Black Screen and Command Prompt on startup

[BrokenHat]

Hello,

I hope I am posting this correctly and I am hoping that I can get some help on a problem I am having.

I noticed yesterday that I was not able to open my command prompt at all, even in safe mode. I ran a scan with Malwarebytes (free version) to see if anything came up, as I have used it before and had good results. Some stuff did pop up that I didn't recognized, and I proceeded to remove the threats. Everything seemed fine, and i was able to use the command prompt. After rebooting, my computer loaded windows and logged into my user account, but had a black screen and a command prompt box saying sys32. I figured out that explorer.exe was not running on startup. Every time I reboot, I have to enter "explorer.exe" to launch it and everything works after that. I ran another Malwarebytes scan to see if anything is found. Nothing new other than the 3 items I had left before. This second scan is attached.

I went through the forums to see if I could find a solution. I found a very similar post mentioning a registry entry. I have followed the instructions on that post and attached some relevant files in case I might be able to get some help. Anything that could be recommended would be greatly appreciated. I am really hoping not to have to re-install my operating system.

MBAM results 2.txt FRST.txt Addition.txt

[BrokenHat]

Just to post an update, I've been digging into this issue for quite some time now and I think I was able to fix it. I will post it here in case anyone is able to use this information.

Firstly, make a backup of your registry just in case.

After rebooting and relaunching explorer.exe, I dug through a bunch of forums and help guides. The main takeaway is that something changed my registry so that explorer.exe would not run on startup. After backing up my registry through regedit, I started poking around and comparing my registry to my friends'. There were two main registries I focused on, due to being mentioned in other people's issues. Its the AutoRun key under the Command Processor folder and the Shell key under the Winlogon folder.

The trick is, these keys and folders are located in two paths each: under the CURRENT_USER and under the LOCAL_MACHINE.

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Computer\HKEY_CURRENT_USER\Software\Microsoft\Command Processor

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor

After locating these folders, I first changed the value of the "Shell" keys to " explorer.exe " and then changed the value of any Autorun key to be empty (as in delete the value, not the key itself).

After doing that for all four keys, I rebooted my PC and everything seems to be working OK now. I've checked my PC several times with different scanning stuff and nothing seems to be out of the ordinary. I might one day do a fresh install of Windows 10, but for now I'll leave things as-is and keep my stuff backed up.

[Maurice Naggar]

Hi Brokenhat.

I have two suggestions for you.

[ 1 ]

Get and run the Microsoft Malicious Software Removal tool

https://www.microsoft.com/en-us/download/malicious-software-removal-tool-details.aspx

That link defaults to the 64-bit selection for Windows 10.   If you have the 32-bit Windows, use the blue "Change system" to select the 32 bit version.

Save the download , and then run it to check your system with this Microsoft utility.

 

[ 2 ]

what this machine needs is to upgrade to the Windows 10 build 1903.  You should be able to manually get it thru Windows Update.

It may take repeated tries with Windows Update till your pc is able to see that Update.  You should make a try each day, from here on out, till you see it offered.

The suggestion I have is to go to the Start menu, click the Windows Settings icon. Select Update & Security.  Click on Windows Update.

The Windows Update ( eventually) will have a display like this when it shows up.

Note that the display will show the new build in a new way, in the middle of the display.  You will need to click on the blue line marked "Download and install now"  when ready.

 

 

Getting that Windows build update will put this pc in a better position for a more secure operating system.

.Best regards,

Maurice

[BrokenHat]

Thank you very much for the advice. I'll definitely check out both the tool and the update.

[Maurice Naggar]

You are welcome.   OK.  Just please keep me advised over the next few days, after you have done the suggestions.

Sincerely,

Maurice

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks