01 16:50 - 2020-02-01 16:50 - 000000065 _____ () C:\Users\Kalinow\AppData\Local\x-plane_install_11.txt

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)



ATTENTION: ==> Could not access BCD.  -> 0

LastRegBack: 2020-07-17 01:34
==================== End of FRST.txt ========================