Acer laptop with black screen and movable cursor

[pcmedicri]

Happy New Years everyone!

A customer came in with an Acer laptop that turns on, boots to bios, then Windows 7 loads, but it shows a black screen and no login/welcome screen. The mouse cursor appears and you can move it around.

First thing I made a full disk image. Next I ran malwarbytes and picked up 6500 items. When the scan completed, malwarebytes crashes upon removing the detected objects. I run Eset and clean out the objects it finds. I tried to see if it would boot, but nope same black screen issue.

Next I run hitmanpro and it finds 5400 additional items with more than 10 trojans and over 4000 malware items. I removed all that successfully. I reinsert the drive into the laptop and nope it doesnt boot into windows.

Tried system restore and failed due to corruption with the system restore folder. Chkdsk /f /r fixed errors, but it did not get me into windows.

i also did fixboot, fix mbr, ran antirootkits and this drive will not allow me to boot at all.

The hard drive is Hitachi and passes fine. No sector issues.

I even checked the registry hive and made sure the Shell had explorer.exe

I went deeper and noticed something. In regedit, the HKEY_Local_Machine/Services, CurrentControlSet is missing. CurrentControlSet001 and 002 are there. Looking at my other Acer laptop, I see it there. Could this be the reason all of us cant boot? I tried to export the CurrentControlSet registry from a fresh Windows 7 install and import it into the laptop I am working on, but i cant seem to copy.

If I can't get the desktop rolling, I will just factory reset the pc.

Yes, I did search the forums

Thanks.

Edit: Copied System registry and it kept doing restart loops after Windows 7 booted. I know that currentcontrolset is the problem here. Is there a way to copy keys from a registry to another hard drive?

 

[jkurgeek]

Assuming it doesn't boot into safe mode?
How many user profiles? If it's trying to automatically load one profile and it's corrupt, enabling the built-in admin so it presents a choice may give you some clues.

CurrentControlSet001 is the last set that the system started with. CurrentControlSet002 is the Last Known Good Config.
CurrentControlSet points to which one should be loaded, so compare the entries with a working Win 7 install.

 

[Krilus]

Fabs autobackup will still find the profile on a different PC and back it up.

In this case I would just tell the customer that there was so much damage done by the infection that a nuke and pave is their best option. I'm not a "Nuke and Pave" by default tech but at some point I think you have to look at whats best for the client aswell as your own sanity.

 

[HFultzjr]

Run offline scans. (Kaspersky)

Boot up to Win 7 Disk and try and do startup repairs from there.

Run SFC /scannow from command prompt

Run chkdsk /f on the OS drive from command prompt.

I thought I heard somewhere that Win AIO Repair can be run offline, but can't find it.

 

[orinoco]

Have you tried to do an inplace repair ie non destructive reinstall ?

 

[MichaelBits]

For future reference...
If windows boots to a black screen and you get a cursor, hit ctrl-alt-del and bring up task manager. Then type explorer in the run. This will get the desktop loaded so you can start the repairs.

I've encountered this "error" several times. Kind of a crap shoot as to whether it is even repairable. Sometimes easy, sometimes leads to N&P.

 

[Larry Sabo]

I had an Acer yesterday with these symptoms (Win 8) and I swear Alt+Tab brought up the desktop. I ended up refreshing Windows in the end, as wireless only worked if AC adapter was plugged in, plus other weirdness.

 

[pcmedicri]

Run offline scans. (Kaspersky)

Boot up to Win 7 Disk and try and do startup repairs from there.

Run SFC /scannow from command prompt

Run chkdsk /f on the OS drive from command prompt.

I thought I heard somewhere that Win AIO Repair can be run offline, but can't find it.

Yes, startup repairs says no errors found.

Chkdsk /f was run. I also did /r /f

Ill look at the win aio repair. Thanks for the idea.

For future reference...
If windows boots to a black screen and you get a cursor, hit ctrl-alt-del and bring up task manager. Then type explorer in the run. This will get the desktop loaded so you can start the repairs.

I've encountered this "error" several times. Kind of a crap shoot as to whether it is even repairable. Sometimes easy, sometimes leads to N&P.

Ctrl alt del does not work. Ctrl Shift Esc doesnt work.

sticky keys work. so pressing shift multiple times just enables sticky keys.

Assuming it doesn't boot into safe mode?
How many user profiles? If it's trying to automatically load one profile and it's corrupt, enabling the built-in admin so it presents a choice may give you some clues.

CurrentControlSet001 is the last set that the system started with. CurrentControlSet002 is the Last Known Good Config.
CurrentControlSet points to which one should be loaded, so compare the entries with a working Win 7 install.

Yes, safemode with and without networking do not boot at all. Tried last known configuration, system boot logging, pretty much every option in F8.