Stuck with black screen of death

[DarrellS]

I thought about you the last couple of days and the frustration that you are going though. For the last couple of months, I've noticed when my PC slows down or a program crashes (which seems to be a lot lately), that I have multiple instances of explorer.exe in task manager. I've seen a lot of people on Google with this same problem with Windows 7. None of them that fixed the problem can remember how they did it and others said it was a virus. Well, I've run all kinds of scans and no malware or viruses were found. A few days ago, while I was doing my normal work, I did a right click in Windows Explorer and an installer popped up trying to install a PDF Createor in Paperport an before I could kill the install attempt, it crashed with an error 2203 something about Windows Installer. This would happen off and on while using right click in explorer so I thought first I'd uninstall Paperport and reinstall it but I just ended up getting nowhere for two days. Nuance could not uninstall and it could not install. Getting the same error message every time. I searched and searched for help. Found a program to completely remove paperport and everything that comes with it but it was still no help. Microsoft website was no help either since I could not download and install windows installer. Well, they did kinda help since they led me to a site that led me to regedit which allowed me to get rid of all pending installs that were there (they were all Nuance/Paperport install attempts) so I cleaned those out. Then it led me to services to turn the installer off and on. Then to the temporary folder where I had to give SYSTEM and Everyone else control to make changes in the temp folder where the installer had to read and write to and from. Restarted the computer, stuck in the install and wallah, every program on the disc installed without an issue. I was almost ready to do a repair install of Windows 7 but had the patience this time to not jump to drastic conclusions like I usually do.

I hated this OS when I first installed it and it still gives me fits at times. Usually they have to do with permissions. So far I'm not having anymore explorer problems. It took me a while to get Windows 7 set up to look Windows 98SE (which I had XP set up to look like).

I was able to find a site that tells you how to make a non destructive re-install of Windows 7 that leaves you with all of your data, programs and settings. Hopefully, it can help you get back up and running.

https://www.winhelp.us/non-destructive-reinstall-of-windows-7.html

I was almost ready to use it and will if my problems aren't fixed. I could've just re-installed a backup but it's a few months old and I would've lost some stuff I've installed since then. Better than doing a complete format an re-install though. On the page above, there is a program called Speccy that has all kinds of system information, including your Windows 7 serial key.

[davexnet]

Have you tried a CHKDSK from the CMD prompt.
What about last known configuration ?

What about attempting System Restore from the CMD prompt (via WInRE)

[Mephesto]

I re-read your first post and realized I misunderstood what you were saying about the restore point files in the SVI folder. I read it as if you were saying there was no restore points, doh!

NOW as of today there are no restore points but I have the big files with gibberish filenames backed up in case someone has a way to extract all the shit from it. The files are in it including registry hives but they are fragmented.

Actually with Win 7 there are 2 places where you will find the registry hives, in C:\Windows\System32\config\RegBack (those are the files that are used when you select last good config) and the usual _restore folder in SVI.

Regback hives are dated 10/26/2014 and the _restore folder is the XP SVI folder, not Win7's. They're useless.

Here's a nice guide on doing a manual restore with recent versions of Windows.

That's a guide on doing manual restores on XP.

NEXT!

[Mephesto]

Have you tried a CHKDSK from the CMD prompt.

Yes.

What about last known configuration ?

Yes.

What about attempting System Restore from the CMD prompt (via WInRE)

rstrui.exe error because my system restore that caused this bullshit got interrupted and is still pending, remember?
But as of today, all restore points were automatically deleted anyway so this is useless.

[davexnet]

Have you tried a CHKDSK from the CMD prompt.

Yes.

What about last known configuration ?

Yes.

What about attempting System Restore from the CMD prompt (via WInRE)

rstrui.exe error because my system restore that caused this bullshit got interrupted and is still pending, remember?
But as of today, all restore points were automatically deleted anyway so this is useless.

I wish you luck going forward... As you imply, nothing obvious jumps out scouring the internets.

But sometimes obscure solutions appear. A motherboard on my son's PC recently died, and I replaced it
with something newer, Windows XP would not start because of the HDD controllers being different.
I found a small utility on the BART PE repair disk that did some kind of reset on the appropriate section of the registry.
Problem solved, XP started up, re-detected the controller and we were back in business.

Have you tried bootrec /fixmbr, /fixboot & /rebuildbcb ?

[nic2k4]

NOW as of today there are no restore points...

That's a guide on doing manual restores on XP.

I guess the point is moot now, I believe the guide applies to all versions of Windows (at least since XP). I checked the SVI folder on my Win 7 PC and the files listed in step 4 of the guide are the same. At this time I believe it's appropriate to say it; he's dead,Jim!

OTH, your problem is all that software you can't re-install 'cause you no longer have the keys and the few programs that didn't work under Win 7, but you need Win 7 for the SSD support. Solution, do a fresh Win 7 install and use Microsoft Virtual PC to run your XP with all its software.

My latest image backup is 2 months old, I made it just before doing the upgrade to 7 because I never expected any stable experience with it.

Smart of you to have made a backup. According to Microsoft you can use that image to create a VHD file to use with MS VPC. The instructions apply to VPC2004, I use Virtualbox so I can't tell you if this works the same with the latest VPC version. You might have to use another HDD to restore your XP backup and create a VHD using Disk2VHD. There may still be some life in that cat.

[nic2k4]

Have you tried bootrec /fixmbr, /fixboot & /rebuildbcb ?

With Win 7 Startup Repair does all that. It might be necessary to run it multiple times.

[Mephesto]

But sometimes obscure solutions appear. A motherboard on my son's PC recently died, and I replaced it
with something newer, Windows XP would not start because of the HDD controllers being different.
I found a small utility on the BART PE repair disk that did some kind of reset on the appropriate section of the registry.
Problem solved, XP started up, re-detected the controller and we were back in business.

Haha, trust me I've been there. Multiple times. The most serious, dire situation I've ever been in was in 2012 when I copied my 250GB HDD bit-for-bit to my new 2TB drive. After restarting (with both drives hooked up) my system was unbootable, on both the drives. I had no backups. The MBR was erased and the drive was recognized as unformatted, no filesystem detected.
Everybody told me it was a lost cause and that I had to use photorec (or whatever it was called) to salvage what I can and move on. This sentiment was unanimous in every place I went to for help. Their pathetic cynicism only made me ever so defiant against their shit advice and I grew more compulsive and determined to fix this, not just to get my OS back but to make a point.

How did I do it? Apparently drives are assigned not just a drive letter but a slot number as well, going up to 6 I believe. Because the contents of the HDD was copied bit-by-bit, so was the slot number designation so I guess this caused confusion in the BIOS that two drives occupied the same slot so trying to boot to it fücked up the MBR. All it took to fix it was assign the proper slot number to my 2TB HDD, I ran all the boot corrector features on the partitioning liveCD I was using. Then finally I mounted the partition with its proper drive letter, ran chkdsk and it booted successfully.

At other times when my system was unbootable after a minor mishap, all it took was mounting the drive with the proper letter with that liveCD to fix it.

But this time it's different. It boots fine but there's no logon screen. I've had problems with winlogon before which was easily fixed by replacing the registry hives with a backup, sometimes a much older backup when system restore similarly failed.

Have you tried bootrec /fixmbr, /fixboot & /rebuildbcb ?

Yes yes and yes.

[Mephesto]

I guess the point is moot now, I believe the guide applies to all versions of Windows (at least since XP). I checked the SVI folder on my Win 7 PC and the files listed in step 4 of the guide are the same. At this time I believe it's appropriate to say it; he's dead,Jim!

Umm

Change your "View" options to show details so you can sort the files/folders by date modified or created. Go to the most recent folder created BEFORE the issues had arisen. Inside that folder is another called "snapshot." Open it and copy the following to a temp directory:"

"Go to the most recent folder created before the issue" Dipshit couldn't be bothered to be specific about the exact location I need to go to for these non-existent hive copies preceded with an _underscore which are nowhere to be found in the backed up SysVolInfo folder that I looked into.
Actually I did find some in a folder named _restore{4F366BDF-1114-48A8-86C8-88CEE7E52368} There were two folders inside that one named RP127 and RP128 with a snapshot folder inside each of them. The registry hives inside are dated 10/22/2014 and 10/23/2014 respectively, both days before the upgrade to 7.

Basically... they are XP folders from the XP system restore just before I upgraded.

So please, stop sending me XP material.

[nic2k4]

Actually I did find some in a folder named _restore{4F366BDF-1114-48A8-86C8-88CEE7E52368} There were two folders inside that one named RP127 and RP128 with a snapshot folder inside each of them. The registry hives inside are dated 10/22/2014 and 10/23/2014 respectively, both days before the upgrade to 7.

Basically... they are XP folders from the XP system restore just before I upgraded.

So please, stop sending me XP material.

My Win 7 PC, which was a clean install onto an unformatted HDD, has a _restore{...} folder in the system volume information folder. In there, there's a bunch of RPxxx subfolders and all have the _registry_... hive files. Funny thing is there are more RPxxx folders than there are available restore points. I used Ccleaner to remove all but the last restore point before imaging the drive, might be that Ccleaner only modifies the list and leaves the files behind.

If you only see XP hives that could mean system restore was disabled in Win 7. BTW, I used a Linux live disc to look at the drive, that should not matter except I get to use a decent file search tool instead of the crap in Win 7. Search the SVI folder for *, then sort by date, check if you see some _registry_machine... files with a date that corresponds to your Win 7 upgrade.

I agree with you, I'm not willing to call anything dead until I see proof. I have never seen the fileset from an upgraded drive, it's possible the Win 7 restore files ended up in a different location. Using a restore point got you in this mess, there has to be files somewhere. That could be why they "couldn't be bothered to be specific about the exact location".

If the video card swap didn't work and all the restore points are gone, all that's left is the current corrupted registry hives. You can try to dig through them, but if they're incomplete or damaged, it would be difficult to fix it that way.

I didn't ask before 'cause I thought it would be below you, but for the sake of thoroughness do CTRL-ALT-DEL or SHIFT-CTRL-ESC do anything? Do you see a blue or red button at the bottom of the black screen?

[Mephesto]

Are you serious? Your Win7 restore points work like on XP? What version of 7 do you have, is it 32/64?

I have SysVolInfo backed up so they aren't gone for good. The current corrupted hives are useless because they were in the middle of being modified by system restore and got interrupted. They are of no use to me, only the hives from previous restore points.

No, Ctrl+Alt+Del doesn't work on the black screen. The only thing that works is pressing shift 5 times which brings up Stickykeys. Unfortunately, there's nothing I can do with that. Replacing corrupted hives with old 10/26/2014 hives brings up a failed to initialize logon error.
It's weird, on XP I once replaced my hives with 6-8 months old backups and my system worked again amazingly smooth, no visible problems that I expected. But then again my system went thru huge changes in the past 2 months so I'm not slamming 7 for not accepting rather outdated backups.

Using a restore point got you in this mess, there has to be files somewhere.

THERE are the files. Everything including the registry hives are inside those huge files with gibberish names. How the fück to manually extract anything from them is anyone's guess.

[nic2k4]

Are you serious?

No shit!

This is what's in my Win 7 x64 system volume information folder. I'm using a Mint live disc to view the folder so I know I'm looking at files and there's none of that NTFS symbolic links or virtual folder shenanigan going on.

Looking at your screen grab, those "huge files" are listed as local discs not as files or folders, can you see what's the file extension? Is this something that Paragon did when it backed up the SVI or is it a symlink magic trick? Could you restore the image to a spare drive and use Linux to look at the files?

Nooooooo, not sticky keys! I spent hours trying to fix a laptop once that turned out to be bloody stinky keys got auto-enabled without anyone noticing it. It would load up to the login screen and seemingly freeze there as typing a password wouldn't register any keystroke, funny thing the login screen had a black background. The only time I'd ever had to deal with it was when a client would complain that his PC said it had sticky keys and he wanted me to clean his keyboard! That's such a useless app, does any body use it other than Parkinson's patients. There doesn't seem to be any way to disable it in Win 7.

[Mephesto]

Yeah... files and hives from 2011. Very useful.
They don't have an extension.
Paragon? What makes you think I use that malfunctioning piece of shit that almost destroyed my system in 2012?
I used it just now to change the drive letters to reflect their PROPER designation and now this spare partition is damaged with Windows MSI errors, so I have to reinstall it now. Thanks Paragon.
I don't know what you mean by looking at the files with Linux. Can it OPEN them and extract anything from them? Your question sounds like "are they actual files?" Yes they are.

[nic2k4]

Yeah... files and hives from 2011. Very useful.

Hey, I just picked one RPxxx folder at random, but I hadn't noticed the date. It really looks like deleting restore points with Ccleaner is not a good idea.

They don't have an extension.

Maybe they're volume shadow copies. In that case a VSC browser should be able to open them. I've seen a couple that use the Windows API and service, but I doubt they can open standalone files. Doesn't hurt to try. Forensic Explorer will work, but it's not free and I don't know how much functionality you get with the 30 day trial.

Paragon? What makes you think I use that malfunctioning piece of shit that almost destroyed my system in 2012?

The path on your screen capture, broken C drive backup.PBD, pbd is a Paragon file extension. I wouldn't use it either, but it's been handy playing with some DVR file systems.

[coodbe]

I had a black screen with the large arrow. I also used system restore and eventually had no restore points to go back to. What made you use system restore in the first place? In my case, the computer would run fine for a day or two then would reboot itself constantly. Programs would seem corrupted. The symptoms would vary. It almost seemed like a virus. But virus scans did not find anything. I even had Acronis and images stored on external hard drives. I could even boot from an Acronis restore disc. But the computer never became stable and kept crashing. It would not even run long enough to do a complete restore of windows 7. In the end it was a hardware problem. One of the ram sticks was bad.

[Mephesto]

Yeah... files and hives from 2011. Very useful.

Hey, I just picked one RPxxx folder at random, but I hadn't noticed the date. It really looks like deleting restore points with Ccleaner is not a good idea.

I bet none of them are recent, they are likely vestigial folders from XP like mine.

Maybe they're volume shadow copies. In that case a VSC browser should be able to open them. I've seen a couple that use the Windows API and service, but I doubt they can open standalone files. Doesn't hurt to try. Forensic Explorer will work, but it's not free and I don't know how much functionality you get with the 30 day trial.

That program detected no shadow volumes and like all others including "system restore explorer" I can't set custom location to open the damn files.

The path on your screen capture, broken C drive backup.PBD, pbd is a Paragon file extension. I wouldn't use it either, but it's been handy playing with some DVR file systems.

No they aren't, I used EaseUS Todo Backup. I wouldn't touch Paragon.

coodbe, my memory sticks are fine.

[davexnet]

I looked at system restore explorer also. There must be some way to extract from those big files. Can 7z do it?
Perhaps take a copy of one for a test, simplify the name and put a .cab suffix on it.

Perhaps there was an underlying problem with your system, the \regback folder is supposed to contain recent backups.
For example, here is the contents of my Vista system.

[Mephesto]

They aren't archives, they are virtual drives of some sort. I hear them being called shadow volumes or something but I'm new to the subject so I have little background on this.
They have to be mounted as actual drives somehow so they can be browsed but none of the relevant programs I tried so far could let me point specifically to them. They try to load from C drive SysVolInfo by default which is a dead end because they are gone from that folder, they exist elsewhere because I backed them up before they got auto-deleted.

I'm obviously failing at google-fu because I could only find one such relevant program on my own: ShadowExplorer. The others I've been told by other people. So if anyone finds a way, I'd be immensely grateful.

[nic2k4]

They have to be mounted as actual drives somehow so they can be browsed...

Keyword, good idea:

http://www.forensicswiki.org/wiki/Mount_shadow_volumes_on_disk_images#Mounting_the_Shadow_Volume

[Mephesto]

They have to be mounted as actual drives somehow so they can be browsed...

Keyword, good idea:

http://www.forensicswiki.org/wiki/Mount_shadow_volumes_on_disk_images#Mounting_the_Shadow_Volume

I've already been to that page, it's useless. It assumes the volumes are in their default, expected folder which they aren't.

[nic2k4]

I bet none of them are recent, they are likely vestigial folders from XP like mine.

They're all from 2011, you must be right. I'm not sure where they came from, but around that time I was toying with WinFLP images trying to create a live CD. I might have accidentally extracted the SVI folder along the way. This was bugging me so I deleted the SVI folder and rebooted Windows. The folder got recreated and there was only a few files in it (kimeta.dat, iswift3.dat, tracking.log,syscache.hve and mountpointmanagerremotedatabase) and no subfolders. Then I created a restore point, two files with name in brackets {} and the SPP folder got added.

I've already been to that page, it's useless. It assumes the volumes are in their default, expected folder which they aren't.

You're supposed to convert your PBD files to VHD, then mount the VHD, then use VSSAdmin to mount the shadow volume, then use mklink to create a symlink that will give you access to the files in explorer. In the example the files would be at C:\shadow_volume_1.

[Mephesto]

My PDB files are EaseUS Todo Backup images, are you sure they can be converted to VHD? You assumed they were Paragon files at first.

[nic2k4]

'cause I have Paragon files that are PBD's. Yes they can, I forgot to include the link.

http://www.todo-backup.com/products/features/convert-physical-to-virtual.htm

[Mephesto]

Did everything, I get this:


Why can't I just open the individual fückin huge gibberish files? I had to spend hours converting the entire damn partition image to a VHD and in the end I get an error with no explanation.

And guess where I have been the past few days? I tried to create a new partition on the free space on my 2TB HDD with microsoft's diskmgmt.msc because I was too lazy to install EaseUS partition manager but as soon as that happened a few of my partitions went missing so I deleted that new partition I created a few seconds ago fearing I might've created it over one of them and... that somehow deleted all partitions (including this spare Win7 installation) on my 2TB disk. It was 2012 all over again, I spent 16 hours recovering all of my partitions, two of which were backups of my damaged C drive and so far I've recovered 7/8 of them. Does ANY part of this piece of shit operating system not malfunction?

[davejavu]

Total stab in the dark here, but found this in another forum. I see from an earlier post that from your black screen you can repeatedly press shift and get the sticky keys dialog to show up.



Not sure if you will see the highlighted link as some users in the other forum said they couldn't. If you can't see it the rest of this post will be pointless so feel free to stop reading!

1) press shift several times until the sticky keys window appears
2) click the link that'll lead to ease of access center
3) click cancel on the the bottom right corner of the set up sticky keys window
4) click control panel on the upper left corner (beside the make your computer easier to use title)

If this works you will at least be able to get your control panel up and access the system restore/recovery section. Don't know if you can resume an interrupted system restore or restart it again from scratch, assuming the files you need to restore from aren't completely borked. With any luck Windows will recognise that something went wrong with the previous attempt and offer you some options to resolve it (although I wouldn't risk anything valuable betting on it knowing Windows!)

The remaining points below are what the original poster in the other forum did, but may not be relevent to what you need to do next.

5) on the computer settings menu choose the recovery icon (make sure that the view is by either large or small icons for easier access)
6) click open system restore
7) click next on the bottom right corner until the button finish appears, then click it. (just follow everything the window says that will lead you to recovering your previous system in a certain time)
8) let it do its job and wait until your computer restarts

Best of luck finding a solution if this turns out to be useless.

[nic2k4]

Why can't I just open the individual fückin huge gibberish files? I had to spend hours converting the entire damn partition image to a VHD and in the end I get an error with no explanation.

'Cause MS doesn't spend much time polishing admin tools of that sort. Your first try applied to the shadow copy in the C drive SVI that should have worked, that can only mean the program has a bug, this patch should fix it.

And guess where I have been the past few days? I tried to create a new partition on the free space on my 2TB HDD with microsoft's diskmgmt.msc because I was too lazy to install EaseUS partition manager but as soon as that happened a few of my partitions went missing so I deleted that new partition I created a few seconds ago fearing I might've created it over one of them and... that somehow deleted all partitions (including this spare Win7 installation) on my 2TB disk. It was 2012 all over again, I spent 16 hours recovering all of my partitions, two of which were backups of my damaged C drive and so far I've recovered 7/8 of them. Does ANY part of this piece of shit operating system not malfunction?

Yeah, I wouldn't trust that buggy app for anything than the most basic tasks. The only disk management software MS ever put out that worked right was Fdisk, disk management in NT has been screwed since Win2k. I use Gparted for all partition work, never failed me yet. OTH, I'd never re-partition a live drive, don't you have an old drive or even a large enough flash drive lying around.

[Mephesto]

Thanks for the link to the hotfix. I was able to mount this time but now I have:


Sigh... you don't suppose there's a way to do a chkdsk on this do you? It mounts as a symbolic link and not as a local disk/removable drive.

Yeah, I wouldn't trust that buggy app for anything than the most basic tasks. The only disk management software MS ever put out that worked right was Fdisk, disk management in NT has been screwed since Win2k. I use Gparted for all partition work, never failed me yet. OTH, I'd never re-partition a live drive, don't you have an old drive or even a large enough flash drive lying around.

I needed a partition to copy this VHD to as you instructed and I considered creating one on the 260GB of free space left on this 2TB drive a simple operation. 'Guess I was wrong. This is the first and last time I ever use disk management. No I don't have a 250GB flash drive and this 2TB drive IS the old drive. My SSD is my main drive which as you know hosts my blackscreened OS.

[nic2k4]

It's supposed to mount as a symlink, you can only hope the corruption happened during the conversion process. Do you have a PC shop nearby that sells off-lease and used hardware? A 320GB drive usually goes for less than $30. You should try to restore the PBD file to make sure it's useable and while you're there you could just access it's SVI directly.

[Mephesto]

I can already access the SVI directly, of both the PBD and the new VHD that I mounted as an actual drive from which I mounted one of its restore points as that symlink you talked about which it said was... corrupted. Can I mount the restore point as a drive instead of a symlink?

[nic2k4]

When you attach the VHD with diskpart a new drive should be created. Don't mark it as read only and you will be able to change permissions... but you may also get unexpected changes as in I have no idea how Windows is going to react to the new SVI. Not that it would be bad, you can always convert the PDB to VHD again. You could try Shadow Explorer on that drive, but it might be that the only way to access the content of the Shadow Volume is with a symlink.