Hack Forums
Windows 10 Explorer.exe Constant Restart - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Windows 10 Explorer.exe Constant Restart (/showthread.php?tid=5261193)

Pages: Pages 1 2


Windows 10 Explorer.exe Constant Restart - Topkek_Is_Life - May 6, 2016

As of recently I have been having a problem where explorer.exe is crashing and restarting every minute or two. Nothing else too weird is happening, so I would assume it is just a problem with windows, but I can never be too sure.

Farbar logs

FRST: http://pastebin.com/K5KZRyav
Additional: http://pastebin.com/Ug0xzdRS

TDSS Log

Log: http://pastebin.com/6crUziZ6


* - ProtectNull™ - May 6, 2016

Hello I am here to assist you,

Please read these before we start with the procedures,
  • Please do not follow any other instructions other than mine, as they can cause conflict between my fixes.

  • Please be patient, as you can see I have other people to assist.

  • Please consider backing up any important files incase, (usually I will create System Restore Points if needed)

  • Please read the instructions carefully, as it can help a lot.

  • Do not login to valuable sites such as banking etc.



[img]http://nilights.info/wp-content/uploads/2014/05/divider.png[/img]


Download this here ESET Online Scanner
  • Turn off the real time scanner of any existing antivirus program while performing the online scan.

  • Tick the box next to YES, I accept the Terms of Use.

  • Click Start

  • Make sure that the option Remove found threats is unticked

  • Click on Advanced Settings and ensure these options are ticked

  • 1) Scan for potentially unwanted applications

  • 2) Scan for potentially unsafe applications

  • 3) Enable Anti-Stealth Technology

  • Click Scan

  • Wait for the scan to finish

  • If any threats were found, click the 'List of found threats' , then click Export to text file....

  • Save it to your desktop, then please copy and paste that log to pastebin and paste the pastebin link to your next reply.





* - Topkek_Is_Life - May 7, 2016

I got no found threats. I assume this means a problem with windows then?


* - ProtectNull™ - May 8, 2016

(May 7, 2016 09:06 PM)Topkek_Is_Life Wrote:  I got no found threats. I assume this means a problem with windows then?

Please run a chkdisk.

CMD as admin then do 'chkdisk C:'


* - Topkek_Is_Life - May 8, 2016

I am getting

Code
'chkdisk' is not recognized as an internal or external command, operable program or batch file.

Spoiler (Click to View)


* - ProtectNull™ - May 8, 2016

(May 8, 2016 04:04 PM)Topkek_Is_Life Wrote:  I am getting

Code
'chkdisk' is not recognized as an internal or external command, operable program or batch file.

Spoiler (Click to View)

Should be chkdsk, my bad. Its late here. 🤝


* - Topkek_Is_Life - May 9, 2016

Got
Code
Usn Journal verification completed.
The Volume Bitmap is incorrect.
Windows has checked the file system and found problems.
Please run chkdsk /scan to find the problems and queue them for repair.

976181247 KB total disk space.
534456548 KB in 459961 files.
    329080 KB in 184070 indexes.
         0 KB in bad sectors.
    926207 KB in use by the system.
     65536 KB occupied by the log file.
440469412 KB available on disk.

      4096 bytes in each allocation unit.
244045311 total allocation units on disk.
110117353 allocation units available on disk.

but when I ran chkdsk /scan I got

Code
184051 data files processed.
CHKDSK is verifying Usn Journal...


  35512544 USN bytes processed.

Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

976181247 KB total disk space.
533840936 KB in 457101 files.
    328112 KB in 184052 indexes.
         0 KB in bad sectors.
    927551 KB in use by the system.
     65536 KB occupied by the log file.
441084648 KB available on disk.

      4096 bytes in each allocation unit.
244045311 total allocation units on disk.
110271162 allocation units available on disk.



* - ProtectNull™ - May 9, 2016

(May 9, 2016 02:34 PM)Topkek_Is_Life Wrote:  Got
Code
Usn Journal verification completed.
The Volume Bitmap is incorrect.
Windows has checked the file system and found problems.
Please run chkdsk /scan to find the problems and queue them for repair.

976181247 KB total disk space.
534456548 KB in 459961 files.
    329080 KB in 184070 indexes.
         0 KB in bad sectors.
    926207 KB in use by the system.
     65536 KB occupied by the log file.
440469412 KB available on disk.

      4096 bytes in each allocation unit.
244045311 total allocation units on disk.
110117353 allocation units available on disk.

but when I ran chkdsk /scan I got

Code
184051 data files processed.
CHKDSK is verifying Usn Journal...


  35512544 USN bytes processed.

Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

976181247 KB total disk space.
533840936 KB in 457101 files.
    328112 KB in 184052 indexes.
         0 KB in bad sectors.
    927551 KB in use by the system.
     65536 KB occupied by the log file.
441084648 KB available on disk.

      4096 bytes in each allocation unit.
244045311 total allocation units on disk.
110271162 allocation units available on disk.

Alright, I'm doing to do a few things before we go on the main fixes.
  • Please download RougeKiller and save the file to your Desktop.

  • Right-Click RougeKiller.exe and select Run as Administrator

  • Click Scan. Do not use the computer during the scan.

  • A log will be created and saved to the root directory. Paste the file contents to pastebin.com and post the link in your next reply.



[img]http://nilights.info/wp-content/uploads/2014/05/divider.png[/img]

  • Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.

  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

  • The tool will open and start scanning your system.

  • Please be patient as this can take a while to complete depending on your system's specifications.

  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

  • Post the contents of JRT.txt into your next message.





* - Topkek_Is_Life - May 10, 2016

RogueKiller: http://pastebin.com/4wAVgM1P

JRT: http://pastebin.com/iNLrvg7f


* - ProtectNull™ - May 10, 2016

(May 10, 2016 01:29 PM)Topkek_Is_Life Wrote:  RogueKiller: http://pastebin.com/4wAVgM1P

JRT: http://pastebin.com/iNLrvg7f

Download this here AdwCleaner
  • Double click on AdwCleaner.exe to run the tool.

  • Click on the Scan button.

  • When it's done you'll see: Pending: Please uncheck elements you don't want removed.

  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.

  • Look over the log especially under Files/Folders for any program you want to save.

  • If there's a program you may want to save, just uncheck it from AdwCleaner.

  • If you're not sure, post the log for review in pastebin.com and paste link in next reply.

  • If you're ready to clean it all up, click the Clean button.

  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.

  • Copy and paste the contents of that logfile in your next reply.

  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.



[img]http://nilights.info/wp-content/uploads/2014/05/divider.png[/img]

Download Farbar Recovery Scan Tool(x64) or Farbar Recovery Scan Tool(x32/x86) and save it to your Desktop.
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

  • Make sure Addition.txt is checked

  • Press the Scan button.

  • It will produce a log called FRST.txt and Addition.txt in the same directory the tool is run from.

  • Copy the contents inside FRST.txt and Addition.txt to Pastebin.com in separate links.

  • Please copy and paste the links back here.

    Code
    FRST Log:
    Addition Log:






* - Topkek_Is_Life - May 11, 2016

FRST: http://pastebin.com/0WnPWmK1
Additional: http://pastebin.com/3Dyh4ciW
AdwCleaner: http://pastebin.com/8BuzUUcV


* - ProtectNull™ - May 12, 2016

(May 11, 2016 02:37 PM)Topkek_Is_Life Wrote:  FRST: http://pastebin.com/0WnPWmK1
Additional: http://pastebin.com/3Dyh4ciW
AdwCleaner: http://pastebin.com/8BuzUUcV

Please try doing FRST again but ran as Administrator. 🤝


* - Topkek_Is_Life - May 12, 2016

Sorry about that
FRST: http://pastebin.com/ALCxk1eq


* - ProtectNull™ - May 12, 2016

(May 12, 2016 12:18 PM)Topkek_Is_Life Wrote:  Sorry about that
FRST: http://pastebin.com/ALCxk1eq

Please open notepad and copy paste the contents in the codebox below. (Do not include "Code:" tags)


Code
start
CreateRestorePoint:
ShortcutTarget: Curse.lnk -> C:\Users\Bryce\AppData\Roaming\Curse Client\Bin\Curse.exe (No File)
GroupPolicyScripts: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [!BTSync2.3.3Done] -> {581FFA04-FC33-0003-0302-95003A5CDE89} =>  No File
ShellIconOverlayIdentifiers-x32: [!BTSync2.3.3RO] -> {581FFA03-FC33-0003-0302-95003A5CDE89} =>  No File
ShellIconOverlayIdentifiers-x32: [!BTSync2.3.3RW] -> {581FFA02-FC33-0003-0302-95003A5CDE89} =>  No File
ShellIconOverlayIdentifiers: [!BTSync2.3.3Done] -> {581FFA04-FC33-0003-0302-95003A5CDE89} => C:\ProgramData\BitTorrent Sync\ShellExtensionOverlay64_128.dll [2016-03-09] ()
ShellIconOverlayIdentifiers: [!BTSync2.3.3RO] -> {581FFA03-FC33-0003-0302-95003A5CDE89} => C:\ProgramData\BitTorrent Sync\ShellExtensionOverlay64_128.dll [2016-03-09] ()
ShellIconOverlayIdentifiers: [!BTSync2.3.3RW] -> {581FFA02-FC33-0003-0302-95003A5CDE89} => C:\ProgramData\BitTorrent Sync\ShellExtensionOverlay64_128.dll [2016-03-09] ()
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
HKU\S-1-5-21-2190844961-839790844-1856883618-1006\...\Run: [Clownfish] => 0
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job =>  <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job =>  <==== ATTENTION
Task: C:\WINDOWS\Tasks\ASC9_SkipUac_Bryce.job =>
Task: C:\WINDOWS\Tasks\Uninstaller_SkipUac_Gaming_Account.job =>
MSCONFIG\startupreg: OneDrive => "c:\users\gaming account\appdata\local\microsoft\onedrive\onedrive.exe" /background
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [DfsMgmt-In-TCP] => (Allow) %systemroot%\system32\dfsfrsHost.exe
CloseProcesses:
EmptyTemp:
Hosts:


Click File, Save As and enter fixlist.txt as the file name.

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system environment.
  • Run FRST/FRST64 and press the Fix button just once and wait.

  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

  • When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.





* - Topkek_Is_Life - May 13, 2016

Fixlog: http://pastebin.com/kDJwEyad