black screen of death? (vista)

Alright, so im turning on my laptop (running vista 32bit home) everything is normal, but i always get a message, something about disk check (chkdsk or something along the lines of that) and i usually press a button to cancel it, but this time i forgot, so i let it run, watching it do some stuff i had no clue about, and when when it finally finishes, i log in to my user profile, but then nothing pops up, just a black screen.

I press control alt delete to get windows task manager, i can create new tasks etc like chrome, i thought maybe i should restart the computer, thinking it would maybe fix it, i log into my profile, and still get the black screen, so then i decided maybe i should go into safe mode and try a system restore.

So i boot into safe mode, get system restore running, try restoring, and when i tried to restart into normal mode, i still had the black screen, so i turned off my laptop, went into safe mode and found this error:



I did a little research on this, and i came across a post on a different website to try a sfc /scannow.
So i do that, and then i get this...



should i post the log? if is helpful, and maybe do a malwarebytes scan? i dont think i have any sort of malware since i did a scan yesterday with it and havent downloaded anything with it since, but i havent done a virus scan with my normal anti virus since it has not detected anything, (i use microsoft security essentials and malware bytes from time to time, but security essentials is my default anti virus thing on my laptop).

So now i am unsure what to do, still use the internet fine on normal and safe mode with networking, i still need to restart and try normal mode after doing that scan with cmd, i will edit the post to see if i can access normal mode now.

:edit:

still not working in normal.

1. Go to start and search for cmd like in the screenshot and right click on it. Then run it as Administrator.



A black DOS box will open.
2. Enter the commands:
findstr /C:"[SR] Cannot repair member file" %windir%\logs\cbs\cbs.log > sfcdetails.txt
start sfcdetails.txt

when i try that it says it cannot open %windir%\logs\cbs\cbs.log >sfcdetails.txt

i dont have the "\" but the / due to my locale settings being japanese to it turns into a yen sign, should i change that and try again?

when i try that it says it cannot open %windir%\logs\cbs\cbs.log >sfcdetails.txt

i dont have the "\" but the / due to my locale settings being japanese to it turns into a yen sign, should i change that and try again?

Yes try it.

when i try that it says it cannot open %windir%\logs\cbs\cbs.log >sfcdetails.txt

i dont have the "\" but the / due to my locale settings being japanese to it turns into a yen sign, should i change that and try again?

Yes try it.

ummm 1 problem, i cant =_= lol

when i go into normal mode, start a new task and browse for control panel, i cant get to the regional settings or something like that and change the locale settings, know another way i can do it? like a specific command? i cant seem to find much, its like its deleted a few things. Also i tried booting in safe mode with networking again and it just froze when it said "please wait" with all the commands or what eve above it, during my last post a message came up saying "please restart to save these changes" or something similar, but i dont remember making any changes sooooo..what now? lol

Try this command instead:

%windir%\logs\cbs\cbs.log > sfcdetails.txt
start sfcdetails.txt

ummm, it said access is denied even though i opened in administrator lol,

could you maybe please provide a screen shot of what i have to do, just encase i am doing something wrong, thank you!

dxpoo.

I suspect infection, try this first so we can rule out infection.

================================== MBAM Scanner ==================================

Run a scan with MBAM:

Download the free version of Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad.
• Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

Sorry, i was out all day! anyway, before i left i decided i would run a full scan (just encase it picked up anything else) and run it in normal mode not safe (i thought the virus etc might not run on safe mdoe so maybe it would get caught in normal) and apparently...nothing was found!


Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.07.01.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Arjann :: ARJANN-LAPTOP [administrator]

01/07/2012 16:21:44
mbam-log-2012-07-01 (16-21-44).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 370826
Time elapsed: 1 hour(s), 33 minute(s), 39 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)



So, any other advice? i think it is a registry problem, considering it was all to do with the check disk thing, unless the virus cannot be detected by malwarebytes, so...any other advice would be nice!

Just the be sure, run one more scan:

================================== Eset Scanner ==================================

Run Eset online scanner;

Note: You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin
Go to the Eset web page to run an online scanner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
• click on the ESET Online Scanner button
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the ActiveX control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options
• Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• Click on copy to clipboard or copy and paste the results here in this topic

alright, here is a shocker!

C:\Users\Arjann\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\2a7fa1bc-367d6c9c a variant of Java/Exploit.Blacole.AN trojan
C:\Users\Arjann\Downloads\asc-setup (1).exe a variant of Win32/Toolbar.Widgi application
C:\Users\Arjann\Downloads\Clothing Replacer.rar Win32/Packed.Autoit.C.Gen application
C:\Users\Arjann\Downloads\gamebooster (1).exe a variant of Win32/Toolbar.Widgi application
C:\Users\Arjann\Downloads\gamebooster.exe a variant of Win32/Toolbar.Widgi application
C:\Users\Arjann\Downloads\gb3-setup.exe a variant of Win32/Toolbar.Widgi application
C:\Users\Arjann\Downloads\imf-setup (1).exe a variant of Win32/Toolbar.Widgi application
C:\Users\Arjann\Downloads\imf-setup.exe a variant of Win32/Toolbar.Widgi application
C:\Users\Arjann\Downloads\NTLEA.rar a variant of Win32/FlyStudio application
C:\Users\Arjann\Downloads\Clothing Replacer\�^??“I�^ŽO�‘�Ù‘oOnline•ž?‘Ö?�H‹ïv3_3\�^ŽO�‘�Ù‘o•ž?‘Ö?�H‹ïr10b.exe Win32/Packed.Autoit.C.Gen application
C:\Users\Arjann\Downloads\NTLEA\NTLEA\NT Locale Emulator Advance\neko.dll a variant of Win32/Fly

i had no idea either! i removed them btw after the scan which i believe is ok

soo, what should i do now oh mighty fasso! (btw i am thankful for the help you have provided me so far!)

Is there an another account on the computer which has the type of Administrator?

http://windows.microsoft.com/en-US/windows-vista/Fix-a-corrupted-user-profile

Try also this:

1. Boot into Safe mode.
2. Activate Administrator:



A black DOS box opens, enter the following command.
net user administrator /active:yes

3. Log off in Safe Mode, and then log on to the built-in Administrator account to logon with that account in Safe Mode.

4. Then create a new Account.

5. Log into the new account (not into safe mode, but normal mode) an try to backup your files from the old one.

First backup your files of that account, because it's damaged. If you don't how to backup this files, let me known.

6. Then delete the corrupted profile account.

could you please tell me how to back up files from the old 1? thanks, idk weather to use the program that backs up files, or the actual drive to.

It would be nice to have some pictures on what to do, im a bit confused with "lon on the built in administrator account" when i only have 1 account. Thanks.

To back-up your files you'll need a CD to burn on or an USB Stick. You'll also need to download (a Live CD) on a working computer.

You can try Ubuntu live CD or Puppy Linux, more information about that:

Look at the reaction off AustrAlien: http://www.bleepingcomputer.com/forums/topic456996.html/page__view__findpost__p__2730906

Hello, safe mode isnt working (at the moment, il try in a bit again) but i just wanted to calrify if this would work considering i think its not really a virus/malware problem more like a computer problem in general from the chkfile (file check) at start up of windows:



thank you, dxpoo