Black Screen after Windows Logo - waits 2 minutes, then able to login

[bluejonny]

HI everyone

I am a noob here, so firstly can I say thanks in advance for any help you can give me on a frustrating problem. I also hope this is in the right place as it's not Blue screen, it's a black screen!

My System - custom build, Intel Core i5 760 @ 2.8GHz, DDR3 SDRAM, Windows 7 x64 Ultimate, FOXCONN Motherboard H55M-S and Nvidia GeForce GTX 460.

So, I noticed a few days ago, all of a sudden, my PC started to get a black screen after the Windows loading animation. However, after about 2 minutes it does eventually take me to the login screen where I can get access and everything appears to be in order.

I have tried this in Safe Mode and the same thing happens.

I have followed some of the hints on this forum about running tools and so far I have the following (but these have not been run in safe mode):

AVAST - no issues
SPYBOT - no issues
MALWARE BYTES - no issues
SFC SCANNOW - no issues
DISABLED Graphics card - no change after reboot
UNINSTALLED graphics card - no change
REMOVED USB Hub - no change after reboot
DISCONNECTED Network cable and rebooted - no change (I am wired LAN not wireless) I thought the network may be timing out.

Ran a boot Log and found :

Did not load driver \SystemRoot\System32\drivers\vga.sys
Did not load driver \SystemRoot\System32\DRIVERS\srv.sys
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS

I have also used Soluto to see what the boot times were and only two programs were taking a long time to boot so I removed it from the start up process which were Spotify and NVIDIA Experience centre. It made no difference.

Additionally, I noticed on some occasions the machine boots and after the black screen the display seems to be at very low resolution, some very funny colours and also displaying at 800 x 600.

I hope someone on here can help - the only one thing I have not tried is a system restore as I am hesitant in getting something wrong.

Any help would be much appreciated. Trying to give you as much info as I can!

Thanks

Jon

 

[Arc]

Post it following the Blue Screen of Death (BSOD) Posting Instructions.

 

[bluejonny]

Arc - thanks so much for your reply. I have attached the file requested in RAR format.

Thanks

Jon

 

[Arc]

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

 

[bluejonny]

Sure will do, and I'll report back. If it is RAM I will kick myself for not looking there first... :-(

 

[Arc]

Sure will do, and I'll report back. If it is RAM I will kick myself for not looking there first... :-(

Publish a Speccy snapshot too: http://www.sevenforums.com/tutorials/311593-speccy-publish-snapshot-your-system-specs.html .

Because, we have to check some other settings about the RAM, too.

 

[bluejonny]

Hi There -

So MEMTEST ran for 16 hours, and found no faults.

Also, the Speccy report can be found here; http://speccy.piriform.com/results/C5ybd7z1gR7ySI007NpfnRI

Thanks

Jon

 

[Britton30]

Hi and welcome to Seven Forums.
Try a Clean Boot: http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Some hardware tests to run.

Graphics card test:
Video Card Stress Test with Furmark ​

Hard drive(s)test(s):

Pick one for your HDD brand or use Seatools.
7 Free Hard Drive Testing Software Tools​

 

[essenbe]

Bluejonny, is the firmware on your SSD updated to the latest? Also, try disconnecting all hard drives except the SSD and see if your problems improve. Also, I am not familiar with the latest Intel SSDs, but they have a tool box. See if it gives any indication that the SSD has any problems.

 

[Layback Bear]

Intel SSD Tool Box. Pick the one for the particular SSD

https://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&DwnldID=18455

 

[Slartybart]

Try these:
http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Sysinternals Live: Autoruns for Windows
Overview: Autoruns for Windows
Options menu select Filter Options and untick [...] Hide Windows Entries


Your choices:

• Fix the path of the driver
• Disable the driver
  :warn: Do NOT disable core drivers(graphics, harddisk, CDROM)
• Find and correct missing files
• Reinstall the driver from the OEM site

You might also look this over, it might help identify the cause.
The Case of the Veeerrry Slow Logons

 

[Slartybart]

I followed NDProxy to here: NDPROXY Overview (Windows Drivers)
and read the advisory referenced on that page (advisory does not apply to Win7).

That took me to a few places, which sort of indicated malware. Sort of because the initial reference states with Vista and above are not affected....

Anyway, it wouldn't hurt to scan your system

Download: Farbar Recovery Scan Tool Download
Select the version that applies to your system: 64-bit

:ar: Save it to your Desktop.

Double-click the downloaded file to run it.
When the tool opens, click Yes to the disclaimer.
Also check the Addition.txt, if not already checked.

Press the Scan button.

When done, the tool makes a log, FRST.txt, on the Desktop.

:ar: Please provide the FRST.txt in your reply.

It also creates another log: Addition.txt
:ar: Also post the Addition.txt in your reply.

 

[bluejonny]

I would like to say firstly thanks to all the help here, it really is appreciated.

So some additional weirdness. Tried to start my machine tonight and the monitor would not even display a picture (no signal). Tried a few reboots and nothing. Eventually resorted to using one of the DVI outputs rather than the mini HDMI output on the card and machine showed picture and booted, BUT still with black screen pause of about 2 minutes. Not sure this is absolutely relevant or a red herring.

So I have tried some tests (but not all) as suggested.

Firstly, my SSD drive ticks all the boxes. Plenty of life left, passed stress tests and is at the latest firmware version. (Intel tools)

Tried the video card test to push the card - Temp stopped at 89C and in a real hard push with all settings ticked as advised, got weird flashes of text now and again across the bottom and sides of screen and could not see the text int he top left telling me what was going on.

I have run the FARBAR scan and results are attached. I will do the other recommendations later if that's OK.

Once again, thanks so much for your kind support.

Bluejonny

 

[Slartybart]

In Control Panel -> Programs and Features uninstall the following if present

Bonjour
Google Update
Spybot - Search & Destroy 2
Skype AutoUpdate
Java
Java Update
Adobe ARM
Advanced Installer
AVG


FRST shows a number of infections.

Let's see what Kaspersky TDSSkiller can do about the more serious ones

Download TDSSKiller from: How to detect and remove unknown rootkits
Scroll down to How to disinfect a compromised system
* Download....

Click the Save button (default save location is tyour Downloads folder)
Click the Run button when the download completes
Anser Yes to UAC
Accept the EULA
Accept the KSN Statement
TDSS initializes

Ready to Scan

View attachment 308074
​

Change parameters, tick Detect TDLFS file system
Press OK

View attachment 308075
​

Press Start scan

View attachment 308076
​

The log file is on C:\ and has is easily identified as Kaspersky TDSS
You can view the log by clicking Report in the upper right.

View attachment 308080
​

Please attach the C:\TDSSKiller.version_DD.MM.YYYY_HH.MM.SS_log to a new post
See: http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

 

[bluejonny]

Hi There again

Here is my log - incidentally the scan picked up one threat for which I have not taken any action on:

TDSS File System
Physical Drive: \Device\Harddisk1\DR1
Suspicious Object, Medium Risk

Thanks again for your help.

Bluejonny

 

[Slartybart]

The log says that you have a TDSS file system on that drive, that is not a good thing. It's not on drive 0 so that is a good thing.

Run TDSSKiller again and when you get to the take action window, please post a screenshot.

Take a look at the possible actions (delete, cure, quarantine?).

I think there might be a submit to TotalVirus, not sure what the screen says though.

 

[Britton30]

19:07:47.0237 0x0cc4  ================ Scan MBR ==================================
19:07:47.0238 0x0cc4  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
19:07:47.0424 0x0cc4  \Device\Harddisk0\DR0 - ok
19:07:47.0428 0x0cc4  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
19:07:47.0511 0x0cc4  [COLOR=red]\Device\Harddisk1\DR1 - detected TDSS File System ( 1 )[/COLOR]
19:07:47.0511 0x0cc4  [COLOR=red]\Device\Harddisk1\DR1 ( TDSS File System ) - warning[/COLOR]

This is what TDSS is, also called Alureon, could be part of a botnet stealing info. It's not good on any drive, hopefully your OS isn't on drive 1.

Alureon - Wikipedia, the free encyclopedia

 

[Slartybart]

Thanks Gary, that's pretty much why I asked bluejohnny to run TDSSKiller again. That was 5 hours ago, but we're in different time zones, so we'll have to wait for the Earth to spin a little bit.

Normally you would try to cure, then quarantine, then delete malware. A rootkit is a different beast.
I wanted to see what the utility presented before advising a course of action.

Bill
.

 

[bluejonny]

Hi Guys - I re-ran TDSSKiller and this time it has reported no Threats Found. I saw the last thing it scanned was HardDisk1\DR1\Partition1 but no threats were found. I restarted but my black screen still persists.

If I am free of Malware, I am wondering whether Windows is waiting for some process to time out. I read the blog that was recommended, The cause of very slow logins, but to be honest I think the things that were being written about there, I don't possess the skills to do. :-(

I also noticed tonight that on the reboot, the arrow on the black screen changed to a rotating circle as if waiting form some process to finish.

Is there anything else you can advise I check please?

Thanks for your help.

 

[Slartybart]

Post the TDSSKiller log from the last run. These things are tricky - if you didn't take action the first time TDSSKiller ran, then it's still there. the log will tell more.

There's a good chance that after looking at the log, I'll ask you to run TDSSKiller again!
Once the TDSS file system is resolved, there are a number of malware scans to run. Many malware 'invite' their friends so a few scanners are good practice.

I'm wondering if you forgot to tick Detect TDLFS file system (you caught the mistake the very first time you ran TDSSKiller and restarted it with the parameter marked.)

I can't tell if disk 1 is external or internal, if it's the same disk as before or what. You're the eyes on that side of the monitor (your System Specs don't say if the 1 TB drive is internal or external, so I'm assuming that the 160 GD SSD is your boot, the 1TB drive is an internal drive and that it is the same drive as before.

Please post information about your drives having this information also makes it easier to a discuss course of action.
See: http://www.sevenforums.com/tutorials/274797-disk-management-post-screen-capture-image.html
Post# 12 provides additional information on how to provide the most useful screenshot.

In addition to that addendum, please make sure that the Status column shows everything in between the parenthesis (Boot, Page file....)

Thanks