none
Windows 7 Booting to Black Screen with Command Prompt

    Question

  • I just removed a large amount of viruses from a computer and now when it boots it goes to a black screen with a command prompt window. I can start explorer from the command prompt window and get my desktop but it is very frustrating having to do so every time I boot the computer. I checked the registry value at HKEY_LOCAL_MACHINE\SOFTWARE\Micrsoft\Window NT\Current Version\Winlogon and Shell is set to 'explorer.exe'. Any thoughts on how I can fix this without a reinstall?
    Saturday, June 15, 2013 6:52 PM

Answers

  • If the infection occurred recently and System Restore is enabled, you can restore the computer to an earlier date using Safe Mode.

    To do so, restart the computer and start tapping the F8 key, select the Safe Mode with Command Prompt option. If you are asked to select an operating system, use the arrow keys to select the correct one and press Enter. Log on as an administrator or with an account that has administrator credentials.

    At the command prompt, type %systemroot%\system32\rstrui.exe and then press Enter. Follow the prompts to restore the computer to an earlier date.

    Sunday, June 16, 2013 7:20 AM
  • Hi,


    You can try to use Windows 7 installation DVD to perform a system restore.

      

    Note: Please ensure that the DVD-ROM is the first booting device.

     

    1) Please insert the Windows 7 RC DVD and reboot the computer.

    2) When we are prompted to press a key to boot from the DVD, please press Enter or the space bar.

    3) Choose your language settings, and then click Next.

    4) Click Repair your computer.

    5) Select the operating system you want to repair, and then click Next.

    6) On the System Recovery Options menu, click System restore.


    Regards,



    Vincent Wang
    TechNet Community Support

    Monday, June 17, 2013 8:00 AM
    Moderator

All replies

  • If the infection occurred recently and System Restore is enabled, you can restore the computer to an earlier date using Safe Mode.

    To do so, restart the computer and start tapping the F8 key, select the Safe Mode with Command Prompt option. If you are asked to select an operating system, use the arrow keys to select the correct one and press Enter. Log on as an administrator or with an account that has administrator credentials.

    At the command prompt, type %systemroot%\system32\rstrui.exe and then press Enter. Follow the prompts to restore the computer to an earlier date.

    Sunday, June 16, 2013 7:20 AM
  • Hi,


    You can try to use Windows 7 installation DVD to perform a system restore.

      

    Note: Please ensure that the DVD-ROM is the first booting device.

     

    1) Please insert the Windows 7 RC DVD and reboot the computer.

    2) When we are prompted to press a key to boot from the DVD, please press Enter or the space bar.

    3) Choose your language settings, and then click Next.

    4) Click Repair your computer.

    5) Select the operating system you want to repair, and then click Next.

    6) On the System Recovery Options menu, click System restore.


    Regards,



    Vincent Wang
    TechNet Community Support

    Monday, June 17, 2013 8:00 AM
    Moderator
  • Hi,

    Something might be still hooked up to the startup process and/or the winlogon. You may try Autoruns tool from SysInternals and try disabling (unchecking the box) all irrelevant third party files hooked on to the Winlogon, Logon and Explorer tab. A reboot post this setting should work out.


    Regards, AnikG

    Monday, June 17, 2013 11:01 AM
  • Willy,

    You were close.  The malware probably infected your current user rather than local machine.  This fix for me was to go to the same path: HKEY_Current_User\SOFTWARE\Micrsoft\Window NT\Current Version\Winlogon and Shell is set to 'explorer.exe' except use HKEY_Current_User as opposed to HKEY_Local_Machine.  The malware infected the winlogon shell for your user profile only (not administrator or other users).

    This post helped.  Thanks,

    Ray

    Wednesday, October 23, 2013 3:11 PM