CloseProcesses:
CreateRestorePoint:
Task: {3C17929B-62E3-49C8-ADD5-D584E58AF191} - System32\Tasks\TweakBit\Driver Updater\Start Driver Updater оn logon => C:\Program Files (x86)\TweakBit\Driver Updater\DriverUpdater.exe <==== UWAGA
Task: {760B78AC-E99B-493D-9A8E-6AB804657173} - System32\Tasks\TweakBit\Driver Updater\Start Driver Updater automatic scanning => C:\Program Files (x86)\TweakBit\Driver Updater\DriverUpdater.exe <==== UWAGA
Task: {C3EC569E-C377-4495-BB86-E69F62354C19} - System32\Tasks\Driver Booster SkipUAC (Maro) => C:\Program Files (x86)\IObit\Driver Booster\5.2.0\DriverBooster.exe
Task: {F3087F22-CD31-41B1-ACC4-8364D938CB66} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-02-15] (Adobe Systems Incorporated)
Task: {F785EB54-29DD-4EE6-93DA-AAC29D57582E} - System32\Tasks\TweakBit\Driver Updater\Time for deal => C:\Program Files (x86)\TweakBit\Driver Updater\DriverUpdater.exe <==== UWAGA
AlternateDataStreams: C:\Windows\system32\d3dx9_24.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\d3dx9_25.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\d3dx9_26.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\d3dx9_27.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\d3dx9_28.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\d3dx9_29.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\d3dx9_30.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\difx64.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\FBAgent.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\gfxSrvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\GfxUI.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\hccutils.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\hkcmd.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\ig4icd64.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igd10umd64.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igdumd64.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxcmrt64.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxCoIn_v2405.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxcpl.cpl:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxdev.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\IGFXDEVLib.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxdo.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxexps.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxext.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxpers.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxpph.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrara.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrchs.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrcht.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrcsy.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrdan.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrdeu.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrell.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrenu.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxresn.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxress.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrfin.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrfra.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrheb.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrhrv.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrhun.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrita.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrjpn.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrkor.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrnld.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrnor.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrplk.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrptb.lrc:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\igfxrptg.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrrom.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrrus.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrsky.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrslv.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrsve.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrtha.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxrtrk.lrc:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxsrvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxsrvc.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxTMM.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\igfxtray.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\iglhcp64.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\iglhsip64.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\IntcDAuC.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mfc140esn.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\MRT-KB890830.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MRT.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\PresentationNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\TsWpfWrp.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WdfCoInstaller01011.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\x3daudio1_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\xactengine2_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_43.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3dcsx_43.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_43.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3dx11_43.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_24.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_25.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_26.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_27.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_28.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_29.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_30.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\FlashPlayerApp.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\ig4icd32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\igd10umd32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\igdumd32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\igdumdx32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\igfxcmrt32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\igfxdv32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\igfxexps32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\iglhcp32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\iglhsip32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\mfc140deu.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msvcp120.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\msvcr120.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\PresentationNative_v0300.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\TsWpfWrp.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\vccorlib120.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\x3daudio1_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_1.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\xinput1_3.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\dtlitescsibus.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\dtliteusbbus.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\ETD.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\ETDSMBus.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\igdkmd64.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\Impcd.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\IntcDAud.sys:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\advinst.msi:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\advinst.msi:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\ATKPackage_WIN7_32_WIN7_64_z100006.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\ATKPackage_WIN7_32_WIN7_64_z100006.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\Autodesk_EAGLE_8.6.0_English_Win_64bit.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\Autodesk_EAGLE_8.6.0_English_Win_64bit.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\Becky G, Bad Bunny - Mayores (Official Video).mp3:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\Becky G, Bad Bunny - Mayores (Official Video).mp3:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\Britney Spears - ...Baby One More Time.mp3:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\Britney Spears - ...Baby One More Time.mp3:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\ChromeSetup.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\ChromeSetup.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\CrystalDiskInfo7_5_1.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\CrystalDiskInfo7_5_1.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\CrystalDiskMark6_0_0.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\CrystalDiskMark6_0_0.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\directx_Jun2010_redist(1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\directx_Jun2010_redist(1).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\driver-updater-setup.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\driver-updater-setup.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\driver_booster_setup.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\driver_booster_setup.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\dxwebsetup.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\e-mikrofirma (1.1.0.0).msi:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\e-mikrofirma (1.1.0.0).msi:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\EpicInstaller-7.1.1.msi:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\EpicInstaller-7.1.1.msi:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\FastBoot_Win7_64_104.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\FastBoot_Win7_64_104.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\Fergie - A Little Party Never Killed Nobody (All We Got) ft. Q-Tip, GoonRock.mp3:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\Fergie - A Little Party Never Killed Nobody (All We Got) ft. Q-Tip, GoonRock.mp3:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\FontPack1500720033_XtdAlf_Lang_DC.msi:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\FontPack1500720033_XtdAlf_Lang_DC.msi:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\FoxitAdvancedPDFEditor31_enu_Setup.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\FoxitAdvancedPDFEditor31_enu_Setup.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\FoxTrading-Whitepaper_EN.docx:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\FoxTrading-Whitepaper_EN.docx:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\FRST64(1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\FRST64(1).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\FRST64.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\jre-8u161-windows-i586.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\jre-8u161-windows-i586.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\Lou Bega - Mambo No. 5 (A Little Bit of...) (Official Video).mp3:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\Lou Bega - Mambo No. 5 (A Little Bit of...) (Official Video).mp3:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\Mr. President - Coco Jambo (1920 x 1080p HD) videoclip.mp3:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\Mr. President - Coco Jambo (1920 x 1080p HD) videoclip.mp3:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\MSI_Unpacker_v1.5_www.INSTALKI.pl.msi:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\MSI_Unpacker_v1.5_www.INSTALKI.pl.msi:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\Net4Switch_Win7_32_64_100020.zip:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\Net4Switch_Win7_32_64_100020.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\npp.7.5.4.Installer.x64.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\npp.7.5.4.Installer.x64.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\photo6028509336566868753.jpg:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\photo6028509336566868753.jpg:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\PriorityEx-Web-Translation.xlsx:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\translation.rtf:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\translation.rtf:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\user-manual-2428249.pdf:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\UTC--2018-02-15T14-51-37.737Z--77c3d32a5c88686b1ee796040e159dea9fa584b8:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\UTC--2018-02-15T14-51-37.737Z--77c3d32a5c88686b1ee796040e159dea9fa584b8:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\vcredist_x64(1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\vcredist_x64(1).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\vcredist_x64.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\vcredist_x64.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\vcredist_x86(1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\vcredist_x86(1).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\vcredist_x86(2).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\vcredist_x86.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\VC_redist.x64(1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\VC_redist.x64(1).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\vc_redist.x64.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\vc_redist.x64.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\VC_redist.x86(1).exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\VC_redist.x86(1).exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\vc_redist.x86.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\vc_redist.x86.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\WHITE-PAPER-ENGLISH-WORD-12-02-2018(1).doc:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\WHITE-PAPER-ENGLISH-WORD-12-02-2018(1).doc:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\WHITE-PAPER-ENGLISH-WORD-12-02-2018(2).doc:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\WHITE-PAPER-ENGLISH-WORD-12-02-2018(2).doc:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\WHITE-PAPER-ENGLISH-WORD-12-02-2018(3).doc:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\WHITE-PAPER-ENGLISH-WORD-12-02-2018(3).doc:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\WHITE-PAPER-ENGLISH-WORD-12-02-2018.doc:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\WHITE-PAPER-ENGLISH-WORD-12-02-2018.doc:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\WORLDWIDE ICO 12022018 (1).docx:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\WORLDWIDE ICO 12022018 (1).docx:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\WORLDWIDE-ICO-12022018-1.docx:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\WORLDWIDE-ICO-12022018-1.docx:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\xinput1_3(1).zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\xinput1_3.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Maro\Downloads\Новый документ.rtf:$CmdTcID [64]
AlternateDataStreams: C:\Users\Maro\Downloads\Новый документ.rtf:$CmdZnID [26]
HKLM\...\.scr: EAGLESCR => "c:\EAGLE 8.6.0\eagle.exe" -C "" "%1" <==== UWAGA
C:\Program Files (x86)\TweakBit
C:\WINDOWS\System32\Tasks\TweakBit
C:\ProgramData\TweakBit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakBit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Licenses\AFPL License.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Licenses\FairPlay License.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Licenses\GPL License.lnk
C:\Users\Maro\Documents\..stare\GTA San Andreas User Files\User Tracks\Ed_Sheeran -  I See Fire — skrót.lnk
C:\Users\Maro\Documents\..stare\GTA San Andreas User Files\User Tracks\Guns n' Roses — skrót.lnk
C:\Users\Maro\Documents\..stare\GTA San Andreas User Files\User Tracks\Happysad — skrót.lnk
C:\Users\Maro\Documents\..stare\GTA San Andreas User Files\User Tracks\Linkin Park - Living Things — skrót.lnk
C:\Users\Maro\Documents\..stare\GTA San Andreas User Files\User Tracks\Nirvana - Nevermind — skrót.lnk
C:\Users\Maro\Documents\..stare\GTA San Andreas User Files\User Tracks\Ostatni w Raju - Zbiór Dziwnych Opowieści — skrót.lnk
C:\Users\Maro\Desktop\Majek dokumenty\Gameforge Live.lnk
C:\Users\Maro\Desktop\Majek dokumenty\GTA San Andreas.lnk
C:\Users\Maro\Desktop\Majek dokumenty\Metin2.lnk
C:\Users\Maro\Desktop\Majek dokumenty\San Andreas Mod Installer.lnk
C:\Users\Maro\Desktop\Majek dokumenty\123321\123.lnk
C:\Users\Maro\Favorites\Bing.url
HKU\S-1-5-21-3175827008-2363616892-2152115624-1001\...\MountPoints2: {ebd0a346-0ddc-11e8-82e0-485b3916f5cd} - "I:\SETUP.EXE" 
2018-02-09 19:46 - 2018-02-09 19:46 - 000768664 _____ (TweakBit) C:\Users\Maro\Downloads\driver-updater-setup.exe
EmptyTemp:
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}