Usuwanie niechcianej infekcji dll-propagation.exe - Logi z FRST

Witam,

Proszę o pomoc w usunięciu niechcianej infekcji między innymi procesu dll-propagation. Poniżej logi z FRST.

Fixlist.txt:
CloseProcesses:
(C:\Users\psuje\AppData\Local\Temp\24qrrXHyyao7PIDSMXbgocvqIlv\services.exe ->) () [Brak podpisu cyfrowego] C:\Users\psuje\AppData\Roaming\.dllbackups\data\modules\dll-host\res\pssuspend\ProcessSuspender.exe
(C:\Users\psuje\AppData\Local\Temp\24qrrXHyyao7PIDSMXbgocvqIlv\services.exe ->) (Microsoft Corporation) [Brak podpisu cyfrowego] [Plik w użyciu] C:\Users\psuje\AppData\Roaming\.dllbackups\data\modules\dll-propagation\dll-propagation_2.9.8.exe
(C:\Users\psuje\AppData\Roaming\.dllbackups\data\modules\dll-propagation\dll-propagation_2.9.8.exe ->) (Microsoft Corporation) [Brak podpisu cyfrowego] C:\Users\psuje\AppData\Local\Temp\1xq0MkKMTM0YtEl1JnXJ2x0ArfP\dll-propagation.exe <3>
(C:\Users\psuje\AppData\Roaming\.dllbackups\dllruntime.exe ->) (Microsoft Corporation) [Brak podpisu cyfrowego] C:\Users\psuje\AppData\Local\Temp\24qrrXHyyao7PIDSMXbgocvqIlv\services.exe <4>
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
HKU\S-1-5-21-3363506453-3553768079-2881111537-1001\...\Run: [electron.app.dllservices] => C:\Users\psuje\AppData\Roaming\.dllbackups\dllruntime.exe [63160117 2022-06-06] (Microsoft Corporation) [Brak podpisu cyfrowego] [Plik w użyciu]
HKU\S-1-5-21-3363506453-3553768079-2881111537-1001\...\Run: [electron.app.services] => C:\Users\psuje\AppData\Roaming\.dllbackups\dllruntime.exe [63160117 2022-06-06] (Microsoft Corporation) [Brak podpisu cyfrowego] [Plik w użyciu]
HKU\S-1-5-21-3363506453-3553768079-2881111537-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [36836592 2022-05-11] (Piriform Software Ltd -> Piriform Software Ltd)
HKU\S-1-5-21-3363506453-3553768079-2881111537-1001\...\MountPoints2: {6fa8256e-e4b9-11ec-869e-c86000697890} - "N:\OnePlus_setup.exe" /s
HKLM\SOFTWARE\Policies\Microsoft\Edge: Ograniczenia <==== UWAGA
HKU\S-1-5-21-3363506453-3553768079-2881111537-1001\SOFTWARE\Policies\Microsoft\Edge: Ograniczenia <==== UWAGA
Task: {076122FE-4C1A-4A98-AE43-6ACF711D5EAF} - System32\Tasks\ASC_PerformanceMonitor => E:\PROGRAMY\ZAINSTALOWANE\Advanced System Care\Advanced SystemCare\Monitor.exe /Task (Brak pliku)
Task: {0A82D1E7-7EB8-4D3C-A996-EF3C8AD0F578} - \MicrosoftEdgeScriptRuntime -> Brak pliku <==== UWAGA
Task: {45FDE517-7E6F-4DD3-9226-541BCE384A4D} - \SecurityHealthEnvelope -> Brak pliku <==== UWAGA
Task: {46E07CC4-72BE-4684-A14B-ADF43BA96711} - System32\Tasks\SecurityServiceHub => C:\Users\psuje\AppData\Local\ServiceHub\SecurityServiceHub.exe (Brak pliku)
Task: {4E2C539A-B3B6-44E1-AF65-1EBCCE77CE73} - \MicrosoftInkResources -> Brak pliku <==== UWAGA
Task: {5F97B94D-C909-4F66-9E23-14CD0403021A} - \MicrosoftEnvelope -> Brak pliku <==== UWAGA
Task: {7371562E-3982-4A9A-858F-05441E16EF6B} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\Windows\explorer.exe /NoUACCheck
Task: {80E230DA-5CE7-4B77-A7D9-E93D55F3A46E} - System32\Tasks\klcp_update => C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2113024 2022-05-31] () [Brak podpisu cyfrowego]
Task: {87C8ABE5-8953-4B6C-A244-210C4375D5A6} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [619416 2022-06-17] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {CF8E9271-1A17-4A3A-83D7-416031CDC55C} - System32\Tasks\CCleanerSkipUAC - psuje => C:\Program Files\CCleaner\CCleaner.exe [30924528 2022-05-11] (Piriform Software Ltd -> Piriform Software Ltd)
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
S3 iobit_monitor_server2021; \??\E:\PROGRAMY\ZAINSTALOWANE\Advanced System Care\Advanced SystemCare\drivers\Monitor_win10_x64.sys [X]
2022-06-17 15:10 - 2022-06-17 15:10 - 000000000 ____D C:\Users\psuje\AppData\Roaming\Ookla
2022-06-06 17:06 - 2022-06-06 20:10 - 000000000 ____D C:\Users\psuje\AppData\Roaming\windows
2022-06-06 17:06 - 2022-06-06 19:56 - 000000000 ____D C:\Users\psuje\AppData\Local\ServiceHub
2022-06-06 17:06 - 2022-06-06 18:08 - 000002612 _____ C:\Windows\system32\Tasks\SecurityServiceHub
2022-06-06 17:06 - 2022-06-06 17:06 - 000000000 ____D C:\Users\psuje\AppData\Roaming\System32
2022-06-06 17:06 - 2022-06-06 17:06 - 000000000 ____D C:\Users\psuje\AppData\Roaming\Install
2022-06-06 17:06 - 2022-06-06 17:06 - 000000000 ____D C:\Program Files (x86)\IObit
2022-06-06 17:04 - 2022-06-06 20:17 - 000000000 ____D C:\Users\psuje\AppData\LocalLow\IObit
2022-06-06 17:04 - 2022-06-06 17:04 - 000003374 _____ C:\Windows\system32\Tasks\ASC_PerformanceMonitor
2022-06-06 17:04 - 2022-06-06 17:04 - 000000000 ____D C:\ProgramData\ProductData
2022-06-06 17:04 - 2022-06-06 17:04 - 000000000 ____D C:\ProgramData\{F86B0233-9A85-4589-8AAF-524CC4F8211B}
2022-06-06 17:02 - 2022-06-06 20:24 - 000000000 ____D C:\Users\psuje\AppData\Roaming\IObit
2022-06-06 17:02 - 2022-06-06 20:17 - 000000000 ____D C:\ProgramData\IObit
2022-06-06 09:09 - 2022-06-17 15:09 - 000000000 ____D C:\Users\psuje\AppData\Roaming\services
2022-06-06 09:09 - 2022-06-06 18:13 - 000000000 ___HD C:\Users\psuje\AppData\Roaming\.dllbackups
2022-06-06 09:09 - 2022-06-06 09:09 - 000000000 ____D C:\Users\psuje\AppData\Roaming\dllservices
2022-06-05 11:16 - 2022-06-05 11:16 - 000000040 ____H C:\E64C1B27A59C
EmptyTemp:


Zrob tez skan przy pomocy mbam oraz adwcleaner i usun to co wykryja.

Dziękuję za pomoc.

Uruchomiłem twój skrypt i przeskanowałem po restarcie system. Malwarebytes nic nie znalazł.

Pozdrawiam.

Usuń folder C:\FRST i to wszystko.