Chyba pri štarte: "startupchecklibraly.dll" - pre Condera

Zpráva

GhostFox · #1 Příspěvek od **GhostFox** » 12 dub 2019 14:08

Zdravím ťa Conder.

Tak som si teda založil vlastnú tému. V prílohe sú logy z FRST.
Bohužiaľ ten fixlog z opravy predchádzajúceho erroru "winscomrssrv.dll", som už vymazal (áno, som zbrklý).

Prípadne je téma aj pre iných ľudí. Mám problém s errorom pri štarte Windowsu: "startupchecklibraly.dll".

Ďakujem za akúkoľvek pomoc pri riešení!

#2 Příspěvek od **Conder** » 12 dub 2019 23:21

Ahoj

Fixlog bude ulozeny aj v C:\FRST\Logs

Stiahni AdwCleaner: https://toolslib.net/downloads/finish/1/

Uloz na plochu a ukonci vsetky programy
Spusti AdwCleaner ako spravca
Odsuhlas licencne podmienky
Klikni na Skenovat nyni (Scan now) a pockaj na dokoncenie
Nechaj zaskrtnute vsetky nalezy
Klikni na Cisteni a opravy (Clean and Repair) a potvrd restart PC teraz
Po restartovani PC sa otvori AdwCleaner, klikni na Zobrazit soubor protokolu
Otvori sa log, jeho obsah sem skopiruj

GhostFox · #3 Příspěvek od **GhostFox** » 14 dub 2019 09:35

V prílohe je fixlog a tu je kód z programu AdwCleaner:

# -------------------------------
# Malwarebytes AdwCleaner 7.3.0.0
# -------------------------------
# Build: 04-04-2019
# Database: 2019-04-10.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 04-14-2019
# Duration: 00:00:00
# OS: Windows 10 Pro
# Cleaned: 0
# Failed: 0

***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [2550 octets] - [18/03/2019 22:26:43]
AdwCleaner[C00].txt - [2514 octets] - [18/03/2019 22:27:13]
AdwCleaner[S01].txt - [1388 octets] - [19/03/2019 18:31:16]
AdwCleaner[C01].txt - [1574 octets] - [19/03/2019 18:31:33]
AdwCleaner[S02].txt - [1493 octets] - [14/04/2019 10:30:46]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C02].txt ##########

#4 Příspěvek od **Conder** » 15 dub 2019 13:59

Pardon za zdrzanie.

Odkial presne je ten pouzity fixlist?

Poprosim o obidva nove logy z FRST (moznost Scan).

GhostFox · #5 Příspěvek od **GhostFox** » 16 dub 2019 20:25

Conder píše: Pardon za zdrzanie.

Odkial presne je ten pouzity fixlist?

Poprosim o obidva nove logy z FRST (moznost Scan).

Taktiež mi prepáč to zdržianie.

Neviem či som správne pochopil otázku, preto odpoviem radšej dvomi odpoveďami

1. Fixlist je z C/FRST/Logs
2. Fixlist je z témy v ktorej som ťa požiadal o pomoc.

V prílohe sú nové logy

#6 Příspěvek od **Conder** » 17 dub 2019 20:31

Mal som namysli prave ten druhy vyznam

Do tej predchadzajucej temy som ale taky fixlist neposielal (vid. tento fixlist), takze zrejme si pouzil nejaky iny fixlist. Problem je tiez, ze tym fixlistom sa odstranili sluzby, ktore sa odstranit nemali (ako som hovoril, fixlisty su urcene len pre konkretny PC resp. system a spustenie na inom PC moze sposobit skody).

Otvor poznamkovy blok (Win+R -> notepad -> enter)

Skopiruj nasledujuci text a vloz ho do poznamkoveho bloku:

Kód: Vybrat vše

Start
CloseProcesses:
CreateRestorePoint:

PowerShell: Get-ChildItem -Path "$ENV:USERPROFILE\Desktop" -Recurse -Force | Measure-Object -Property Length -Sum
PowerShell: Get-ComputerRestorePoint
ExportKey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv
ExportKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9675998-9B12-4560-8E98-A6CCCDE0BE18}
VirusTotal: C:\Program Files (x86)\Common Files\lyauaxEn.exe
VirusTotal: C:\Users\Daniel\AppData\Local\USoOGoo.exe
File: C:\Program Files (x86)\Common Files\lyauaxEn.exe
File: C:\Users\Daniel\AppData\Local\USoOGoo.exe

U0 Partizan; system32\drivers\Partizan.sys [X]
2019-04-16 21:21 - 2019-04-16 21:21 - 000000000 ____D C:\Users\Daniel\Downloads\FRST-OlderVersion
2018-04-12 01:34 - 2018-04-12 01:34 - 000060416 _____ (Microsoft Corporation) C:\Program Files (x86)\Common Files\lyauaxEn.exe
2019-02-22 17:19 - 2019-02-22 17:19 - 000000000 _____ () C:\Users\Daniel\AppData\Roaming\FC29FA0894FE.ini
2019-03-17 17:13 - 2019-03-17 17:13 - 000000002 _____ () C:\Users\Daniel\AppData\Local\imw.ini
2018-04-12 01:34 - 2018-04-12 01:34 - 000060416 _____ (Microsoft Corporation) C:\Users\Daniel\AppData\Local\USoOGoo.exe
Task: {0EEEDFCC-07BE-4211-8AA1-88283AE0D64E} - \GoogleUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {32D0A379-AF3E-44D4-9F22-61091ED055A3} - System32\Tasks\Microsoft\Windows\Application Experience\StartupCheckLibrary => rundll32.exe StartupCheckLibrary.dll,DllMainRunLibrary
Task: {85F9A445-7851-472E-B1AE-5F7BB907D3CE} - \Microsoft\Windows\WDI\SrvHost -> No File <==== ATTENTION
Task: {A8C7D4E7-B35C-4CFC-BA6A-E1FB6048D94F} - \GoogleUpdateTaskMachineUA -> No File <==== ATTENTION

Hosts:
EmptyTemp:
End

Uloz na plochu s nazvom fixlist.txt
Spusti znovu FRST a klikni na Fix
Po dokonceni si FRST vyziada restart PC, potvrd kliknutim na OK
Po restartovani PC bude na ploche subor Fixlog.txt, jeho obsah sem skopiruj

GhostFox · #7 Příspěvek od **GhostFox** » 22 dub 2019 18:54

Zdravím ťa.

Ospravedlňujem sa, že píšem až po pár dňoch, ale boli sviatky, a ja som nemal prístup na PC.
Error sa odstránil. Ďakujem ti mnohokrát za pomoc. Je to vlastne všetko? Nie je potrebné už nič opravovať?
P.S: Písal som ti na mail.

Kód: Vybrat vše

Fix result of Farbar Recovery Scan Tool (x64) Version: 22.04.2019
Ran by Daniel (22-04-2019 19:48:59) Run:2
Running from C:\Users\Daniel\Desktop
Loaded Profiles: Daniel (Available Profiles: Daniel)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:

PowerShell: Get-ChildItem -Path "$ENV:USERPROFILE\Desktop" -Recurse -Force | Measure-Object -Property Length -Sum
PowerShell: Get-ComputerRestorePoint
ExportKey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv
ExportKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9675998-9B12-4560-8E98-A6CCCDE0BE18}
VirusTotal: C:\Program Files (x86)\Common Files\lyauaxEn.exe
VirusTotal: C:\Users\Daniel\AppData\Local\USoOGoo.exe
File: C:\Program Files (x86)\Common Files\lyauaxEn.exe
File: C:\Users\Daniel\AppData\Local\USoOGoo.exe

U0 Partizan; system32\drivers\Partizan.sys [X]
2019-04-16 21:21 - 2019-04-16 21:21 - 000000000 ____D C:\Users\Daniel\Downloads\FRST-OlderVersion
2018-04-12 01:34 - 2018-04-12 01:34 - 000060416 _____ (Microsoft Corporation) C:\Program Files (x86)\Common Files\lyauaxEn.exe
2019-02-22 17:19 - 2019-02-22 17:19 - 000000000 _____ () C:\Users\Daniel\AppData\Roaming\FC29FA0894FE.ini
2019-03-17 17:13 - 2019-03-17 17:13 - 000000002 _____ () C:\Users\Daniel\AppData\Local\imw.ini
2018-04-12 01:34 - 2018-04-12 01:34 - 000060416 _____ (Microsoft Corporation) C:\Users\Daniel\AppData\Local\USoOGoo.exe
Task: {0EEEDFCC-07BE-4211-8AA1-88283AE0D64E} - \GoogleUpdateTaskMachineCore -> No File <==== ATTENTION
Task: {32D0A379-AF3E-44D4-9F22-61091ED055A3} - System32\Tasks\Microsoft\Windows\Application Experience\StartupCheckLibrary => rundll32.exe StartupCheckLibrary.dll,DllMainRunLibrary
Task: {85F9A445-7851-472E-B1AE-5F7BB907D3CE} - \Microsoft\Windows\WDI\SrvHost -> No File <==== ATTENTION
Task: {A8C7D4E7-B35C-4CFC-BA6A-E1FB6048D94F} - \GoogleUpdateTaskMachineUA -> No File <==== ATTENTION

Hosts:
EmptyTemp:
End
*****************

Processes closed successfully.
Restore point was successfully created.

========= Get-ChildItem -Path "$ENV:USERPROFILE\Desktop" -Recurse -Force | Measure-Object -Property Length -Sum =========



Count    : 15
Average  : 
Sum      : 6922166
Maximum  : 
Minimum  : 
Property : Length




========= End of Powershell: =========


========= Get-ComputerRestorePoint =========


CreationTime           Description                    SequenceNumber    EventType         RestorePointType      
------------           -----------                    --------------    ---------         ----------------      
1. 4. 2019 10:31:13    Windows Update                 4                 BEGIN_SYSTEM_C... 18                    
8. 4. 2019 21:21:19    Scheduled Checkpoint           5                 BEGIN_SYSTEM_C... 7                     



========= End of Powershell: =========

================== ExportKey: ===================

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv]
"Type"="32"
"Start"="3"
"ErrorControl"="1"
"ServiceSidType"="1"
"ImagePath"="C:\WINDOWS\system32\svchost.exe -k netsvcs -p"
"ObjectName"="LocalSystem"
"DependOnService"="rpcss"
"RequiredPrivileges"="SeAuditPrivilege*SeCreateGlobalPrivilege*SeCreatePageFilePrivilege*SeTcbPrivilege*SeAssignPrimaryTokenPrivilege*SeImpersonatePrivilege*SeIncreaseQuotaPrivilege*SeShutdownPrivilege*SeDebugPrivilege*SeB (the data entry has 215 more characters)."

=== End of ExportKey ===
================== ExportKey: ===================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9675998-9B12-4560-8E98-A6CCCDE0BE18}]
"AuthorizedCDFPrefix"=""
"Comments"=""
"Contact"="Default Company Name"
"DisplayVersion"="1.0.0"
"HelpLink"=""
"HelpTelephone"=""
"InstallDate"="20190219"
"InstallLocation"=""
"InstallSource"="C:\WINDOWS\System32\"
"ModifyPath"="MsiExec.exe /X{E9675998-9B12-4560-8E98-A6CCCDE0BE18}"
"NoModify"="1"
"Publisher"="Default Company Name"
"Readme"=""
"Size"=""
"EstimatedSize"="58"
"UninstallString"="MsiExec.exe /X{E9675998-9B12-4560-8E98-A6CCCDE0BE18}"
"URLInfoAbout"=""
"URLUpdateInfo"=""
"VersionMajor"="1"
"VersionMinor"="0"
"WindowsInstaller"="1"
"Version"="16777216"
"Language"="1033"
"DisplayName"="Installer"

=== End of ExportKey ===
VirusTotal: C:\Program Files (x86)\Common Files\lyauaxEn.exe => https://www.virustotal.com/file/6f55350ad77606c65c755dd2eec985c6969fcf30d3f03d308b9c4f555b3edda4/analysis/1555792052/
VirusTotal: C:\Users\Daniel\AppData\Local\USoOGoo.exe => https://www.virustotal.com/file/6f55350ad77606c65c755dd2eec985c6969fcf30d3f03d308b9c4f555b3edda4/analysis/1555792052/

========================= File: C:\Program Files (x86)\Common Files\lyauaxEn.exe ========================

C:\Program Files (x86)\Common Files\lyauaxEn.exe
File not signed
MD5: 07D7DE60D8A825D4FAEB94DB19623502
Creation and modification date: 2018-04-12 01:34 - 2018-04-12 01:34
Size: 000060416
Attributes: ----A
Company Name: Microsoft Corporation
Internal Name: msiexec
Original Name: msiexec.exe
Product: Windows Installer - Unicode
Description: Windows® installer
File Version: 5.0.17134.228 (WinBuild.160101.0800)
Product Version: 5.0.17134.228
Copyright: © Microsoft Corporation. All rights reserved.
VirusTotal: https://www.virustotal.com/file/6f55350ad77606c65c755dd2eec985c6969fcf30d3f03d308b9c4f555b3edda4/analysis/1555792052/

====== End of File: ======


========================= File: C:\Users\Daniel\AppData\Local\USoOGoo.exe ========================

C:\Users\Daniel\AppData\Local\USoOGoo.exe
File not signed
MD5: 07D7DE60D8A825D4FAEB94DB19623502
Creation and modification date: 2018-04-12 01:34 - 2018-04-12 01:34
Size: 000060416
Attributes: ----A
Company Name: Microsoft Corporation
Internal Name: msiexec
Original Name: msiexec.exe
Product: Windows Installer - Unicode
Description: Windows® installer
File Version: 5.0.17134.228 (WinBuild.160101.0800)
Product Version: 5.0.17134.228
Copyright: © Microsoft Corporation. All rights reserved.
VirusTotal: https://www.virustotal.com/file/6f55350ad77606c65c755dd2eec985c6969fcf30d3f03d308b9c4f555b3edda4/analysis/1555792052/

====== End of File: ======

HKLM\System\CurrentControlSet\Services\Partizan => removed successfully
Partizan => service removed successfully
"C:\Users\Daniel\Downloads\FRST-OlderVersion" => not found
C:\Program Files (x86)\Common Files\lyauaxEn.exe => moved successfully
C:\Users\Daniel\AppData\Roaming\FC29FA0894FE.ini => moved successfully
C:\Users\Daniel\AppData\Local\imw.ini => moved successfully
C:\Users\Daniel\AppData\Local\USoOGoo.exe => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0EEEDFCC-07BE-4211-8AA1-88283AE0D64E}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0EEEDFCC-07BE-4211-8AA1-88283AE0D64E}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{32D0A379-AF3E-44D4-9F22-61091ED055A3}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{32D0A379-AF3E-44D4-9F22-61091ED055A3}" => removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\Application Experience\StartupCheckLibrary => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Application Experience\StartupCheckLibrary" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{85F9A445-7851-472E-B1AE-5F7BB907D3CE}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{85F9A445-7851-472E-B1AE-5F7BB907D3CE}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WDI\SrvHost" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A8C7D4E7-B35C-4CFC-BA6A-E1FB6048D94F}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A8C7D4E7-B35C-4CFC-BA6A-E1FB6048D94F}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA" => not found
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 10510336 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 35900528 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 51656 B
Edge => 551049 B
Chrome => 354475001 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
LocalService => 0 B
NetworkService => 100628 B
NetworkService => 0 B
Daniel => 125652265 B

RecycleBin => 0 B
EmptyTemp: => 502.8 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 19:49:47 ====

#8 Příspěvek od **Conder** » 22 dub 2019 21:50

Este skontrolujeme zopar veci.

Spusti kontrolu integrity systemovych suborov:

Otvor Start, napis "cmd" (bez uvodzoviek), klikni pravym tlacitkom mysi na Prikazovy riadok a klikni na Spustit ako spravca

Skopiruj a spusti prikaz:

Kód: Vybrat vše

DISM.exe /Online /Cleanup-image /Restorehealth

Po dokonceni skopiruj a spusti druhy prikaz:
Kód: Vybrat vše
```
sfc /scannow
```

Po dokonceni obidvoch prikazov skopiruj a spusti tento prikaz:

Kód: Vybrat vše

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >> "%userprofile%\desktop\sfcdetails.txt" && copy %windir%\logs\dism\dism.log %userprofile%\desktop\dism.txt

Na ploche sa vytvoria subory sfcdetails.txt a dism.txt, tieto subory zabal ho do archivu RAR alebo ZIP a posli ako prilohu k dalsiemu prispevku
Restartuj PC a napis ako sa chova PC

GhostFox · #9 Příspěvek od **GhostFox** » 23 dub 2019 18:17

Ahoj,

súbory sú v prílohe.
PC sa správa normálne, nevidím nijaký rozdiel pred a po.

#10 Příspěvek od **Conder** » 24 dub 2019 16:24

Este by som odporucil preinstalovat Realtek audio ovladac, kedze podla toho fixlogu bola odstranena sluzba, ktora patri k tomuto Realteku. Odporucam stiahnut zo stranky vyrobcu zakladnej dosky.

VIRY.CZ

Chyba pri štarte: "startupchecklibraly.dll" - pre Condera

Chyba pri štarte: "startupchecklibraly.dll" - pre Condera

Re: Chyba pri štarte: "startupchecklibraly.dll" - pre Conder

Re: Chyba pri štarte: "startupchecklibraly.dll" - pre Conder

Re: Chyba pri štarte: "startupchecklibraly.dll" - pre Conder

Re: Chyba pri štarte: "startupchecklibraly.dll" - pre Conder

Re: Chyba pri štarte: "startupchecklibraly.dll" - pre Conder

Re: Chyba pri štarte: "startupchecklibraly.dll" - pre Conder

Re: Chyba pri štarte: "startupchecklibraly.dll" - pre Conder

Re: Chyba pri štarte: "startupchecklibraly.dll" - pre Conder

Re: Chyba pri štarte: "startupchecklibraly.dll" - pre Conder