Analiza logów FRST i HijackThis po podejrzeniu infekcji linkiem

Cytat:

CloseProcesses:
CreateRestorePoint:
HKLM-x32\...\Run: [P17RunE] => RunDll32 P17RunE.dll,RunDLLEntry
HKLM-x32\...\Winlogon: [Shell] [ ] () <=== UWAGA
Tcpip\..\Interfaces\{7c1e1bd1-0387-44ee-8092-7c3780e66687}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{990384aa-ad8b-43ce-b031-84b76d848330}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{d51b0950-f152-41bc-89e5-34466e30fab1}: [DhcpNameServer] 192.168.1.254
HKLM\SYSTEM\CurrentControlSet\Services\4583E99297C3B214 <==== UWAGA (Rootkit!)
Task: {B0AAB528-6A7C-4402-A610-0D03378135FE} - \Microsoft\Windows\UNP\RunCampaignManager -> Brak pliku <==== UWAGA
HKU\S-1-5-21-2677041840-1652937685-740319646-1001\Software\Classes\regfile: regedit.exe "%1" <==== UWAGA
FirewallRules: [{70DD4C2E-1A1F-4A90-BA8C-6AEA5314B628}] => (Allow) D:\Games\pobrane\BlackDesert_Downloader.exe Brak pliku
FirewallRules: [{BFF3F6BC-45C6-4C8D-9A0B-3CE398820FF8}] => (Allow) D:\Games\pobrane\BlackDesert_Launcher.exe Brak pliku
FirewallRules: [{DC5D03C2-2BA4-4598-AEC0-5604E466098E}] => (Allow) D:\Games\pobrane\bin64\BlackDesert64.exe Brak pliku
FirewallRules: [{12A80B8C-E831-4DC5-ABD3-6C53644599AE}] => (Allow) D:\Games\pobrane\bin\BlackDesert32.exe Brak pliku
FirewallRules: [{24EB70A1-6889-4AEB-9C0D-9BBDB963F52F}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\6.0.2\DriverBooster.exe Brak pliku
FirewallRules: [{F45CF87D-A43C-4570-9FCB-460A6F475E9B}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\6.0.2\DriverBooster.exe Brak pliku
FirewallRules: [UDP Query User{E1914509-33E8-4FAF-A27E-BA036F3DBE71}C:\users\raptor\appdata\local\gamerhash\miners\claymore_cryptonote_cpu_v2\nscpucnminer64.gh] => (Allow) C:\users\raptor\appdata\local\gamerhash\miners\claymore_cryptonote_cpu_v2\nscpucnminer64.gh ()
FirewallRules: [TCP Query User{E93AA101-D82C-4525-9390-413A9BC66B63}C:\users\raptor\appdata\local\gamerhash\miners\claymore_cryptonote_cpu_v2\nscpucnminer64.gh] => (Allow) C:\users\raptor\appdata\local\gamerhash\miners\claymore_cryptonote_cpu_v2\nscpucnminer64.gh ()
FirewallRules: [UDP Query User{0397D994-E2E0-46EC-A56A-D6E38BCED2EA}C:\users\raptor\appdata\local\gamerhash\miners\claymore_dual_v1\ethdcrminer64.gh] => (Allow) C:\users\raptor\appdata\local\gamerhash\miners\claymore_dual_v1\ethdcrminer64.gh ()
FirewallRules: [TCP Query User{0BE2926E-DF07-4813-88F8-B0684A6BC3F5}C:\users\raptor\appdata\local\gamerhash\miners\claymore_dual_v1\ethdcrminer64.gh] => (Allow) C:\users\raptor\appdata\local\gamerhash\miners\claymore_dual_v1\ethdcrminer64.gh ()
FirewallRules: [{8E170833-F53C-4350-8BBB-651060E25540}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe Brak pliku
FirewallRules: [{1BD8D0F1-B5B4-4816-834B-609982782A93}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe Brak pliku
FirewallRules: [TCP Query User{C8436CF2-07FA-4AC5-9AD8-DB5D0EEC0504}C:\program files\windowsapps\spotifyab.spotifymusic_1.73.345.0_x86__zpdnekdrzrea0\spotify.exe] => (Allow) C:\program files\windowsapps\spotifyab.spotifymusic_1.73.345.0_x86__zpdnekdrzrea0\spotify.exe Brak pliku
FirewallRules: [UDP Query User{74E33A0C-D4D6-450F-8A8D-778B73898013}C:\program files\windowsapps\spotifyab.spotifymusic_1.73.345.0_x86__zpdnekdrzrea0\spotify.exe] => (Allow) C:\program files\windowsapps\spotifyab.spotifymusic_1.73.345.0_x86__zpdnekdrzrea0\spotify.exe Brak pliku
FirewallRules: [{894A5F6C-422F-4196-9C81-605FD5B35C9A}] => (Allow) C:\Users\raptor\AppData\Roaming\uTorrent\uTorrent.exe Brak pliku
FirewallRules: [{6B65E353-7254-43EE-85F7-967201E3BA8C}] => (Allow) C:\Users\raptor\AppData\Roaming\uTorrent\uTorrent.exe Brak pliku
FirewallRules: [{0D799E6A-EC47-42EE-A470-E16A589E87D6}] => (Allow) C:\Program Files\Vuze\Azureus.exe Brak pliku
FirewallRules: [{02FDE5CA-8F0D-4D07-872F-96A8C663729C}] => (Allow) C:\Program Files\Vuze\Azureus.exe Brak pliku
EmptyTemp: