CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-21-749702408-2515216661-2750082208-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-749702408-2515216661-2750082208-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hao.360.cn/?src=lm&ls=n4134a09b9b
HKU\S-1-5-21-749702408-2515216661-2750082208-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer17win10.msn.com/?pc=ACTE
HKU\S-1-5-21-749702408-2515216661-2750082208-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.lenovo.com
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
CHR HKLM-x32\...\Chrome\Extension: [gannpgaobkkhmpomoijebaigcapoeebl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pbjikboenpfhbbejgkoklgkhjpfogcam] - hxxps://clients2.google.com/service/update2/crx
S3 cpuz143; \??\C:\Windows\temp\cpuz143\cpuz143_x64.sys [X]
S3 NAVENG; \??\C:\Program Files (x86)\Norton Security\NortonData\22.8.0.50\Definitions\SDSDefs\20180208.002\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security\NortonData\22.8.0.50\Definitions\SDSDefs\20180208.002\EX64.SYS [X]
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> Brak pliku
Task: {6F8F62DD-4991-4FDF-858A-A2D22FC88F86} - System32\Tasks\App Explorer => C:\Users\K. Wieczór\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [2017-12-21] (SweetLabs, Inc) <==== UWAGA
Task: {E15364DB-A9EE-4397-BDBB-F858BAD87E40} - System32\Tasks\AmazonAssistantHelper => C:\ProgramData\OEM\Transactional\amazonx@hermes\AmazonX.exe [2017-08-02] ()
FF NewTabOverride: Mozilla\Firefox\Profiles\9g7sxept.default -> Disabled: nortonhomepage@symantec.com
FF Extension: (Amazon Assistant for Firefox) - C:\Users\K. Wieczór\AppData\Roaming\Mozilla\Firefox\Profiles\9g7sxept.default\Extensions\abb-acer@amazon.com [2018-02-08] [Przestarzałe]
EmptyTemp:
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}