Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Any concensus on black screen with mouse issue?


  • Please log in to reply
6 replies to this topic

#1 Ken-in-West-Seattle

Ken-in-West-Seattle

  • Members
  • 518 posts
  • OFFLINE
  •  
  • Local time:03:23 PM

Posted 05 February 2010 - 09:26 AM

I have run into several of these and either reimaged after backup (laptops) or reloaded onto a new or wiped drives.

I find this inelegant as a solution...

Has anyone found a common trigger or cause? More importantly, is there a list somewhere to help narrow down whether this is a malware problem, a userinit issue caused by particular infection and repair scenarios or a registry entry miswritten for whatever reason.

I am ready to believe the root cause may be in malware, but with the variety of alleged fixes and workarounds fond by google I have to assume there are some which are caused by other errors.

Anyone have some clues or a place to start?

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,741 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:23 PM

Posted 05 February 2010 - 09:51 AM

It's like anything else...any number of things on a system can result in a black screen, any number of things can reduce the mouse to uselessness.

My first two guesses go to damaged system files and/or malware...but I believe you have to have more clues before deciding on an attempted fix.

Louis

#3 Ken-in-West-Seattle

Ken-in-West-Seattle
  • Topic Starter

  • Members
  • 518 posts
  • OFFLINE
  •  
  • Local time:03:23 PM

Posted 05 February 2010 - 12:27 PM

To be more exact, the common themes are xp splash screen = normal, followed by logon screen, followed by black background with normal functioning mouse. No icons, no menu, no keystroke will bring up anything.

Google indicates some systems with these symptoms (all I can see are from 2005 to 2008) can get a taskmanager window to appear with ctrl-alt-del. A few can get a sticky keys dialog window by hitting shift five times. Many of these are also shoing up on Vista installs

The ones I run into do not respond to ctl-alt-del, sticky keys or anything else. They will also show the same symptoms in safe mode (in addition to the safe mode corner logos) and will not boot into safe mode command prompt instead opening in the GUI safe mode.

Google messages with these symptoms seem to be clustered after mid 2009 and often seem to be tied to trojan. dropper or rootkit repair attempts.

There should be a pattern or some research somewhere.

I will end up doing a nuke and reload on these but I want somewhere to start untangling this puzzle. I have several disk images I can reload to recreate the problem, but cruising through config files and registries has not located a common starting point.


I have a new one this week that displays the hi res background image and theme matched mouse cursor, and seems to accept a login, but comes back 3 min later and automatically runs a logoff procedure. Safe mode has a black background, and it will not start in safe mode command prompt.

I hope one of the malware experts can take a look at this post and comment. If there is a better place for this post perhaps the admins will move it.

#4 Techguy27

Techguy27

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:23 PM

Posted 03 March 2010 - 10:24 AM

I've seen this on Vista a hundred times and Windows 7 once.

Sometimes the fix for me with the Vista machines is a reg edit to make the NT Authority the log in for the RPC service.
Vista Reg Fix

The rest of the time the fix for me with Vita and the Windows 7 machine, and also one Server 2008 box was to go into the \system32\config folder and delete the event logs. The machine came right up after reboot.

#5 Ken-in-West-Seattle

Ken-in-West-Seattle
  • Topic Starter

  • Members
  • 518 posts
  • OFFLINE
  •  
  • Local time:03:23 PM

Posted 03 March 2010 - 05:19 PM

On vista it seems to be called KSOD but the difference seems to be that one can start taskmanager with a ctl-alt-del on nearly all the vista reports.

I have seen several types of hangs where explorer fails to start that allow taskmanager to start and locate evt view hangs, dot net failed installs and hanging automatic updates.

The one I now automatically associate with unidentified rootkits, trojans or AV deletes, does not allow any method to get a taskmanager or boot into safemode w/command prompt.

If the number of reports are falling off, I would assume the rootkit writers have changed what would develop into a "telltale" before I would attribute it to something Microsoft fixed.

I am still using the "nuclear option" until something better comes along. :thumbsup:

#6 Techguy27

Techguy27

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:23 PM

Posted 04 March 2010 - 01:12 PM

Wish I could find more valid info for you. I'm sure you have seen that google is all over the place as far as resolutions, etc. From the computers I've come into contact with, the KSOD is on normal and safe mode boot. Once I was able to get the sticky keys method of opening explorer. The ctrl+alt+delete has never worked for me.

Typically I have to use the Vista media to get to the command prompt to delete the corrupt event logs, or do the reg edit. Hope it helps some.

Honestly, most of the time for me the fix is using the Vista media to get to the command prompt. navigate to the windows\system32\config folder and do a del *.log After reboot the machine loads without any hangs.

#7 Ken-in-West-Seattle

Ken-in-West-Seattle
  • Topic Starter

  • Members
  • 518 posts
  • OFFLINE
  •  
  • Local time:03:23 PM

Posted 04 March 2010 - 04:51 PM

thanks for the clarification.

I will probably have one to test that scenario on within the week :thumbsup:

del *.evt should work from the repair console on xp.

When you use *.log in the example, I can only assume you were using a hypothetical.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users