Black screen on startup after pceu virus fix

[f1rz3n]

okay, so here is the problem:

I had the pceu virus and have managed to get rid of that completely and now everything works fine except when I startup windows, after I logon there would just be a black screen and nothing else. I can get everything to work by pressing ctrl + alt + del and start task manager. Also, pressing the windows button does not open the start menu. Any ideas on how to solve this?

Thanks in advance

 

[marsmimar]

It's possible that there are still remnants of the pceu virus hiding within your computer. Or some other virus/malware. Regardless of which anti-virus product you used to remove pceu, no anti-virus product is 100% effective 100% of the time (if there was such a thing we'd all be using it.) Suggest you run a couple more free on-demand scanners. The more "no malware found" results the more likely your machine really is malware free.

Windows Defender Offline (disk must be prepared on a machine with no malware)

Malwarebytes

ESET Online Scanner

HitmanPro

SuperAntispyware

It's also possible that the virus may ahve damaged or corrupted system files. Run a system file checker scan from an elevated command prompt (option two.) If problems are found, run the scan 3 times and reboot the computer after each scan.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

If the black screen issue hasn't been fixed, you can try a startup repair. Run this tool 3 times and restart the computer after each scan no matter what the results are.

http://www.sevenforums.com/tutorials/681-startup-repair.html

Finally, one of the Forum experts prepared a couple of troubleshooting tutorials with some additional suggestions.

http://www.sevenforums.com/tutorials/219533-troubleshooting-windows-7-failure-boot.html

http://www.sevenforums.com/tutorials/220165-troubleshooting-steps-windows-7-a.html

 

[mmkarimi]

before that, I suggest you to make a new admin user, maybe this is the problem with your user,

 

[Kaktussoft]

so ctrl-alt-delete works. Can you start explorer.exe there?

 

[Kaktussoft]

Run regedit and goto key
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Do you see this?
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ExcludeProfileDirs"="AppData\\Local;AppData\\LocalLow;$Recycle.Bin"
"BuildNumber"=dword:00001db1
"FirstLogon"=dword:00000000
"ParseAutoexec"="1"

Please check if it's the same. No "shell" entry there?

 

[f1rz3n]

before that, I suggest you to make a new admin user, maybe this is the problem with your user,

I have tried with different users, no problem there.

so ctrl-alt-delete works. Can you start explorer.exe there?

Yes. (I can run everything fine just like normal with "run", I am using that laptop right now)

Run regedit and goto key
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Do you see this?
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ExcludeProfileDirs"="AppData\\Local;AppData\\LocalLow;$Recycle.Bin"
"BuildNumber"=dword:00001db1
"FirstLogon"=dword:00000000
"ParseAutoexec"="1"

Please check if it's the same. No "shell" entry there?

Yes, no "shell" entry.

Thank you guys for the quick replies as always.

 

[Kaktussoft]

When you run explorer.exe all desktop icons appear again? Also the system tray... everything is working then?

Only that user has problems... all other user accouns are working fine?

 

[f1rz3n]

When you run explorer.exe all desktop icons appear again? Also the system tray... everything is working then?

Only that user has problems... all other user accouns are working fine?

When I run explorer.exe it just opens a new explorer window and none of the usual thing happens so no icons / task bar / start button

 

[Kaktussoft]

Screen is totally blank, no gadgets, no background image,.... just blank?
Blinking cursor??

 

[f1rz3n]

I do have a cursor yes.

btw, the values in Winlogon in regedit are a bit different from yours:

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ExcludeProfileDirs"="AppData\\Local;AppData\\LocalLow;$Recycle.Bin"
"BuildNumber"=dword:00001db0 (7600)
"FirstLogon"=dword:00000000 (0)
"ParseAutoexec"="1"

does this help at all?

 

[Kaktussoft]

Did you customize a lot to that faulty account? I mean WORD/EXCEL/Internet explorer settings, background, that kind of things? Is it problem that acoount is deleted? (don't delete it yet!)

 

[Kaktussoft]

I do have a cursor yes.

btw, the values in Winlogon in regedit are a bit different from yours:

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ExcludeProfileDirs"="AppData\\Local;AppData\\LocalLow;$Recycle.Bin"
"BuildNumber"=dword:00001db0 (7600)
"FirstLogon"=dword:00000000 (0)
"ParseAutoexec"="1"

does this help at all?

That part of registry is fine. Normally cancelling the explorer process removes the system tray and all desktop icons as well. Rerunning explorer displays them again. Of course this is read somewhere from registry...don't know where.

Is that cursor really a text cursor? So not a mouse pointer?

 

[f1rz3n]

not the word/excel/ie
I have custom themes but shouldn't be a huge problem if I deleted the account, but does that delete anything in the documents and settings?
I also customized the explorer.exe before but that shouldn't be the problem because it used to work fine.

this only happened after I deleted the pceu virus off my laptop.

 

[f1rz3n]

my appologies, I just made a new admin account and it seems to be having the same problem, blank blue screen with cursor

 

[Kaktussoft]

my appologies, I just made a new admin account and it seems to be having the same problem, blank blue screen with cursor

Be more accurate please, I try to help. So it is not a user problem. All accounts have same problem?

Is it a mouse cursor or text cursor? And can you type text there?

 

[f1rz3n]

Yes all accounts have the same problem and it is a mouse cursor, I can't type there

 

[Kaktussoft]

Yes all accounts have the same problem and it is a mouse cursor, I can't type there

So a mouse pointer.... no idea why many call it a cursor. pffff

Try a "startup repair" and do "chkdsk/f c:" for elevated command prompt

 

[f1rz3n]

Yes all accounts have the same problem and it is a mouse cursor, I can't type there

So a mouse pointer.... no idea why many call it a cursor. pffff

Try a "startup repair" and do "chkdsk/f c:" for elevated command prompt

I have done a check disk before and found no problems, but I shall do a startup repair and then check disk after the current virus scan has finished.

 

[Kaktussoft]

If disk is fine and will find nothing. Even startup repair will most likely find anything. Though give it a try.
Most websites say it's caused by the "shell" key in registry I told you before. But it isn't in your case. All users have the problem so isn't cause by a user registry setting, but a system setting.


Are you sure it started with this problem just after virus removal?

 

[f1rz3n]

If disk is fine and will find nothing. Even startup repair will most likely find anything. Though give it a try.
Most websites say it's caused by the "shell" key in registry I told you before. But it isn't in your case. All users have the problem so isn't cause by a user registry setting, but a system setting.


Are you sure it started with this problem just after virus removal?

Yes, I was using the laptop fine before I got the virus.