[Rozwiązano] Usunięcie procesu dll-propagation - analiza logów z FRST

Witam, mam problem z wywaleniem procesu dll-propagation, w załączniku przesyłam logi z FRST

Fixlist.txt dla FRST:
CloseProcesses:
(Microsoft Corporation) [Brak podpisu cyfrowego] [Plik w użyciu] C:\Users\Robert\AppData\Roaming\.dllbackups\data\modules\dll-propagation\dll-propagation_2.9.8.exe
(Microsoft Corporation) [Brak podpisu cyfrowego] [Plik w użyciu] C:\Users\Robert\AppData\Roaming\.dllbackups\dllruntime.exe
(Microsoft Corporation) [Brak podpisu cyfrowego] C:\Users\Robert\AppData\Local\Temp\1xq0MkKMTM0YtEl1JnXJ2x0ArfP\dll-propagation.exe <3>
(Microsoft Corporation) [Brak podpisu cyfrowego] C:\Users\Robert\AppData\Local\Temp\1y6QaG1dVqmqkzRvawVNVxn3bhE\dllservices.exe <4>
HKU\S-1-5-21-1430495745-1830344144-2108601391-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [35093120 2021-09-10] (Piriform Software Ltd -> Piriform Software Ltd)
HKU\S-1-5-21-1430495745-1830344144-2108601391-1001\...\Run: [Opera GX Browser Assistant] => C:\Users\Robert\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe [3291288 2021-02-01] (Opera Software AS -> Opera Software)
HKU\S-1-5-21-1430495745-1830344144-2108601391-1001\...\Run: [electron.app.dllservices] => C:\Users\Robert\AppData\Roaming\.dllbackups\dllruntime.exe [63924677 2021-09-15] (Microsoft Corporation) [Brak podpisu cyfrowego] [Plik w użyciu]
HKU\S-1-5-21-1430495745-1830344144-2108601391-1001\...\Policies\Explorer: []
HKU\S-1-5-21-1430495745-1830344144-2108601391-1001\...\MountPoints2: {697a321e-8319-11ea-98f4-e8d0fc82877c} - "D:\autorun.exe"
Task: {2C99368D-2CE3-474D-9B47-E6E675019107} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [684976 2021-09-10] (Piriform Software Ltd -> Piriform)
Task: {4760E105-221D-463E-83B2-A62BF1409A43} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [29155968 2021-09-10] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {6E837D93-450D-451E-83A7-AA58BDF5CFA7} - System32\Tasks\Opera scheduled assistant Autoupdate 1604243431 => C:\Users\Robert\AppData\Local\Programs\Opera\launcher.exe [42731728 2021-09-28] (Opera Software AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\Robert\AppData\Local\Programs\Opera\assistant" $(Arg0)
Task: {74C41956-C874-49BD-A0DD-9AA6E6EA6128} - System32\Tasks\CCleanerSkipUAC - Robert => C:\Program Files\CCleaner\CCleaner.exe [29155968 2021-09-10] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {84ABC4BC-70ED-4F32-AB51-FD74A4D9CF1D} - System32\Tasks\Opera scheduled Autoupdate 1604243429 => C:\Users\Robert\AppData\Local\Programs\Opera\launcher.exe [42731728 2021-09-28] (Opera Software AS -> Opera Software)
Task: {A201B429-0CFB-4A54-956F-51CE08B5DCFA} - System32\Tasks\Opera GX scheduled assistant Autoupdate 1615547187 => C:\Users\Robert\AppData\Local\Programs\Opera GX\launcher.exe [42666192 2021-09-28] (Opera Software AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\Robert\AppData\Local\Programs\Opera GX\assistant" $(Arg0)
Task: {F41F4E78-DDFB-4AE6-B503-F787A8DAFDE4} - System32\Tasks\Opera GX scheduled Autoupdate 1614796954 => C:\Users\Robert\AppData\Local\Programs\Opera GX\launcher.exe [42666192 2021-09-28] (Opera Software AS -> Opera Software)
Edge HKLM\...\Edge\Extension: [djmbpijobamaimdblhkpclfnpkiogeoo]
Edge HKLM-x32\...\Edge\Extension: [djmbpijobamaimdblhkpclfnpkiogeoo]
FF NewTab: Mozilla\Firefox\Profiles\g7e0gx69.default -> hxxps://securesearch.org/homepage?hp=2&pId=BT170603&iDate=2020-11-07 10:47:47&bName=
CHR HKLM\...\Chrome\Extension: [blgipgnbmnikbdecnjmgckmndlkebhid]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif]
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
CHR HKLM-x32\...\Chrome\Extension: [blgipgnbmnikbdecnjmgckmndlkebhid]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif]
2021-10-08 17:25 - 2021-10-08 17:25 - 000000000 ____D C:\Users\Robert\Downloads\FRST-OlderVersion
2021-09-19 13:22 - 2021-09-19 13:22 - 016280648 _____ C:\Users\Robert\Downloads\HandBrake-1.4.1-x86_64-Win_GUI(2).exe
2021-09-19 13:13 - 2021-09-19 13:13 - 016280648 _____ C:\Users\Robert\Downloads\HandBrake-1.4.1-x86_64-Win_GUI(1).exe
2021-09-15 19:42 - 2021-09-15 19:42 - 000000000 ____D C:\Users\Robert\AppData\Roaming\Ookla
2021-09-13 19:21 - 2021-09-19 00:42 - 000000000 ____D C:\Users\Robert\AppData\Roaming\dll-access
2021-09-13 19:16 - 2021-10-08 17:31 - 000000000 ____D C:\Users\Robert\AppData\Roaming\dll-propagation
2021-09-13 19:10 - 2021-10-08 17:31 - 000000000 ____D C:\Users\Robert\AppData\Roaming\dllservices
2021-09-13 19:10 - 2021-09-16 12:48 - 000000000 ___HD C:\Users\Robert\AppData\Roaming\.dllbackups
EmptyTemp:

Dzięki wielkie pomogło
Jak dobrze rozumiem to ktoś postawił koparkę na moim laptopie

Raczej Ty sam, sciagajac zainfekowane torrenty.