Maybe too much information, but rather that than not enough.
Recommended roomate get auslogics defrag & ccleaner to maintain his slow dell laptop; he ended up grabbing a bad torrent of cc from piratebay instead of buying it as I suggested. .zip file; he says upon unzipping it prompted him to click to "prove he was human" before install, he noped out & grabbed me when it directed him to fill out a survey beforehand & wouldn't let him close out firefox instead.
Task mgr killed firefox instance; it immediately started opening a new edge instance for each I closed, while cmd windows started intermittently flashing on & off & a bunch of "install x game" shortcuts popped up on desktop, win defender warnings about malware. Win defender was partially disabled & he'd had no a/v beyond an expired mcafee trial.
Reenabled win defender & both quick and full scanned; found a lot of malicious files it claimed it fixed; installed & ran malwarebytes, found about as many again. Went through several cycles of running MWB, quarantining, rebooting, and deleting from quarantine, kept finding around the same # every subsequent scan. Tried to safe mode boot, couldn't get it to work, enabled legacy safe boot & ran MWB cycle again several times in safe mode, still kept finding around the same # of infections. Noticed at some point during every startup, at the Dell screen, it would hang for a bit, then a message about "Scanning & repairing (weirdly named serial string drive)" would appear; he says no such message ever appeared before. Laptop currently has 5 partitions beyond the system partition; 3 "recovery", 1 "OEM", and 1 "EFI system". He left it with me to try & fix, it's sat for a bit as I've been busy with work & whatnot. Logs follow.
Any potential help appreciated, as this is beyond my barely beginner skills.
FRST.txt 28.58KB 6 downloads
Addition.txt 31.43KB 2 downloads