The computer behaves suspiciously(maybe RaT or dropper i think)

Ok good.
Please now  run a scan with AdwCleaner.
Please download AdwCleaner.

• Close all open programs and browsers
• Right click on the icon and select Run as administrator
• Click Scan Now
• When the scan has finished AdwCleaner shows you all detected PUPs and adware.
• If any are found, select them and click Quarantine. (I would suggest that you do not select Pre-installed applications for now, or any other items you wish to keep.)
• AdwCleaner prompts you to save and close your work before continuing. Click Continue.
• After cleaning, you are prompted to restart your device. Click Restart now to complete the cleanup process.

Once your computer has restarted ...

•     If it doesn't open automatically, please start AdwCleaner.
•     Click on View Log File button (This log can also be found in the Log Files tab).
•     A Notepad file will open containing the results.
•     Click Skip Basic Repair (if the option appears)
•     Please post the contents of the file in your next reply.

-------------------------------------------------------------
The run a FULL scan with ESET Online Scanner as follows.

• Download ESET Online Scanner from here and save it to your Desktop.
• Right click the esetonlinescanner.exe file you downloaded and select Run as administrator.
• Select your desired language from the drop-down menu and click Get started.
• Click Yes if a User Account window appears.
• In the Terms of use screen, click Accept if you agree to the Terms of use.
• Click Get started in the welcome screen.
• Select your preference for the Customer Experience Improvement Program and the Detection feedback system.Click Continue.
• Click Computer scan, in the Welcome back screen.
• Choose Full scan on the next screen.
• Select Enable ESET to detect and quarantine potentially unwanted applications.Then click Start scan
• Please note that this process can take several hours to complete.
• At the end of the scan, the Found and resolved detections screen may be displayed. You can click View detailed results to view specific information. Click Continue.
• On the following screen click Save scan log and save it to your Desktop as ESETScan.txt. Click Continue.
• ESET Online Scanner will now ask if you wish to turn on the Periodic Scan feature.I suggest that you do not do this for now Click Continue
• You are offered a 30 day trial of ESET Internet Security on the next screen. Click Continue
• On the next screen, you can leave feedback about the program if you wish.
• There is an option to delete the application's data on closing, but we can but we can do this later.
• If you left feedback, click Submit and Close. If not, click Close.
• Copy and paste the contents of the ESETScan.txt file in your next reply.

Edited by rubyheart, Yesterday, 08:38 PM.

ESET NOT WORKING. After installing a module update, percentage goes to 4444% and application closes.  How to attach a image? 

I can attach an error from the windows event log.

ESET can be temperamental sometimes.
Let's use an alternative scanner instead.
Please run a scan with Emsisoft Emergency Kit.

• Download and save the installation file from here.
• Double-click on the Emsisoft Emergency Kit setup file to start the installation process and then click on the Install button.
• You may be presented with a User Account Control warning, asking you if you want to run this file. Click Yes to continue.
• The downloaded package unpacks to “C:\EEK” by default and this folder now opens on your screen.
• To start Emsisoft, double-click on the Start Emergency Kit Scanner icon in this folder.
• You may get another User Account Control warning. Click Yes to continue.
• Accept the Licence Agreement.
• When you launch the program for the first time, Emsisoft Emergency Kit will automatically download updates. The Scan tab changes from orange to green when the update process is completed.
• Leave the settings unchanged, which include detection of Potentially Unwanted Programs.
• Now click on Malware Scan in the Scan button.
• When the Emsisoft scan has finished, you will see a screen reporting details of any malicious files found on your computer.(Close the pop up inviting installation of Emsisoft protection)
• Click Quarantine selected objects. (Note, this option is only shown if malicious objects were detected during the scan)
• You may be asked to restart your computer.
• When the threats have been quarantined, click the View Report button in the lower-right corner and the scan log will open in Notepad. The logs can also be accessed in the left hand menu bar.
• Please save this log on your desktop and post the contents into your next reply.
• When you close Emsisoft Emergency Kit it asks if you wish to sign up for a newsletter. This is optional, and does not affect the malware removal process.

Emsisoft Emergency Kit - Версия 2024.4

Обновлено: 15.11.2024 11:56:48

Пользовательская LTVN\ltvn.adm

 LTVN

 Windows 11x64 

 

Настройки проверки:

 

Тип проверки: Проверка на угрозы

Объекты: Память, Следы, Файлы

 

Обнаруж. ПНП: Вкл.

Проверка архивов: Откл.

Проверка архива почты: Откл.

Проверка ADS: Вкл.

 

Запуск проверки: 15.11.2024 11:56:55

C:\Users\ltvn.adm\Downloads\cce_public_x64\cce_2.5.242177.201_x64\cce_x64\ccekrnl.dat обнаружено: Gen:Variant.Application.KillSwitch.3 ( [krnl.xmd]

 

Проверено: 80244

Найдено: 1

Проверка памяти... 

Проверка следов... 

Проверка файлов... 

 

Конец проверки: 15.11.2024 11:58:59

Время проверки: 0:02:04

 

C:\Users\ltvn.adm\Downloads\cce_public_x64\cce_2.5.242177.201_x64\cce_x64\ccekrnl.dat Gen:Variant.Application.KillSwitch.3 (

 

В карантине 1

 

Edited by rubyheart, Today, 04:03 AM.

I found a strange file: IIsScHlp.wsc

SHA-256 HASH: 5fb933c08c31fc6e99e2c4d2a77f4379335c00bf11afe3d0850cef25e04e7320 

Edited by rubyheart, Today, 04:07 AM.

I attached a new frst logs. 

What is the full path to this file?

Please advise how the computer is running now and details of any other remaining concerns.

C:\Windows\WinSxS\amd64_microsoft-windows-iis-legacyscripts_31bf3856ad364e35_10.0.22621.1_none_dfdc389d6af52efc

I also have these on my computer and suggest that you leave them alone, as removal may affect computer performance.

I see that Kaspersky is disabled in your new log.
Was this intentional?

No, it is not updated, and after launching it, my Internet connection falls off.

After the launch, there are problems with steam.

There is a feeling that it is absolutely useless, and does not catch viruses, just like microsoft defender.