Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Registry Console Window pops up several times / File System Error -214

Started by KassD7 , Jan 26 2017 05:32 AM

malware virus error windows10 Filesystemerror registryconsole

Please log in to reply

#31
KassD7

Posted 28 January 2017 - 01:40 PM

Member

Topic Starter
Member
33 posts

I created a new user with admin rights and the error is also found there... :smashcomp:

#32
RKinner

Posted 28 January 2017 - 02:13 PM

Malware Expert

Expert
24,625 posts

OK. Bring up FRST and put

26EE0668-A00A-44D7-9371-BEB064C98683

in the box then hit registry search or whatever it is called. It should give you a txt file. Please copy and paste it into a reply.

Then repeat the search for the second number

7881be6a-ce28-4676-a29e-eb907a5126c5

and post its results too.

#33
KassD7

Posted 28 January 2017 - 02:42 PM

Member

Topic Starter
Member
33 posts

First registry search result:

Farbar Recovery Scan Tool (x64) Version: 28-01-2017 01

Ran by Kassem (28-01-2017 22:22:07)

Running from C:\Users\Kassem\Desktop

Boot Mode: Normal

================== Search Registry: "26EE0668-A00A-44D7-9371-BEB064C98683" ===========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{26EE0668-A00A-44D7-9371-BEB064C98683}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DeviceUpdateLocations]

"::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\::{F1390A9A-A3F4-4E5D-9C5F-98F3BD8D935C},"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\::{BC48B32F-5910-47F5-8570-5074A8A5636A},"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\::{E413D040-6788-4C22-957E-175D1C513A34},"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7007ACC7-3202-11D1-AAD2-00805FC1270E}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}\::{d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}]

"ParsingName"="shell:::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{15eae92e-f17a-4431-9f28-805e482dafd4}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{df7266ac-9274-4867-8d55-3bd661de872d}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\OpenContainingFolderHiddenList]

"Start menu search results for Control Panel"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{26EE0668-A00A-44D7-9371-BEB064C98683}]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\DeviceUpdateLocations]

"::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0F214138-B1D3-4a90-BBA9-27CBC0C5389A}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\::{F1390A9A-A3F4-4E5D-9C5F-98F3BD8D935C},"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\::{BC48B32F-5910-47F5-8570-5074A8A5636A},"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\::{E413D040-6788-4C22-957E-175D1C513A34},"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7007ACC7-3202-11D1-AAD2-00805FC1270E}"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}\::{d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{de61d971-5ebc-4f02-a3a9-6c82895e5c04}]

"ParsingName"="shell:::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{15eae92e-f17a-4431-9f28-805e482dafd4}"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{df7266ac-9274-4867-8d55-3bd661de872d}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\OpenContainingFolderHiddenList]

"Start menu search results for Control Panel"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0"

[HKEY_USERS\S-1-5-21-198589097-2935813840-3369481996-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{C8BA9FB6-6100-45B6-A6CB-FD384DE84968}\RecentItems\{13B1DB41-4F02-4F0A-BE86-19EFF087D6C0}]

"Path"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\8\::{7B81BE6A-CE2B-4676-A29E-EB907A5126C5}"

====== End of Search ======

--------------------------------------------------------------------------------------------------------------------------------

Second registry search result:

There were errors, the text file was blank, I think you confused some '8's with 'B's, I am running it again.

Update:

Farbar Recovery Scan Tool (x64) Version: 28-01-2017 01

Ran by Kassem (28-01-2017 22:51:09)

Running from C:\Users\Kassem\Desktop

Boot Mode: Normal

================== Search Registry: "7B81BE6A-CE2B-4676-A29E-EB907A5126C5" ===========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b81be6a-ce2b-4676-a29e-eb907a5126c5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7b81be6a-ce2b-4676-a29e-eb907a5126c5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{7b81be6a-ce2b-4676-a29e-eb907a5126c5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}\::{d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{df7266ac-9274-4867-8d55-3bd661de872d}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{7b81be6a-ce2b-4676-a29e-eb907a5126c5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}\::{d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{df7266ac-9274-4867-8d55-3bd661de872d}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}"

"Path"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\8\::{7B81BE6A-CE2B-4676-A29E-EB907A5126C5}"

[HKEY_USERS\S-1-5-21-198589097-2935813840-3369481996-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]

"{7B81BE6A-CE2B-4676-A29E-EB907A5126C5} {000214E6-0000-0000-C000-000000000046} 0xFFFF"="0x0100000000000000561731CB7A16D201"

[HKEY_USERS\S-1-5-21-198589097-2935813840-3369481996-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]

"{7B81BE6A-CE2B-4676-A29E-EB907A5126C5} {000214E6-0000-0000-C000-000000000046} 0xFFFF"="0x0100000000000000E16EDD1A9E79D201"

====== End of Search ======

Edited by KassD7, 28 January 2017 - 02:51 PM.

#34
RKinner

Posted 28 January 2017 - 03:56 PM

Malware Expert

Expert
24,625 posts

If we look at this one:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a305ce99-f527-492b-8b1a-7e76fa98d6e4}]

"ParsingName"="::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}\::{d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}"

It has the complete text of your message (without the error).

{a305ce99-f527-492b-8b1a-7e76fa98d6e4}

From: https://msdn.microso...y/bb882665.aspx

AppUpdates

A305CE99-F527-492B-8B1A-7E76FA98D6E4

and from: http://www.techradar...g-secret-464668

shell:AppUpdatesFolder

Displays installed Windows Updates

Applies to Vista, 7, 8

so that might explain why you don't see your Windows Updates.

I also found this helpful hint which talks about the last GUID in the line:

http://forum.thewind...indows-8-a.html

Copy the next line:

C:\Windows\explorer.exe shell:::{d450a8a1-9568-45c7-9c0e-b4f9fb4537bd}

Open an elevated command prompt and right click and Paste (or edit then paste) and the copied line should appear. Hit Enter. Does the windows update window open or do you get an error. What does the error say? If the window opens is it empty?

#35
KassD7

Posted 28 January 2017 - 04:02 PM

Member

Topic Starter
Member
33 posts

It opens normally, the error only pops up when I open it this way (see attached figure):

Attached Thumbnails

#36
KassD7

Posted 28 January 2017 - 04:04 PM

Member

Topic Starter
Member
33 posts

This is my Updates window, I see a lot of old Office updates, should I remove them?

Attached Thumbnails

#37
RKinner

Posted 28 January 2017 - 04:31 PM

Malware Expert

Expert
24,625 posts

No best to leave them.

So it would seem that {d450a8a1-9568-45c7-9c0e-b4f9fb4537bd} is OK.

What about:

C:\Windows\explorer.exe shell:::{a305ce99-f527-492b-8b1a-7e76fa98d6e4}

(Opens the documents folder on my win 10)

C:\Windows\explorer.exe shell:::{df7266ac-9274-4867-8d55-3bd661de872d}

(says nothing associated with the GUID)

#38
KassD7

Posted 28 January 2017 - 04:35 PM

Member

Topic Starter
Member
33 posts

For both of the new commands I receive the message attached

Attached Thumbnails

#39
RKinner

Posted 28 January 2017 - 04:43 PM

Malware Expert

Expert
24,625 posts

Must have made an error before with the one that opened to documents. It gives me the same error you got.

Some of these are shell extensions so let's see if shellexview helps:

download ShellExView.

http://www.nirsoft.n...s/shexview.html

Use this download:

http://www.nirsoft.n...xview_setup.exe

Once you get it installed, run it and look in the third or fourth column from the RIGHT. It should say MICROSOFT. Click once or twice on MICROSOFT so that items with NO are at the top.

Select all of the NO items and then click on the red led looking icon in the upper left. This should disable all of the non-microsoft additions to Explorer. Reboot and see if you still get the errors.

#40
KassD7

Posted 28 January 2017 - 04:49 PM

Member

Topic Starter
Member
33 posts

The third column from the right is the File Size and the fourth is File Attributes, there are more than 10 columns; expand the window.

#41
RKinner

Posted 28 January 2017 - 04:54 PM

Malware Expert

Expert
24,625 posts

Probably a new version. There should still be one column with MICROSOFT at the top. Got to walk the dog now.

#42
KassD7

Posted 28 January 2017 - 05:06 PM

Member

Topic Starter
Member
33 posts

I got a bit confused, I would appreciate if you can download the new version and walk me through the process. Enjoy your walk!

#43
RKinner

Posted 28 January 2017 - 05:49 PM

Malware Expert

Expert
24,625 posts

Yes it's a new version since I last used it . MICROSOFT column is 7th from the right now just to the left of File Extensions. Looks like:

If you click on the MICROSOFT column it will sort things with the NO entries at the top. (If they are at the bottom you can just click on Microsoft again)

Then select all of the no entries and hit the red mark on the upper left. That will disable all of the non-microsoft items. Usually that's enough tho this time the problem may be Microsoft things. You have to either reboot or restart Explorer to have this take effect.

I see there is also a Microsoft entry called AllControlPanel Items. It is possible that disabling this one may stop the errors.

#44
KassD7

Posted 28 January 2017 - 06:43 PM

Member

Topic Starter
Member
33 posts

Okay so I first disabled all the NO elements, restarted and the error was still there. Then I disabled the All ControlPanels item, rebooted and the error still appears :no:

Should I enable them back?

#45
RKinner

Posted 28 January 2017 - 09:31 PM

Malware Expert

Expert
24,625 posts

guess so.

Copy the next line:

start ::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{7B81BE6A-CE2B-4676-A29E-EB907A5126C5}

Open an elevated command prompt and paste it in.

Does it work?

I think the error may be referring to a problem in

C:\Users\Kassem\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\Indexed\Settings\en-US

in this folder you will find a long list of different items. If you double click on one a new window will open up.

There is also a method discussed here for reindexing things:

https://answers.micr...56-cfc1834ae040

Back to Virus, Spyware, Malware Removal · Next Unread Topic →

Also tagged with one or more of these keywords: malware, virus, error, windows10, Filesystemerror, registryconsole

Security → Virus, Spyware, Malware Removal → Having Powersheel.exe Issues ... Need fixlist.txt Started by raj0171 , 19 Mar 2024 Virus, HELP, Malwarebytes	5 replies 2,672 views	DR M 06 Apr 2024
Security → Virus, Spyware, Malware Removal → HP desktop - google.com is in Norwegian [Solved] Started by wayneman50 , 23 Jul 2023 internet, google, virus and 1 more... 1 2 3	Hot 41 replies 24,300 views	wayneman50 17 Aug 2023
Security → Virus, Spyware, Malware Removal → Possible Malware infection - help request [Solved] Started by Maffu , 07 May 2023 malware, advapi and 1 more... 1 2 3 4	Hot 51 replies 12,735 views	DR M 26 Jun 2023
Security → Virus, Spyware, Malware Removal → Help getting started checking laptop for malware [Solved] Started by triedeverything , 12 Apr 2023 help, malware, spyware 1 2	Hot 19 replies 5,806 views	DR M 16 Apr 2023
Security → Virus, Spyware, Malware Removal → Virus Infection Started by ForrestGump , 05 Oct 2022 Virus 1 2 3 8 →	Hot 110 replies 16,008 views	RKinner 14 Nov 2022