¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan | g3n-h@ckm@n | V9_18.10.19.1 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤ - Start 15:49:52 12/14/2022 Updated 18/10/2019 | 07:30 (GMT) by g3n-h@ckm@n Contact : http://www.sosvirus.net/ Pre_scan Feedbacks : http://www.sosvirus.net/feedback-t74962.html [roman's vil6 suite (Administrator)] - [DESKTOP-IHFM53N] SID = S-1-5-21-981079248-4165750198-1009296217-1001 Boot: Normal boot System : Windows 10 Enterprise (64 bits) Enterprise ProcessorNameString : AMD E1-1200 APU with Radeon(tm) HD Graphics Identifier : AMD64 Family 20 Model 2 Stepping 0 CoreTemp : -1 Celsius - Max : Celsius Memory RAM = Total (MB) : 3748 | Free (MB) : 1797 Pagefile = Total (MB) : 5189 | Free (MB) : 3292 Virtual = Total (MB) : 4194 | Free (MB) : 3952 ¤¤¤¤¤¤¤¤¤¤ # Components of starting up ¤¤¤¤¤¤¤¤¤¤¤ # Drives L:\-> [Removable] | [sardu foldit] | Total : 14.92 Go | Free : 0.82 Go -> NTFS [USB] K:\-> [CDROM] | [3795] | Total : 0.06 Go | Free : 0 Go -> CDFS [SATA] G:\-> [Removable] | [] | Total : 7.44 Go | Free : 5.82 Go -> FAT32 [USB] D:\-> [Fixed] | [] | Total : 244.83 Go | Free : 219.31 Go -> NTFS [SATA] C:\-> [Fixed] | [] | Total : 54.58 Go | Free : 14.02 Go -> NTFS [SATA] ¤¤¤¤¤¤¤¤¤¤ # Windows updates Windows Is Activated ¤¤¤¤¤¤¤¤¤¤ # Sessions C:\Windows\system32\config\systemprofile C:\Windows\ServiceProfiles\LocalService C:\Windows\ServiceProfiles\NetworkService C:\Users\roman's vil6 suite Registry saved , to restore : Shortcut on the desktop 'Pre_Scan_Restore' Restore the register (C:\Pre_Scan\Save\Registry [14.12.2022 @ 15_46_07]) To restore File or Folder : Shortcut on the desktop 'Pre_Scan_Restore' , select 'restore File - Folder' , select an Item and click on Restore ¤¤¤¤¤¤¤¤¤¤ # Browsers IE : 11.0.19041.1566 (© Microsoft Corporation.) ¤¤¤¤¤¤¤¤¤¤ # FlashPlayer ���������� # Security AS : FW : WMI : OK WU: Windows Update Service [Manual(3)] = Running AS: Windows Defender [Auto(2)] = Running FW: Windows FireWall Service [Auto(2)] = Running ¤¤¤¤¤¤¤¤¤¤ # Stopped processes 1940 | [Owner : |Parent : 956] - (.AMD - AMD External Events Service Module.) - (6.14.11.1199) = C:\Windows\System32\atiesrxx.exe 2108 | [Owner : |Parent : 1940] - (.AMD - AMD External Events Client Module.) - (6.14.11.1199) = C:\Windows\System32\atieclxx.exe 3272 | [Owner : |Parent : 956] - (.Microsoft Corporation - Application sous-système spouleur.) - (10.0.19041.2075) = C:\Windows\System32\spoolsv.exe 3644 | [Owner : Système |Parent : 956] - (.Advanced Micro Devices, Inc. - Service Fusion Utility.) - (1.0.0.0) = C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe 3800 | [Owner : |Parent : 956] - (.Microsoft Corporation - Antimalware Service Executable.) - (4.18.2211.5) = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2211.5-0\MsMpEng.exe 1784 | [Owner : SERVICE LOCAL |Parent : 2008] - (.Microsoft Corporation - Device Association Framework Provider Host.) - (10.0.19041.1806) = C:\Windows\System32\dasHost.exe 4224 | [Owner : SERVICE RÉSEAU |Parent : 2008] - (.Microsoft Corporation - Device Association Framework Provider Host.) - (10.0.19041.1806) = C:\Windows\System32\dasHost.exe 1592 | [Owner : |Parent : 956] - (.Microsoft Corporation - Service Broker du moniteur d'exécution System Guard.) - (10.0.19041.546) = C:\Windows\System32\SgrmBroker.exe 4308 | [Owner : Système |Parent : 416] - (.Microsoft Corporation - MoUSO Core Worker Process.) - (10.0.19041.2304) = C:\Windows\System32\MoUsoCoreWorker.exe 3576 | [Owner : LogonSessionId_0_608160 |Parent : 956] - (.Microsoft Corporation - Indexeur Microsoft Windows Search.) - (7.0.19041.2193) = C:\Windows\System32\SearchIndexer.exe 4216 | [Owner : roman's vil6 suite |Parent : 1568] - (.Microsoft Corporation - Shell Infrastructure Host.) - (10.0.19041.746) = C:\Windows\System32\sihost.exe 4412 | [Owner : roman's vil6 suite |Parent : 956] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (10.0.19041.1806) = C:\Windows\System32\svchost.exe 3684 | [Owner : roman's vil6 suite |Parent : 956] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (10.0.19041.1806) = C:\Windows\System32\svchost.exe 4500 | [Owner : roman's vil6 suite |Parent : 1264] - (.Microsoft Corporation - Processus hôte pour Tâches Windows.) - (10.0.19041.1865) = C:\Windows\System32\taskhostw.exe 356 | [Owner : Aucun |Parent : 1264] - (.PC Helpsoft - PC Cleaner automatic scan and notifications.) - (9.1.0.0) = D:\Program Files (x86)\PC Cleaner\PCCNotifications.exe 1880 | [Owner : roman's vil6 suite |Parent : 4768] - (.Microsoft Corporation - Chargeur CTF.) - (10.0.19041.1) = C:\Windows\System32\ctfmon.exe 1220 | [Owner : roman's vil6 suite |Parent : 280] - (.Microsoft Corporation - Explorateur Windows.) - (10.0.19041.2193) = C:\Windows\explorer.exe 5172 | [Owner : roman's vil6 suite |Parent : 956] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (10.0.19041.1806) = C:\Windows\System32\svchost.exe 6740 | [Owner : roman's vil6 suite |Parent : 416] - (. - .) - (0.0.0.0) = C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe 7028 | [Owner : roman's vil6 suite |Parent : 416] - (.Microsoft Corporation - Runtime Broker.) - (10.0.19041.746) = C:\Windows\System32\RuntimeBroker.exe 6296 | [Owner : roman's vil6 suite |Parent : 416] - (.Microsoft Corporation - Runtime Broker.) - (10.0.19041.746) = C:\Windows\System32\RuntimeBroker.exe 3360 | [Owner : roman's vil6 suite |Parent : 416] - (.Microsoft Corporation - Runtime Broker.) - (10.0.19041.746) = C:\Windows\System32\RuntimeBroker.exe 7328 | [Owner : roman's vil6 suite |Parent : 1220] - (.Microsoft Corporation - Windows Security notification icon.) - (10.0.19041.1) = C:\Windows\System32\SecurityHealthSystray.exe 7360 | [Owner : |Parent : 956] - (.Microsoft Corporation - Windows Security Health Service.) - (4.18.1907.16384) = C:\Windows\System32\SecurityHealthService.exe 7428 | [Owner : roman's vil6 suite |Parent : 1220] - (.Microsoft Corporation - Microsoft OneDrive.) - (22.238.1114.2) = C:\Users\roman's vil6 suite\AppData\Local\Microsoft\OneDrive\OneDrive.exe 8156 | [Owner : roman's vil6 suite |Parent : 8120] - (.Advanced Micro Devices Inc. - Catalyst Control Center: Monitoring program.) - (4.5.0.0) = C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe 3500 | [Owner : roman's vil6 suite |Parent : 416] - (.Microsoft Corporation - Runtime Broker.) - (10.0.19041.746) = C:\Windows\System32\RuntimeBroker.exe 7736 | [Owner : roman's vil6 suite |Parent : 8156] - (.Advanced Micro Devices Inc. - Catalyst Control Center: Host application.) - (4.5.0.0) = C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe 5596 | [Owner : roman's vil6 suite |Parent : 956] - (.Microsoft Corporation - Processus hôte pour les services Windows.) - (10.0.19041.1806) = C:\Windows\System32\svchost.exe 5496 | [Owner : roman's vil6 suite |Parent : 8156] - (.Advanced Micro Devices Inc. - Catalyst Control Center: Host application.) - (4.5.0.0) = C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe 5312 | [Owner : roman's vil6 suite |Parent : 2028] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 5216 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 6212 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 8108 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 4028 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 7972 | [Owner : roman's vil6 suite |Parent : 416] - (.Microsoft Corporation - Windows Defender SmartScreen.) - (10.0.19041.2251) = C:\Windows\System32\smartscreen.exe 6044 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 3260 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 5528 | [Owner : roman's vil6 suite |Parent : 416] - (.Microsoft Corporation - .) - (121.9202.4105.0) = C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe 4744 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 1256 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 8332 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2052 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 7008 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 6716 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2124 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 3064 | [Owner : roman's vil6 suite |Parent : 416] - (.Microsoft Corporation - Application Frame Host.) - (10.0.19041.746) = C:\Windows\System32\ApplicationFrameHost.exe 1044 | [Owner : roman's vil6 suite |Parent : 416] - (.Microsoft Corporation - Windows Defender application.) - (10.0.19041.2075) = C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe 5848 | [Owner : roman's vil6 suite |Parent : 416] - (.Microsoft Corporation - Windows Security Health Host.) - (4.18.1907.16384) = C:\Windows\System32\SecurityHealthHost.exe 6424 | [Owner : Aucun |Parent : 416] - (.Microsoft Corporation - Windows Security Health Host.) - (4.18.1907.16384) = C:\Windows\System32\SecurityHealthHost.exe 6804 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 3652 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2068 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 1892 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 7368 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 9164 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 6492 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 7732 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 8064 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 3624 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 7376 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 6452 | [Owner : Aucun |Parent : 6388] - (. - Usb Anti-Malware.) - (11.0.4.2) = C:\Program Files (x86)\UsbFix\UsbFix.exe 9004 | [Owner : roman's vil6 suite |Parent : 5312] - (.Microsoft Corporation - Microsoft Edge.) - (108.0.1462.46) = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 4552 | [Owner : Aucun |Parent : 1264] - (. - Real Time Protection for UsbFix Anti-Malware Professionnal.) - (10.0.3.3) = C:\Program Files (x86)\UsbFix\Modules\UsbFixMonitor.exe 8472 | [Owner : Aucun |Parent : 6452] - (.Microsoft Corporation - Bloc-notes.) - (10.0.19041.1) = C:\Windows\System32\notepad.exe 5076 | [Owner : Système |Parent : 3576] - (.Microsoft Corporation - Microsoft Windows Search Protocol Host.) - (7.0.19041.2193) = C:\Windows\System32\SearchProtocolHost.exe 5112 | [Owner : Système |Parent : 3576] - (.Microsoft Corporation - Microsoft Windows Search Filter Host.) - (7.0.19041.2193) = C:\Windows\System32\SearchFilterHost.exe 7308 | [Owner : roman's vil6 suite |Parent : 3576] - (.Microsoft Corporation - Microsoft Windows Search Protocol Host.) - (7.0.19041.2193) = C:\Windows\System32\SearchProtocolHost.exe 8680 | [Owner : roman's vil6 suite |Parent : 416] - (.Microsoft Corporation - Runtime Broker.) - (10.0.19041.746) = C:\Windows\System32\RuntimeBroker.exe ¤¤¤¤¤¤¤¤¤¤ # Winlogon user ¤¤¤¤¤¤¤¤¤¤ # Winlogon machine Repaired : [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon]~[userinit] : -> C:\Windows\SYSWOW64\userinit.exe, ¤¤¤¤¤¤¤¤¤¤ # SafeBoot Safeboot Keys are O.K Alternate shell is OK ! � ¤¤¤¤¤¤¤¤¤¤ | Winsock ¤¤¤¤¤¤¤¤¤¤ # IFEO ¤¤¤¤¤¤¤¤¤¤ # Mountpoints2 ¤¤¤¤¤¤¤¤¤¤ # Windows [HKLM\Software\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]~[Shell] : SYS:Microsoft\Windows NT\CurrentVersion\Winlogon [HKLM\Software\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini]~[winlogon] : SYS:Microsoft\Windows NT\CurrentVersion\Winlogon [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]~[Shell] : SYS:Microsoft\Windows NT\CurrentVersion\Winlogon ¤¤¤¤¤¤¤¤¤¤ # Security center Repaired : [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}]~[Autostart] : -> C:\Windows\System32\ActionCenter.dll ¤¤¤¤¤¤¤¤¤¤ # Services Impossible to restore service : BROWSER Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\Compbatt]~[Start] : -> 0 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\srService]~[Start] : -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\PlugPlay]~[Start] : 3 -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\Parvdm]~[Start] : -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\NVSvc]~[Start] : -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\NIHardwareService]~[Start] : -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\IKEEXT]~[Start] : 3 -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\IAStorDataMgrsvc]~[Start] : -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\lmhosts]~[Start] : 3 -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\agp440]~[Start] : -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\Browser]~[Start] : -> 3 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\ERSvc]~[Start] : -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\Bits]~[Start] : 3 -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\EapHost]~[Start] : 3 -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\Wlansvc]~[Start] : 3 -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess]~[Start] : 3 -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\wuauserv]~[Start] : 3 -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\wudfsvc]~[Start] : -> 2 Repaired : [HKLM\SYSTEM\CurrentControlSet\Services\WerSvc]~[Start] : 3 -> 2 ¤¤¤¤¤¤¤¤¤¤ # Internet Explorer ¤¤¤¤¤¤¤¤¤¤ # reparsepoint ¤¤¤¤¤¤¤¤¤¤ # Offsets ¤¤¤¤¤¤¤¤¤¤ # Files | Folders | Registry Moved to quarantine successfully : C:\Users\roman's vil6 suite\Desktop\download Moved to quarantine successfully : L:\Driver_Updater.exe Moved to quarantine successfully : L:\FRST64-2.1.exe Moved to quarantine successfully : L:\hmpalert3.exe Moved to quarantine successfully : L:\setup.exe Will be moved in quarantine at reboot : C:\DumpStack.log.tmp Will be moved in quarantine at reboot : L:\msdownld.tmp Moved to quarantine successfully : D:\DumpStack.log.tmp Will be moved in quarantine at reboot : C:\DumpStack.log.tmp ¤¤¤¤¤¤¤¤¤¤ # ADS ¤¤¤¤¤¤¤¤¤¤ # Prefetch cleaned D:\ : Vaccinated (Vaccin created by Pre_Scan) G:\ : Vaccinated (Vaccin created by Pre_Scan) L:\ : Vaccinated (Vaccin created by Pre_Scan) ¤¤¤¤¤¤¤¤¤¤ | Hidden files ~ [Drive Z:] : Hidden : 103 | Restored : 103 ~ [Drive C:] : Hidden : 6 | Restored : 5 ~ [Program Files] : Hidden : 65 | Restored : 65 ~ [Users] : Hidden : 2 | Restored : 2 ~ [Documents] : Hidden : 3 | Restored : 3 ~ [Searches] : Hidden : 2 | Restored : 2 ~ [Windows] : Hidden : 68 | Restored : 67 ~ [Start Menu | Programs | Startup] : Hidden : 1 | Restored : 1 ~ [AppData] : Hidden : 4 | Restored : 4 End : 16:12:49 ¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤ - 249