Start::
CreateRestorePoint:
CHR HomePage: Default -> hxxp://search.conduit.com/?gd=&ctid=CT3322197&octid=EB_ORIGINAL_CTID&ISID=M30FF40F8-E7D3-4112-9BE0-1B8F77F5BE97&SearchSource=55&CUI=&UM=5&UP=SP59263023-9642-4A9C-BCF3-F9AB69429B26&SSPV=
CHR StartupUrls: Default -> "hxxp://search.conduit.com/?gd=&ctid=CT3322197&octid=EB_ORIGINAL_CTID&ISID=M30FF40F8-E7D3-4112-9BE0-1B8F77F5BE97&SearchSource=55&CUI=&UM=5&UP=SP59263023-9642-4A9C-BCF3-F9AB69429B26&SSPV=","hxxp://google.pl/","hxxp://www.gazeta.pl/0,0.html?p=153","hxxp://www.search.ask.com/?o=APN10640A&gct=hp&d=473-102&v=n10781-219&t=4","hxxp://www.search.ask.com/?o=APN10640A&gct=hp&d=473-102&v=a11465-219&t=4","hxxp://start.qone8.com/?type=hp&ts=1399718615&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX","hxxp://start.qone8.com/?type=hppp&ts=1399728565&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX","hxxp://start.qone8.com/?type=hppp&ts=1399880531&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX","hxxp://start.qone8.com/?type=hppp&ts=1399967491&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX","hxxp://start.qone8.com/?type=hppp&ts=1400218644&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX","hxxp://start.qone8.com/?type=hppp&ts=1400422826&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX","hxxp://start.qone8.com/?type=hppp&ts=1400507051&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX","hxxp://start.qone8.com/?type=hppp&ts=1400612919&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX","hxxp://start.qone8.com/?type=hppp&ts=1402492225&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX","hxxp://start.qone8.com/?type=hppp&ts=1402492521&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX","hxxp://start.qone8.com/?type=hppp&ts=1402495295&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX","hxxp://start.qone8.com/?type=hppp&ts=1402497236&from=cvs1&uid=HGSTXHTS545050A7E380_130717TM8514TF1T285PX"
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> Brak pliku
Task: {20B06E83-55E6-43F0-B4B4-2C830D0E7CA1} - System32\Tasks\DriverToolkit Autorun => C:\Program Files (x86)\DriverToolkit\DriverToolkit.exe
Task: C:\WINDOWS\Tasks\DriverToolkit Autorun.job => C:\Program Files (x86)\DriverToolkit\DriverToolkit.exe
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Booking.com.lnk -> C:\Program Files (x86)\HP\Shared\WizLink.exe () -> hxxp://secure.rezserver.com/sdk/v1/LinkFwd?refid=7684&destination=booking&refclickid=square
Reboot:
EmptyTemp:
End::