Win 7 Black screen with cursor and dos box

[PCS]

Had a Win7 PC with a Virus today - UK Police fine.

PC would boot and right before the the police demand, it showed it was loading a file from c:\users\user\app data\local\temp\dfgjfghkfdnhgkdfgjdhgfkdhg.bfg

Deleted this file so i could then get access to the PC and scanned with malwarebytes, tdss killer and hitman pro.

searched through registry for dfgjfghkfdnhgkdfgjdhgfkdhg.bfg and removed all references.

PC now boots to a black screen with cursor and dos box sat at C:\Windows\System32

PC will just stay there until you type "explorer" or close box and do CTRL+ALT+DEL, new task and explorer.

searched around and checked shell - this is just explorer.exe

Thanks all.

 

[ComputerRepairTech]

Had a Win7 PC with a Virus today - UK Police fine.

PC would boot and right before the the police demand, it showed it was loading a file from c:\users\user\app data\local\temp\dfgjfghkfdnhgkdfgjdhgfkdhg.bfg

Deleted this file so i could then get access to the PC and scanned with malwarebytes, tdss killer and hitman pro.

searched through registry for dfgjfghkfdnhgkdfgjdhgfkdhg.bfg and removed all references.

PC now boots to a black screen with cursor and dos box sat at C:\Windows\System32

PC will just stay there until you type "explorer" or close box and do CTRL+ALT+DEL, new task and explorer.

searched around and checked shell - this is just explorer.exe

Thanks all.

Just double checking here, you checked both the shell registry locations:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

 

[ohio_grad_06]

Since you killed what ailed it, I'd say boot from a windows 7 disc, try to do system restore to a day or so before, then finish cleaning.

 

[PCS]

There were only 3 restore points available, I already tried the oldest but it failed to restore.

 

[ComputerRepairTech]

ok so you checked both shell spots in the registry...

did you confirm the userunit entry is normal?

(I assume you would notice if you were in safe mode with command prompt)

does it work in safe mode?