Windows 10: Boot problems: Black screen + CMD no explorer.exe

Hi, tonight i ran malwarebytes to scan for malware. After the scan multible threats were detected. After malware bytes took the appropriate actions my computer froze while trying to reboot. After waiting I hold the power button with now this as consequence:





After running the following command:
Code: start explorer.exe[/quote] it looks normal again.

This problem also occurs in safe mode (what really has me worried).

I made this video to give you some better insight. My Movie - Streamable

Looking forward to tips, everything is welcome!

:)

 

Cwindows\run.vbs is missing

Thanx. It worked. For black screen

 

Cwindows\run.vbs is missing

Ok, the issue with the black screen is having explorer.exe failed. So, you press ctrl-> shift -> esc. After this in the top left go file-> run new task.

In the dialogue box type explorer.exe and it should bring your screen back. After this you can just open cmd. Alternatively you can just type cmd in the dialogue box.

Hope this helps,

Sid

 

These entries are required to start Windows, might have been damaged by malware.

Code: reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /t REG_SZ /d "C:\Windows\System32\userinit.exe," /f reg add "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f reg add "HKLM\System\CurrentControlSet\Control\Session Manager" /v "BootExecute" /t REG_MULTI_SZ /d "autocheck autochk *" /f reg add "HKLM\System\CurrentControlSet\Control\Session Manager" /v "SETUPEXECUTE" /t REG_MULTI_SZ /d "" /f[/quote]

 

All these Registry's exist and have the same value. But just to clarify, windows is starting just not the GUI/ explorer.exe and CMD is randomly starting at boot.

 

Check out possible explorer's hooks, like via Autoruns.

I would suggest to remove everything, but that will really remove everything.

Code: takeown /f "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup" /a /r /d y icacls "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup" /inheritance:r /grant:r AdministratorsOI)(CI)F /t /l /q /c del "%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup\*" /s /f /q del "%AppData%\Microsoft\Windows\Start Menu\Programs\Startup\*" /s /f /q reg delete "HKCU\Software\Microsoft\Command Processor" /v "AutoRun" /f reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /f reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved" /f reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" /f reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /f reg delete "HKCU\Software\Policies" /f reg delete "HKLM\Software\Microsoft\Command Processor" /v "AutoRun" /f reg delete "HKLM\Software\Microsoft\Policies" /f reg delete "HKLM\Software\Microsoft\Tracing" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\AppModelUnlock" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /f reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "VMApplet" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman" /f reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" /f reg delete "HKLM\Software\Policies" /f reg delete "HKLM\Software\WOW6432Node\Microsoft\Policies" /f reg delete "HKLM\Software\WOW6432Node\Microsoft\Tracing" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnceEx" /f reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies" /f reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows" /v "AppInit_DLLs" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "VMApplet" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman" /f reg delete "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" /f reg delete "HKLM\Software\WOW6432Node\Policies" /f reg delete "HKLM\System\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /f reg delete "HKLM\System\CurrentControlSet\Control\SafeBoot" /v "AlternateShell" /f reg delete "HKLM\System\CurrentControlSet\Control\Session Manager" /v "BootExecute" /f reg delete "HKLM\System\CurrentControlSet\Control\Session Manager" /v "Execute" /f reg delete "HKLM\System\CurrentControlSet\Control\Session Manager" /v "SETUPEXECUTE" /f reg delete "HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd" /v "StartupPrograms" /f reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /t REG_SZ /d "C:\Windows\System32\userinit.exe," /f reg add "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f reg add "HKLM\System\CurrentControlSet\Control\Session Manager" /v "BootExecute" /t REG_MULTI_SZ /d "autocheck autochk *" /f reg add "HKLM\System\CurrentControlSet\Control\Session Manager" /v "SETUPEXECUTE" /t REG_MULTI_SZ /d "" /f bcdedit /deletevalue {current} safeboot bcdedit /deletevalue {current} safebootalternateshell bcdedit /deletevalue {default} safeboot bcdedit /deletevalue {default} safebootalternateshell bcdedit /set {default} advancedoptions false bcdedit /set {default} bootems no bcdedit /set {default} bootstatuspolicy DisplayAllFailures bcdedit /set {bootmgr} displaybootmenu no bcdedit /set {current} advancedoptions false bcdedit /set {current} bootems no bcdedit /set {current} bootstatuspolicy DisplayAllFailures[/quote]

 

I ran the code, but didn't fix it. How do i check for possible explorer hooks? (I have autoruns) I uploaded the video My Movie - Streamable

 

It looks to me like explorer.exe was replaced by cmd.exe, but SFC scan should fix that.

Check out Autoruns, un-check to hide Microsoft entries and look for CMD, like this:

 

https://i.imgur.com/hOBiwYi.png
https://i.imgur.com/Z1nfWI4.png

This is what i get,

i thought sfc should fix this aswell, but i updated sfc and ran it multible times and still no fix :/

 

That "%comspec%" should not be there. If you type it into run, you will get just what you get at startup.

Did you run my code in cmd as admin, because this one should fix that.

Code: reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe" /f[/quote]

 

I ran all 3 codes as admin now, (my mistake before..) But it dit not fix the problem. This is Autoruns now:



It still shows comspec

on this file location: HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
which is not changed in the code i believe

 

Remove it via autoruns, but you might need to run explorer via task manager, if that cmd window will not start.

 

WTF you are a genius, it ran normal again!

 

I like to thank you so much! For your time and for sharing your knowledge! Can i review you in any way?

 

Glad you got it sorted it out. *Wink