Tworzenie fixlist do FRST - komputer muli, podejrzewam koparkę

Siemano,

Potrzebowałbym, aby ktoś wykonał dla mnie fixlist do FRST. Komputer dość mocno muli, podejrzewam, że zagnieździł się jakiś syf w postaci koparki. Zamieszczam w adnotacji logi FRST i Addition.

Z góry dzięki

Tradycyjnie podaj najpierw pełną specyfikację komputera
Bo inaczej post do śmieci leci.

Masz malo ramu:
Procent pamięci w użyciu: 91%
Całkowita pamięć fizyczna: 4007.01 MB

Pomysl o wymianie/dokupieniu do 8GB, o ile laptop obsluguje.

Odinstaluj:
RAV Endpoint Protection (HKLM\...\RAVAntivirus) (Version: 4.12.1 - Reason Cybersecurity Inc.)
Safer Web (HKLM\...\ReasonSaferWeb) (Version: 2.1.1 - Reason Cybersecurity Inc.)

Uzyj AdwCleaner oraz Mbam i usun to co wykryja.

Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
AV: Reason Cybersecurity (Enabled - Up to date) {ED4D1201-4876-7014-6F49-4BC9DA784B64}
AV: 360 Total Security (Enabled - Up to date) {FFDC234A-CE9B-08F9-406B-F876951CE066}
ContextMenuHandlers1: [SD360] -> {086F171D-5ED1-4ED2-B736-CFF3AD6A128E} => C:\Program Files (x86)\360\Total Security\MenuEx64.dll -> Brak pliku
ContextMenuHandlers4: [SD360] -> {086F171D-5ED1-4ED2-B736-CFF3AD6A128E} => C:\Program Files (x86)\360\Total Security\MenuEx64.dll -> Brak pliku
ContextMenuHandlers6: [SD360] -> {086F171D-5ED1-4ED2-B736-CFF3AD6A128E} => C:\Program Files (x86)\360\Total Security\MenuEx64.dll -> Brak pliku
Hosts:
HKU\S-1-5-21-40369746-679215297-2283291727-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://securesearch.org/homepage?hp=2&pId=BT171101&iDate=2020-12-28%2012:41:26&iid=7c12b717-d73c-4062-9d7c-e32c0742ec8f&bName=
SearchScopes: HKU\S-1-5-21-40369746-679215297-2283291727-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-40369746-679215297-2283291727-1001 -> {993F5746-4C15-42BC-99C1-064A1764271B} URL = hxxps://securesearch.org?q={searchTerms}
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-40369746-679215297-2283291727-1001\...\webcompanion.com -> hxxp://webcompanion.com
HKU\S-1-5-21-40369746-679215297-2283291727-1001\...\Run: [MicrosoftEdgeAutoLaunch_B9EBB27DF024DCD190DA9B10443EB315] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [4060712 2024-03-14] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-40369746-679215297-2283291727-1001\...\Run: [KLHLLJBZ] => C:\Users\grzeg\AppData\Roaming\moobjakctsye\scv.exe [6029840 2024-01-29] (Google Inc.) [Brak podpisu cyfrowego]
C:\Users\grzeg\AppData\Roaming\moobjakctsye\
HKU\S-1-5-21-40369746-679215297-2283291727-1001\...\Run: [5W1RM5YB55] => C:\Users\grzeg\AppData\Local\Temp\dll.js [222066 2023-08-13] () [Brak podpisu cyfrowego] <==== UWAGA
C:\Users\grzeg\AppData\Local\Temp\dll.js
HKU\S-1-5-21-40369746-679215297-2283291727-1001\...\Run: [YRXSPUCG] => C:\Users\grzeg\AppData\Roaming\qeuiykxsclxc\syswom.exe [5930512 2024-02-05] (Google Inc.) [Brak podpisu cyfrowego]
C:\Users\grzeg\AppData\Roaming\qeuiykxsclxc\
HKU\S-1-5-21-40369746-679215297-2283291727-1001\...\Run: [YESZZX0K] => C:\Users\grzeg\AppData\Roaming\lwwdhhytrylc\Scvhost.exe [7588864 2024-03-11] (Google Inc.) [Brak podpisu cyfrowego]
C:\Users\grzeg\AppData\Roaming\lwwdhhytrylc\
HKU\S-1-5-21-40369746-679215297-2283291727-1001\...\Run: [DDAVSYWB] => C:\Users\grzeg\AppData\Roaming\zrdbxcahdkfm\winlogon.exe [7603200 2024-03-13] (Google Inc.) [Brak podpisu cyfrowego] <==== UWAGA
HKU\S-1-5-21-40369746-679215297-2283291727-1001\...\Run: [WJLWFHUL] => C:\Users\grzeg\AppData\Roaming\ulmlnuouhbow\syswom.exe [7596544 2024-03-13] (Google Inc.) [Brak podpisu cyfrowego]
HKU\S-1-5-21-40369746-679215297-2283291727-1001\...\Run: [MTMDJPXU] => C:\Users\grzeg\AppData\Roaming\bilarckocyfw\fmztzshyyohc.exe [7598080 2024-03-18] (Google Inc.) [Brak podpisu cyfrowego]
C:\Users\grzeg\AppData\Roaming\zrdbxcahdkfm\
C:\Users\grzeg\AppData\Roaming\ulmlnuouhbow\
C:\Users\grzeg\AppData\Roaming\bilarckocyfw\
Startup: C:\Users\grzeg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dll.js [2023-08-13] () [Brak podpisu cyfrowego]
Startup: C:\Users\grzeg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\run.vbs.lnk [2024-01-11]
ShortcutTarget: run.vbs.lnk -> C:\ProgramData\run.vbs () [Brak podpisu cyfrowego]
Startup: C:\Users\grzeg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sbhfth.vbs.lnk [2024-02-05]
ShortcutTarget: sbhfth.vbs.lnk -> C:\ProgramData\sbhfth.vbs () [Brak podpisu cyfrowego]
GroupPolicy: Ograniczenia ? <==== UWAGA
C:\ProgramData\sbhfth.vbs
C:\ProgramData\run.vbs
Policies: C:\ProgramData\NTUSER.pol: Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
Task: {6EC0DF40-DDA9-438B-AC4C-F31366E196F9} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => %ProgramFiles%\CUAssistant\culauncher.exe (Brak pliku)
Task: {F7CA09DE-911F-467A-94B1-2EEE349A7663} - System32\Tasks\Microsoft\Windows\NetFramework\Microsoft .NET Framework => C:\Windows\Microsoft.NET\Framework\v3.5\mscorsvw.exe [7885824 2022-01-15] (Microsoft Corporation) [Brak podpisu cyfrowego] <==== UWAGA
Task: {99F6AB3C-83BA-4305-9225-8BF67849C717} - System32\Tasks\Services\Diagnostic => C:\Users\grzeg\AppData\Local\Disk\AutoIt3\AutoIt3_x64.exe [1013928 2018-03-15] (AutoIt Consulting Ltd -> AutoIt Team) -> "C:\Users\grzeg\AppData\Local\Disk\AutoIt3\Settings.au3"
C:\Users\grzeg\AppData\Local\Disk\AutoIt3\
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe


Po wykonaniu zamiesc nowy log z FRST, ze skanowania, ten jest obciety jak widac.

Wcześniej wgl był problem z instalacją mbama, po fixlogu wszystko przyspieszyło, instalacja mbama w końcu zaskoczyła, przeskanowalem mbamem i adwcleaneram i wywalilem caly syf jaki znalazło ; załączam w fixlog i ponownie frst

Odinstalowales RAVAntivirus?

Fixlist.txt dla FRST:
CloseProcesses:
HKLM-x32\...\Run: [QHSafeTray] => "C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe" /start (Brak pliku)
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Ograniczenia <==== UWAGA
S4 rsClientSvc; C:\Program Files\RAVAntivirus\rsClientSvc.exe [728904 2022-08-06] (Reason Cybersecurity Inc. -> Reason Software Company Inc.)
S4 rsDNSClientSvc; C:\Program Files\ReasonSaferWeb\rsDNSClientSvc.exe [740984 2022-08-06] (Reason Cybersecurity Inc. -> Reason Software Company Inc.)
S4 rsDNSResolver; C:\Program Files\ReasonSaferWeb\rsDNSResolver.exe [10827384 2022-08-06] (Reason Cybersecurity Inc. -> )
S4 rsDNSSvc; C:\Program Files\ReasonSaferWeb\rsDNSSvc.exe [332408 2022-08-06] (Reason Cybersecurity Inc. -> Reason Software Company Inc.)
S4 rsEngineSvc; C:\Program Files\RAVAntivirus\rsEngineSvc.exe [354632 2022-08-06] (Reason Cybersecurity Inc. -> Reason Software Company Inc.)
S4 rsSyncSvc; C:\Program Files\RAVAntivirus\x64\rsSyncSvc.exe [578808 2022-07-31] (Reason Cybersecurity Inc. -> Reason Software Company Inc.)
S4 rsWSC; C:\Program Files\RAVAntivirus\rsWSC.exe [204504 2022-08-06] (Reason Cybersecurity Inc. -> Reason Software Company Inc.)
S2 QHActiveDefense; "C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" [X]
C:\Program Files\RAVAntivirus\
R1 360AntiHacker; C:\WINDOWS\System32\Drivers\360AntiHacker64.sys [199896 2023-03-15] (Beijing Qihu Technology Co., Ltd. -> 360.cn)
S3 360AvFlt; C:\WINDOWS\System32\DRIVERS\360AvFlt.sys [110800 2023-03-15] (Beijing Qihu Technology Co., Ltd. -> 360.cn)
R1 360Box64; C:\WINDOWS\System32\DRIVERS\360Box64.sys [360664 2023-03-15] (Beijing Qihu Technology Co., Ltd. -> 360.cn)
R1 360Camera; C:\WINDOWS\System32\Drivers\360Camera64.sys [58200 2023-03-15] (Beijing Qihu Technology Co., Ltd. -> 360.cn)
S0 360elam64; C:\WINDOWS\System32\DRIVERS\360elam64.sys [17000 2023-03-15] (Microsoft Windows Early Launch Anti-malware Publisher -> 360.cn)
R1 360FsFlt; C:\WINDOWS\System32\DRIVERS\360FsFlt.sys [540416 2023-03-15] (Beijing Qihu Technology Co., Ltd. -> 360.cn)
S4 360Hvm; C:\WINDOWS\System32\Drivers\360Hvm64.sys [348384 2023-03-15] (Beijing Qihu Technology Co., Ltd. -> 360安全中心)
R1 360netmon; C:\WINDOWS\System32\DRIVERS\360netmon.sys [96424 2023-03-15] (Qihoo 360 Software (Beijing) Company Limited -> 360.cn)
R1 ReasonCamFilter; C:\WINDOWS\System32\DRIVERS\ReasonCamFilter.sys [49992 2022-08-06] (Reason CyberSecurity Inc. -> Reason Software Company)
S3 rsDwf; C:\WINDOWS\system32\DRIVERS\rsDwf.sys [54144 2022-08-06] (Reason CyberSecurity Inc. -> Reason CyberSecurity Inc.)
S0 rsElam; C:\WINDOWS\System32\drivers\rsElam.sys [19944 2022-08-06] (Microsoft Windows Early Launch Anti-malware Publisher -> Reason CyberSecurity Inc.)
R1 rsKernelEngine; C:\WINDOWS\System32\DRIVERS\rsKernelEngine.sys [49456 2022-08-06] (Reason CyberSecurity Inc. -> Windows (R) Win 7 DDK provider)
2024-03-18 16:22 - 2024-03-18 16:22 - 000000008 _____ C:\ProgramData\ntuser.pol
2024-03-18 15:16 - 2024-03-18 15:17 - 000000000 ____D C:\AdwCleaner
2024-03-18 16:32 - 2024-01-11 07:51 - 000000000 ____D C:\Users\grzeg\AppData\Roaming\pbxvvqtjzvnd
2024-03-18 16:32 - 2024-01-02 10:37 - 000000000 ____D C:\Users\grzeg\AppData\Roaming\atzcnomycqqa
2024-03-18 16:32 - 2021-03-12 20:11 - 000000000 ____D C:\Users\grzeg\AppData\Roaming\GzZFXOndaTQHgG
2024-03-18 16:20 - 2021-03-12 20:11 - 000000000 __SHD C:\Users\grzeg\AppData\Local\Disk
2024-03-18 16:20 - 2021-03-12 20:11 - 000000000 ____D C:\WINDOWS\system32\Tasks\Services
2024-03-18 15:17 - 2023-07-30 09:13 - 000000000 ____D C:\Users\grzeg\AppData\Roaming\Lavasoft
2024-03-18 15:17 - 2023-07-30 09:13 - 000000000 ____D C:\Users\grzeg\AppData\Local\Lavasoft
2024-03-18 15:17 - 2023-07-30 09:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2024-03-18 15:17 - 2023-07-30 09:12 - 000000000 ____D C:\ProgramData\Lavasoft
2024-03-18 15:17 - 2023-07-30 09:12 - 000000000 ____D C:\Program Files (x86)\Lavasoft
2024-03-14 14:28 - 2023-08-19 09:22 - 000000000 _RSHD C:\360SANDBOX
2023-12-04 08:33 - 2023-11-23 14:53 - 000000061 _____ () C:\ProgramData\benchmark_10M.cmd
2023-12-04 08:33 - 2023-11-23 14:53 - 000000060 _____ () C:\ProgramData\benchmark_1M.cmd
2021-03-16 09:32 - 2021-09-28 20:12 - 000000004 _____ () C:\ProgramData\lock.dat
2023-12-04 08:33 - 2023-11-23 14:53 - 000001023 _____ () C:\ProgramData\pool_mine_example.cmd
2021-03-16 09:56 - 2021-09-28 20:12 - 000000004 _____ () C:\ProgramData\rc.dat
2023-12-04 08:33 - 2023-11-23 14:53 - 000001220 _____ () C:\ProgramData\rtm_ghostrider_example.cmd
2023-12-04 08:33 - 2023-11-25 22:06 - 000000052 _____ () C:\ProgramData\run.cmd
2024-01-29 11:14 - 2024-01-26 20:18 - 000000060 _____ () C:\ProgramData\sbhfth.cmd
2023-12-04 08:33 - 2023-11-23 14:53 - 000000821 _____ () C:\ProgramData\solo_mine_example.cmd
2021-03-16 09:32 - 2021-03-16 09:32 - 000000008 _____ () C:\ProgramData\ts.dat
2021-11-29 20:45 - 2021-07-22 19:40 - 000265504 ____R (Valve Corporation) C:\Program Files (x86)\steam_api64.cdx
2021-11-29 20:45 - 2021-07-22 19:40 - 000401640 ____R (Valve Corporation) C:\Program Files (x86)\steam_api64.dll
C:\Users\grzeg\AppData\Local\Disk
C:\Program Files\RAVAntivirus

Po wykonaniu zamiesc nowe logi ze skanowania.