EdwardY Posted November 4, 2017 ID:1179068 Share Posted November 4, 2017 My friend is having a Black Screen of Death(KSOD). After trying multiple attempts to fix it, nothing has worked. After going into advanced boot options, repair, command prompt and opening RegEdit we discovered his Shell and Userinit values are changing. We've used the Command Prompt to open RegEdit and change them. Shell gets set to cmd.exe /k start cmd.exe And Userinit gets set to X:\WINDOWS\system32\userinit.exe, After changing them correctly they still change back to the above. There is no Safe Mode, no Task Manager etc No System Recovery slots either. Cannot download anything to run it for any tests. Link to post Share on other sites More sharing options...
kevinf80 Posted November 4, 2017 ID:1179072 Share Posted November 4, 2017 Hello EdwardY and welcome to Malwarebytes, Which version of windows is installed on the sick PC, is 64 bit or 32 bit... Also do you have USB flashdrive available.. Thank you, Kevin... Link to post Share on other sites More sharing options...
EdwardY Posted November 4, 2017 Author ID:1179076 Share Posted November 4, 2017 Windows 7 64Bit. No USB flashdrive. Link to post Share on other sites More sharing options...
kevinf80 Posted November 4, 2017 ID:1179078 Share Posted November 4, 2017 We need a Flashdrive to run FRST via recovery environment, can you borrow from a friend or family member, 4 GB is good... Link to post Share on other sites More sharing options...
EdwardY Posted November 4, 2017 Author ID:1179079 Share Posted November 4, 2017 No, and it doesn't much matter, my friends having the problem and would have no way to get FRST anyways. Is there any other way you can help? Link to post Share on other sites More sharing options...
kevinf80 Posted November 4, 2017 ID:1179080 Share Posted November 4, 2017 There is no way really, if we reset reg keys then as you`ve already stated they just change back. There is probably a protective rootkit hidden that we need to find.... You mention accessing command prompt... Can you go into command prompt, copy paste the following at the prompt then hit enter: cmd /c dir /a/s c:\windows\system32\drivers\*.sys That will produce list of drivers can you show that list for me to see.... Link to post Share on other sites More sharing options...
EdwardY Posted November 4, 2017 Author ID:1179082 Share Posted November 4, 2017 Give me a minute, he's going to send me pictures of it from his phone which I'll upload here. Link to post Share on other sites More sharing options...
EdwardY Posted November 4, 2017 Author ID:1179083 Share Posted November 4, 2017 Link to post Share on other sites More sharing options...
kevinf80 Posted November 4, 2017 ID:1179087 Share Posted November 4, 2017 I`m not able to see those drivers very well, do you see any with these sizes 137,552 or 137,040 Link to post Share on other sites More sharing options...
EdwardY Posted November 4, 2017 Author ID:1179089 Share Posted November 4, 2017 No. Link to post Share on other sites More sharing options...
kevinf80 Posted November 4, 2017 ID:1179092 Share Posted November 4, 2017 Maybe there is no rootkit, what exactly are you doing when you alter Winlogon key setting for userinint. Do you load the hive, make change then unload the hive and then exit recovery environmement and see if windows will boot...? Link to post Share on other sites More sharing options...
EdwardY Posted November 4, 2017 Author ID:1179093 Share Posted November 4, 2017 Just change it and try and load. Link to post Share on other sites More sharing options...
kevinf80 Posted November 4, 2017 ID:1179095 Share Posted November 4, 2017 Wait let me see if I can find a link to change userinit value offline with good images to follow, I could explain to you but no images will make it hard to follow... back shortly. Link to post Share on other sites More sharing options...
EdwardY Posted November 4, 2017 Author ID:1179096 Share Posted November 4, 2017 Alright, thank you. Link to post Share on other sites More sharing options...
kevinf80 Posted November 4, 2017 ID:1179097 Share Posted November 4, 2017 Ok, you know how to access command prompt from Recovery environmemnt, the link I post is for w8 and w10 but from Command Prompt is same for windows 7 so should be reasonably easy to follow: http://www.winhelponline.com/blog/edit-registry-offline-windows-re/ Link to post Share on other sites More sharing options...
EdwardY Posted November 4, 2017 Author ID:1179098 Share Posted November 4, 2017 Thanks, I'll read through it. My friend isn't home atm but I'll have him try it later. Will update you then. Link to post Share on other sites More sharing options...
kevinf80 Posted November 4, 2017 ID:1179099 Share Posted November 4, 2017 Ok thanks for the update, a USBflash drive loaded with FRST would definitely make things more user friendly, create log and then create fix... Link to post Share on other sites More sharing options...
EdwardY Posted November 4, 2017 Author ID:1179100 Share Posted November 4, 2017 He doesn't have a USB flashdrive, even if he did he has no way of getting FRST on it. Link to post Share on other sites More sharing options...
kevinf80 Posted November 4, 2017 ID:1179101 Share Posted November 4, 2017 ok I understand, Link to post Share on other sites More sharing options...
EdwardY Posted November 5, 2017 Author ID:1179127 Share Posted November 5, 2017 It didn't work. Link to post Share on other sites More sharing options...
EdwardY Posted November 5, 2017 Author ID:1179128 Share Posted November 5, 2017 I've been looking through the drivers again, and noticed one is close to what you said to look for, 138,048, could this be what you was looking for? Link to post Share on other sites More sharing options...
kevinf80 Posted November 5, 2017 ID:1179155 Share Posted November 5, 2017 Yes could be, can you list please... Link to post Share on other sites More sharing options...
EdwardY Posted November 5, 2017 Author ID:1179170 Share Posted November 5, 2017 ETD.sys Link to post Share on other sites More sharing options...
kevinf80 Posted November 5, 2017 ID:1179189 Share Posted November 5, 2017 (edited) That file is legitimate... Can you boot the system to the Recovery Environment again, then select command prompt. At the prompt type or copy/paste the following command: sfc /scannow /offbootdir=c:\ /offwindir=c:\windows Hit the enter key.. When complete see if windows will boot... Edited November 5, 2017 by kevinf80 Link to post Share on other sites More sharing options...
EdwardY Posted November 5, 2017 Author ID:1179191 Share Posted November 5, 2017 It's doing the system file check now. Link to post Share on other sites More sharing options...
Recommended Posts