Problem z explorer.exe

[R0w3rs]

Witam. Mam problem z uruchomieniem explorer.exe podczas rozruchu systemu(jest tylko czarny ekran i kursor). Działa tylko uruchomienie manualne poprzez menadżer zadań. Wiem, że na forach różnych były różne podobne tematy, jednak każdy skrypt jest inny. Bardzo proszę o pomoc i z góry dziękuję

Extras.TxtPobieranie informacji ...

OTL.TxtPobieranie informacji ...

[picasso]

Temat przenoszę do działu Windows. Oznak infekcji brak.

 

1. Na początek zredukuj ilość programów uruchamianych przy starcie.

- W systemie widać m.in. MBAM, a na forum były przypadki czarnego ekranu z jego winy. Czyli odinstaluj MBAM.

- Od razu też sugeruję pozbyć się IObit Advanced SystemCare 6. IOBit to firma, która nie budzi zaufania (w przeszłości m.in. afera z kradzieżą bazy MBAM, podejrzane relacje partnerskie), a instalatory mają adware.

- Dodatkowo odinstaluj śmieci / resztki: Internet Explorer Toolbar 4.6 by SweetPacks, Minilyrics, LiveUpdate (Symantec Corporation).

 

2. Po deinstalacjach usuń sobie jeszcze puste wpisy i szczątki adware. Instrukcje w spoilerze.

 

 

  Pokaż ukrytą zawartość

 

1. Uruchom OTL i w sekcji Własne opcje skanowania / skrypt wklej:

 

:OTL
IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2481033
IE - HKLM\..\SearchScopes\{C00616CF-AFC0-4A22-8A72-306AF067ACC2}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1602&query={searchTerms}&invocationType=tb50hpcnnbie7-pl-pl
IE - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\URLSearchHook: {d43723ae-1ae1-4a25-a6a4-bf0929273cab} - No CLSID value found
IE - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\SearchScopes\{88FB16D2-04EA-4ffe-8079-CFF68F1B9CE6}: "URL" = http://www.search-results.com/web?q={searchTerms}&o=15868&l=dis&prt=BDIE&chn=retail&geo=PL&ver=3.0.0.11
IE - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2481033
IE - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\SearchScopes\{C00616CF-AFC0-4A22-8A72-306AF067ACC2}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1602&query={searchTerms}&invocationType=tb50hpcnnbie7-pl-pl
IE - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - No CLSID value found.
O2 - BHO: (no name) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - No CLSID value found.
O3 - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\Toolbar\WebBrowser: (no name) - {D43723AE-1AE1-4A25-A6A4-BF0929273CAB} - No CLSID value found.
O4 - HKLM..\Run: [symLnch] "C:\Program Files\Common Files\Symantec Shared\SymSetup\{C1C185CA-C531-49F5-A6FA-B838405A049D}_15_5_0_23\Support\SymLnch\SymLnch.exe" "C:\PROGRA~1\COMMON~1\SYMANT~1\SymSetup\{C1C18~1\Setup.exe" " /X" File not found
O8 - Extra context menu item: &Wyszukiwarka na pasku narzędzi AOL - C:\ProgramData\AOL\ieToolbar\resources\pl-PL\local\search.html ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Reg Error: Value error.)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 8\LiveTunerService.exe -- (WO_LiveService)
SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe -- (FirebirdServerDefaultInstance)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance)
 
:Commands
[emptytemp]

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Klik w Wykonaj skrypt. Zatwierdź restart systemu. W katalogu C:\_OTL powstanie log z wynikami usuwania. Przedstaw go.

 

2. Uruchom AdwCleaner i zastosuj Usuń. Na dysku C powstanie log z usuwania. Przedstaw go.

 

 

 

 

 

.

[R0w3rs]

Niestety, póki co explorer nie działa. Oto logi:

 

  Pokaż ukrytą zawartość

 

All processes killed

Error: Unable to interpret <IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2481033> in the current context!

Error: Unable to interpret <IE - HKLM\..\SearchScopes\{C00616CF-AFC0-4A22-8A72-306AF067ACC2}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1602&query={searchTerms}&invocationType=tb50hpcnnbie7-pl-pl> in the current context!

Error: Unable to interpret <IE - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\URLSearchHook: {d43723ae-1ae1-4a25-a6a4-bf0929273cab} - No CLSID value found> in the current context!

Error: Unable to interpret <IE - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\SearchScopes\{88FB16D2-04EA-4ffe-8079-CFF68F1B9CE6}: "URL" = http://www.search-results.com/web?q={searchTerms}&o=15868&l=dis&prt=BDIE&chn=retail&geo=PL&ver=3.0.0.11> in the current context!

Error: Unable to interpret <IE - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2481033> in the current context!

Error: Unable to interpret <IE - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\SearchScopes\{C00616CF-AFC0-4A22-8A72-306AF067ACC2}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1602&query={searchTerms}&invocationType=tb50hpcnnbie7-pl-pl> in the current context!

Error: Unable to interpret <IE - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}> in the current context!

Error: Unable to interpret <O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.> in the current context!

Error: Unable to interpret <O2 - BHO: (no name) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - No CLSID value found.> in the current context!

Error: Unable to interpret <O2 - BHO: (no name) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - No CLSID value found.> in the current context!

Error: Unable to interpret <O3 - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.> in the current context!

Error: Unable to interpret <O3 - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.> in the current context!

Error: Unable to interpret <O3 - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.> in the current context!

Error: Unable to interpret <O3 - HKU\S-1-5-21-2064861132-3301118621-3301976938-1000\..\Toolbar\WebBrowser: (no name) - {D43723AE-1AE1-4A25-A6A4-BF0929273CAB} - No CLSID value found.> in the current context!

Error: Unable to interpret <O4 - HKLM..\Run: [symLnch] "C:\Program Files\Common Files\Symantec Shared\SymSetup\{C1C185CA-C531-49F5-A6FA-B838405A049D}_15_5_0_23\Support\SymLnch\SymLnch.exe" "C:\PROGRA~1\COMMON~1\SYMANT~1\SymSetup\{C1C18~1\Setup.exe" " /X" File not found> in the current context!

Error: Unable to interpret <O8 - Extra context menu item: &Wyszukiwarka na pasku narzędzi AOL - C:\ProgramData\AOL\ieToolbar\resources\pl-PL\local\search.html ()> in the current context!

Error: Unable to interpret <O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Reg Error: Value error.)> in the current context!

Error: Unable to interpret <SRV - File not found [Auto | Stopped] -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 8\LiveTunerService.exe -- (WO_LiveService)> in the current context!

Error: Unable to interpret <SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe -- (FirebirdServerDefaultInstance)> in the current context!

Error: Unable to interpret <SRV - File not found [Auto | Stopped] -- C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance)> in the current context!

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: JULCIA

 

User: Madzia

->Temp folder emptied: 18966881 bytes

->Temporary Internet Files folder emptied: 12951916 bytes

->Java cache emptied: 72797375 bytes

->Google Chrome cache emptied: 7667947 bytes

->Flash cache emptied: 82122 bytes

 

User: Public

 

User: Romek

->Temp folder emptied: 54049787 bytes

->Temporary Internet Files folder emptied: 670242625 bytes

->Java cache emptied: 1636965 bytes

->Google Chrome cache emptied: 364743150 bytes

->Flash cache emptied: 39969579 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 25046565 bytes

RecycleBin emptied: 4985846952 bytes

 

Total Files Cleaned = 5 964,00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 08222013_192936

 

Files\Folders moved on Reboot...

 

PendingFileRenameOperations files...

 

Registry entries deleted on Reboot...

 

 

AdwCleanerS0.txtPobieranie informacji ...

AdwCleanerR0.txtPobieranie informacji ...

[picasso]

Skrypt OTL nie wykonany wcale, nie wkleiłeś dyrektywy :OTL. Powtarzaj zadanie. Po tym zrób nowy raport OTL z opcji Skanuj.

 

 

.

[R0w3rs]

Przepraszam, widać przeoczyłem. Prosze bardzo:

Extras.TxtPobieranie informacji ...

OTL.TxtPobieranie informacji ...