Black screen after Malwarebytes scan

[Jianwei]

Hi, After Malwarebytes scan and quarantine 16 infected items, my computer showed black screen with cursor only. I searched in the forum and was able to run FRST in repair mode. Attached is the scan result. Greatly appreciate any help! 

FRST.txt

[Maurice Naggar]

Hi, 

My name is Maurice. I will be helping and guiding you, going forward on this case.

Let me know what first name you prefer to go by.

 

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me.

Please only just attach   all report files, etc  that I ask for as we go along.

Please know I help here as a volunteer.  and that I am not on 24 x 7.

Help on this forum is one to one.  

 

Is the system now at the X prompt, showing like

x:\windows\system32 >

 

I see that you have a USB device on G drive.   One of the first questions I have is, do you have another working computer where you can do downloads and also transfer back & forth with the USB ?

also

tell me what Windows showed on-screen after the Scan  and before the "black screen".

[Jianwei]

Hi Maurice, Thank you very much for help. I do have another working computer that I can download/transfer data.

You are right, the system now at the X prompt.

Before the "black screen", it looks like normal restarting,  showed windows logo and then instead of showing log in window, it is black screen forever. The mouse cursor is there and I can move the mouse cursor. I tried to ping it from another working computer and it get ping through as well. 

Really appreciate!

Jianwei

[Maurice Naggar]

It could be just a one-off incident.  It may perhaps be that Windows had a glitch in loading the normal user profile.

But I see a few lines from the FRST that show some startups that need to be removed.

We will need you to use the USB as a key transfer media.  Leave the problem computer sitting where it is.

Just remove the USB  and take it to the working computer  and insert it into that unit.

 

Then I would like for you to download and SAVE ( as is ) the attached text file onto the USB.

That file should be saved to the root of the USB   ( just like where you have the FRST64 on that USB).

Once the save is done,  remove the USB from the other computer.   and take it to the problem-computer  and insert into the USB drive.

.

That all in place, now we want to start the FRST64  just the same way you did before.

Then go slow and careful.  This time we want to do this next procedure.

on the FRST64 window:
Click the Fix button just once, and wait.

 
PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. This run here should be fairly quick.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.

But in this case, I do not expect a "reboot".

The tool will complete its run.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity   

Leave the problem-computer as is.   I would like to review the Fixlog first.

 

 

Fixlist.txt

[Jianwei]

Hi Maurice, The fix runs pretty fast. Attached is the log file. However, my FRST version is different than what you showed. There is no optional scan option.

Fixlog.txt

[Jianwei]

I am sorry, there is optional scan option, with only two options: List BCD and 90 days files 

[Jianwei]

The version number is : 04-07-2020 01

[Maurice Naggar]

Thanks for the Fixlog.  You did fine.   The Fix run is all I wanted.

Now, remove the USB  from the system.  Stash it away and keep it safe.

Next, use the Power-button and Power Off the machine.   Be sure any printers, scan machine, fax machine, external devices are disconnected.

After a minute,  then do a Power ON  and wait and let Windows have the chance to load up normally.

Watch the login process  so that it starts in the normal account.

Keep me advised.   We can do other things after that.

[Jianwei]

Hi Maurice, I tried to restart it and it still shows black screen with cursor. However, before it turns black screen, it did show like a normal screen with "Please wait" for only 1~2 seconds. Please advise. Thanks much.

[Maurice Naggar]

Does it ever get to the point of showing a flashing underscore sign?

 

You should try to get the system to the SAFE mode.  This will require another Power off.

Turn off your pc by pressing the power off button. IF this is a laptop, press and hold the Power off until you can sense the disc has stopped spinning.  

Wait about a minute.  

Then turn the Power On on the pc  and allow it to Restart and load up Windows.  

And right away, tap & retap the F8 Function-key on your keyboard.  
You should see Windows Advanced Options menu. 
Select Safe Mode with Networking  ( make the selection by number using the topmost number-bar at top of keyboard)
 
NOTE: if the F8 function key-method did not prove usable, some systems may use F5 instead.  
And on some systems you may need to press the F2 function key to get hardware boot options. 
 
Then let me know when you get it there. 

. 

[Jianwei]

It did get the window showing a flashing underscore sign, and then showing "Windows staring" and then shows like normal starting screen with "Please wait" for 1-2 seconds.

I just tried safe mode. Before the screen turns black, it blinked many times showing windows 7 is starting. 

Thanks,

[Maurice Naggar]

Question is......did you tap F8  way before the "winows starting" or even before that too.

did you tap the F8  and then did you see a  screen with Startup options ?    similar to this

 

Please take a few minutes.  Read this article at SevenForums

https://www.sevenforums.com/tutorials/666-advanced-boot-options.html

 

the goal is to get to either Safe Mode with Networking   ( so pc has internet capability)

or else,  Safe mode

 

There is no need to rush on any of this.  Take your time.

If after giving real good "college tries"  and still no luck,  then repeat the Power Off > Power On >  and F8

and then pick selection for "Disable automatic restart on system failure"

 

Edited July 8, 2020 by Maurice Naggar

[Maurice Naggar]

Good morning.  I hope you are doing well.

I am checking up to see where things stand.   In addition, I would like t find out if you have anther working computer where you might o downloads, and, if you have a USB-flash-thumb drive of at least 8 GB  that can be repurposed for special use ?

Let me know.   Because if the answer is yes to both, I can guide you to a special method to bot up the problem-machine from the USB-flash drive.

I would also need to know, if you know how to set the pc-hardware to boot up from the USB.    ( i.e. to get to BIOS  to adjust boot-startup).

 

Sincerely.

[Maurice Naggar]

Additional postscript note.  You had had this machine in the Windows Recovery Environment ( at the very start of this case).

So if need be,  you can get there again  and then let me know about that.

Sincerely.

[Maurice Naggar]

Hello.   Rechecking, since I have not heard back from you.  I hope you are doing well.

How are things at this point ?   Any progress ?  any thing new to report ?

[Maurice Naggar]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks