Black screen with cursor after malwarebytes scan

[FlorisvH]

Hello,

I had some adware on my pc and after I noticed I downloaded malwarebytes. Scan ran and gave some threats, and after the restart it went to a black screen.

I downloaded FRST and ran it. The log is attached.

Thanks in advance,

Floris

FRST.txt

[kevinf80]

Hello FlorisH and welcome to Malwarebytes,

Save the attached file fixlist.txt to your flash drive, same place as FRST.
Now please enter System Recovery Options as you did to get the log.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Next,

Re-boot your system, does it now start ok in Normal mode, if so do the following:

Totally Remove Malwarebytes from your system: Download the latest version of Malwarebytes cleanup tool from here: https://downloads.malwarebytes.com/file/mb_clean and save to your Desktop.. If applicable, backup your Malwarebytes license key information and deactivate the product. Close all open applications and deactivate Malwarebytes <---- Very important, do not miss that step To deactivate Malwarebytes: Right click on tray icon, from the opened list select "Quit Malwarebytes" an UAC alert will open, select "Yes" to deactivate Malwarebytes...   Double-click mb-clean.exe to run it A prompt to confirm the cleanup will appear, select Yes or No Yes - will proceed with the cleanup process <---- Select this option to start the tool No - will exit the utility The Utility will launch a Command Prompt window which will disappear once the the cleanup process completes. Once completed, a log file ("mb-cleanresult.txt") will be on your desktop and you'll be prompted to reboot We recommend an immediate reboot <--- Do Not miss out this step Suppressing the reboot may result in an incomplete cleanup Upon reboot Malwarebytes will be totally removed from your system To re-install Malwarebytes: Download Malwarebytes version 3 from the following link: https://www.malwarebytes.com/mwb-download/thankyou/   Double click on the installer and follow the prompts. If necessary select the Blue Help tab for video instructions.... When the install completes and is updated do the following: Open Malwarebytes, select > "settings" > "protection tab" Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Go back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes deal with any found entries... Then select "Export Summary" then "Text File (*.txt)" name that log and save , you can copy or attach that to your reply... Next, Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status...   Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans" Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Let me see the log from Malwarbytes and both logs from FRST... Thank you, Kevin...

 

fixlist.txt

[FlorisvH]

First of all, thanks for the answer.

I ran the fix, and after the reboot it went to black screen again. Attached is the fixlog.

Fixlog.txt

[kevinf80]

Can you run FRST scan again from RE and post a fresh log...

[FlorisvH]

I'm sorry, I misunderstood.

Attached is the new log.

FRST.txt

[kevinf80]

Save the attached file fixlist.txt to your flash drive, same place as FRST.
Now please enter System Recovery Options as you did to get the log.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Post the produced log.......

Re-boot and see if system will boot normally, if not see if it will boot to safe mode with networking...

fixlist.txt

[FlorisvH]

Both normal boot and safe mode with networking result in the black screen.

I ran the scan again after the last fix, so i added them both.

Fix result of Farbar Recovery Scan Tool (x64) Version: 16-11-2017
Ran by SYSTEM (17-11-2017 17:50:06) Run:3
Running from e:\
Boot Mode: Recovery
==============================================

fixlist content:
*****************
start
S1 ESProtectionDriver; \??\C:\WINDOWS\system32\drivers\mbae64.sys [X]
LastRegBack: 2017-11-13 03:09
end
*****************

HKLM\System\ControlSet001\Services\ESProtectionDriver => key removed successfully
ESProtectionDriver => service removed successfully
DEFAULT => copied successfully to System32\config\HiveBackup
DEFAULT => restored successfully from registry back up
SAM => copied successfully to System32\config\HiveBackup
SAM => restored successfully from registry back up
SECURITY => copied successfully to System32\config\HiveBackup
SECURITY => restored successfully from registry back up
SOFTWARE => Could not copy
SOFTWARE => Could not restore from registry back up
SYSTEM => Could not copy
SYSTEM => Could not restore from registry back up

==== End of Fixlog 17:50:06 ====

FRST.txt

[kevinf80]

Do you have Windows Installation DVD, or Windows Recovery Drive...

[FlorisvH]

I have the installation disk, but not the recovery drive. So there is no other way than a complete reinstallation?

[kevinf80]

As you have the installation DVD you do not need a recovery drive, that option you can create later for future use if this fix is successful..   Go to this link: https://www.howtogeek.com/131907/how-to-create-and-use-a-recovery-drive-or-system-repair-disc-in-windows-8/ Scroll down to the following header instruction section: Using a Recovery Drive or System Repair Disc You can use your installation DVD to boot and follow the repair option, from there use "REFRESH" that will install windows 10 again, but will preserve personal data, files, music. videos etc. This link: https://www.howtogeek.com/129815/beginner-geek-how-to-change-the-boot-order-in-your-computers-bios/ explains how to boot from a CD/DVD.... Let me know if that helps you..... Thanks, Kevin...

[FlorisvH]

Okay, so when I was finding the dvd suddenly a program ran on my pc. It is a standard update checker. After that I realised I might have explained it wrong. 

I get a black screen after I log in. 

I realised I could try and get into task messenger and run explorer.exe. And that worked. I think this will help lots, and I don't think I need to do any systemrepair things for now?

Thanks for the help so far!!

[kevinf80]

Do you now boot ok, log in correctly and have access to your Desktop...?

[FlorisvH]

No, after I log in I still get the black screen, but I can access my pc via task manager and running explorer.exe. So I do have access to desktop.

[kevinf80]

Ok, from your desktop lets run FRST and seewhat the logs show..

Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status...   Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans" Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Thanks, Kevin...

[FlorisvH]

Allright, I think it's sortof fixed. I tried making a new local account on my pc. And there is no problem there. I think something is wrong with the explorer.exe in my main account. But I can access everything now, and ran 2 different antivirus. So I think I'm clean now. 

Thanks for the help and your time!

[kevinf80]

Thanks for the update FlorishH, definitely sound like a busted profile/account of sorts... https://www.techbout.com/fix-corrupt-user-profile-windows-10-9139/

If you do not need any further help I guess we can close out...

Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[kevinf80]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!