CloseProcesses:
CreateRestorePoint:
EmptyTemp:
VirusTotal: C:\Program Files (x86)\LKvaHIuaGFsrl.exe
VirusTotal: C:\Program Files (x86)\mpOE.exe
VirusTotal: C:\Users\norbi\AppData\Roaming\cexplorer.exe
VirusTotal: C:\Users\norbi\AppData\Local\Kaykix.exe
HKU\S-1-5-21-1127345323-2592640102-239408248-1001\...\MountPoints2: {31f92ed6-6e49-11e8-a5ea-9822ef706bbe} - "D:\SISetup.exe" 
GroupPolicy: Ograniczenia - Chrome <==== UWAGA
Tcpip\..\Interfaces\{2fa46e70-352c-4210-b3e6-52dd18a8fd10}: [NameServer] 62.179.1.62,62.179.1.63
Tcpip\..\Interfaces\{7e0fc2c7-a2fb-4ec8-873f-697f8f5763c7}: [DhcpNameServer] 192.168.0.1 192.168.0.2
SearchScopes: HKU\S-1-5-21-1127345323-2592640102-239408248-1001 -> DefaultScope {93723AF5-3686-4284-8D3D-F0062176FB1E} URL = 
FF NewTab: Mozilla\Firefox\Profiles\cuq6ogzb.default -> C:\\ProgramData\\Quoteexs\\ff.NT
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [X]
2018-07-16 19:38 - 2018-07-16 19:38 - 000000008 __RSH C:\Users\norbi\ntuser.pol
2018-07-16 19:37 - 2018-07-16 19:37 - 000000008 __RSH C:\Users\Administrator\ntuser.pol
2018-07-16 19:31 - 2018-07-16 19:31 - 000000008 __RSH C:\ProgramData\ntuser.pol
2018-04-12 01:34 - 2018-04-12 01:34 - 000059904 ____N (Microsoft Corporation) C:\Program Files (x86)\LKvaHIuaGFsrl.exe
2018-04-12 01:34 - 2018-04-12 01:34 - 000178688 ____N (Microsoft Corporation) C:\Program Files (x86)\mpOE.exe
2018-03-26 14:57 - 2018-03-26 14:00 - 006860752 _____ (NeoSoft Tools                                               ) C:\Users\norbi\AppData\Roaming\cexplorer.exe
2018-04-17 10:16 - 2018-04-17 10:16 - 001814528 _____ (TODO: <Company name>) C:\Users\norbi\AppData\Local\Kaykix.exe
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> Brak pliku
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> Brak pliku
Task: {0427CE24-7173-4F22-B9C8-594852EE0F46} - System32\Tasks\{B65EBFA6-2BB3-6D01-9B2F-26994F19324F} => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://kotcatk.com/cl/?guid=4qwzsm6x0iwfo3nuixgzm3kw6mx0m52g&prid=1&pid=4_1324_0
Task: {241F8DAA-98C5-40D4-B9A5-5B630021E37E} - System32\Tasks\{550D103A-F658-75DB-46DF-D5DF4C97A13E} => C:\Program Files (x86)\LKvaHIuaGFsrl.exe [2018-04-12] (Microsoft Corporation) <==== UWAGA
Task: {D635FC26-D720-42D9-9244-407A72818605} - \Optimize Thumbnail Cache Files -> Brak pliku <==== UWAGA
Task: {F970549A-A7E8-41A3-A3B8-DE2FB3776D2F} - \InstallShield® Update Service Scheduler -> Brak pliku <==== UWAGA
AlternateDataStreams: C:\Users\Public\AppData:CSM [442]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [482]
FirewallRules: [{4850792C-E096-42E6-847D-8A6962FB72D0}] => (Allow) C:\WINDOWS\SouAUHbxIaS.exe
FirewallRules: [{F00891FE-2B58-4F94-A882-F4530F492FA4}] => (Allow) C:\Program Files (x86)\LKvaHIuaGFsrl.exe
FirewallRules: [{8EF0E004-0459-4E62-BEE7-2379127E0A56}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{353B1DDE-6AA1-4C5F-BA03-5CC2DB219E1A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1D9A8F74-199F-46C3-B975-E9BE37E6550D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{80A5F7E4-0479-420A-8B35-87D6B3D69839}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{9C6D43F2-E42C-4F38-8043-DE597BEAD688}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{5E55B06E-3322-4EE6-9A73-82EF7BCD18E5}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{63B7883C-4AC3-4C7F-8F87-AB74EF38A76A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D46E3C0B-42D8-4EA4-8410-8EF0C089603A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{EB61FBEC-9773-4AD7-9B10-102D883EDDD9}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{3246921C-EF87-422C-A72E-05737DDB156E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{FFB58663-2FF6-4FEE-91AD-EF6B9A874EB5}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{B3D6ADD2-DBCE-4569-AA7B-91C3666790CB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{CC7538E7-4B1C-48E1-AA15-383E1B78F0A5}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{CC99CE33-0C0A-48E9-B553-3B03088011D9}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{ED4172DD-69C4-4807-9103-1C5E2ECADCF7}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F06DC41B-2591-4F1E-AA83-189319F8F864}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{0629BE34-0D43-4811-A4C3-9DB240C00FAC}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{B6ACCBD2-EBFF-4949-B143-72624E6FECC2}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{FB61D9AD-161C-467D-8158-D97A3E26C586}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{6D39C980-91AC-437E-BB67-41A9E6FFA0BA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{600875FF-454C-4655-8275-399D56C03509}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{0B6400E7-63D3-4971-A437-C7B13B1FEC59}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{AB749D88-724B-4D47-B5A9-AFDC6EEB2204}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{69537C68-5BF8-4D93-BE71-DDA0187C57DA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C63A934A-7F24-471A-807D-952122A21DC8}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1D6F702E-8AFE-40E5-BDCB-B907EFE98325}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{E07C8AC0-0CC8-4C92-BC30-D9A914BF7FB9}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{EBDB3934-1E2D-4963-A787-9E723265D09C}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FilesInDirectory: C:\Users\norbi\AppData\Local\*.exe;*.dll;*.ini
FilesInDirectory: C:\Users\norbi\AppData\Roaming\*.exe;*.dll;*.ini
CMD: dir /a "C:\Program Files"
CMD: dir /a "C:\Program Files (x86)"
CMD: dir /a "C:\Users\norbi\AppData"
CMD: dir /a "C:\Users\norbi\AppData\Local"