Prevx Blog
Windows Black Screen Root Cause
Posted by: Jacques Erasmus
We've been working with Microsoft to get to the bottom of the specific black screen issues in our earlier blog. We have made some significant progress in determining specific triggers of the black screen event.
The issue appears to be related to a characteristic of the Windows Registry related to the storage of string data. In parsing the Shell value in the registry, Windows requires a null terminated "REG_SZ" string. However, if malware or indeed any other program modifies the shell entry to not include null terminating characters, the shell will no longer load properly, resulting in the infamous Black Screen with the PC showing only the My Computer folder.
SysInternals was one of the first companies to discover this characteristic of the registry a number of years ago in their utility: RegHide http://technet.microsoft.com/en-us/sysinternals/bb897446.aspx which modifies registry entries to prevent them from being accessible within the operating system. This technique is frequently used by malware authors which is why it is recommended to first query the length of a registry value, and then read it into a buffer, forcing the null termination of strings whether or not null terminated by their content.
Having narrowed down a specific trigger for this condition we've done quite a bit of testing and re-testing on the recent Windows patches including KB976098 and KB915597 as referred to in our previous blog. Since more specifically narrowing down the cause we have been able to exonerate these patches from being a contributory factor.
We have not analyzed further whether a change occurred in the OS interpretation of this or other registry values. In any case, we believe there are significant benefits in the OS using the length of the value as recommended by the SysInternals article.
We have always strongly recommended keeping Windows and all other software up-to-date to reduce the window for exploitation by new threats. We'll keep you updated with further progress if we find anything new.
We apologize to Microsoft for any inconvenience our blog may have caused. This has been a challenging issue to identify. Users who have the black screen issue referred to can still safely use our free fix tool to restore their desktop icons and task bar.
27 comments so far
- Triple Helix on Dec 2 1:17, 2009
- Kes on Dec 2 5:04, 2009
- rod smith on Dec 2 6:34, 2009
- Simon Zerafa on Dec 2 8:50, 2009
- Kamel on Dec 2 10:38, 2009
- Solomon on Dec 2 11:58, 2009
- Paul Balmain on Dec 2 12:11, 2009
- JMan on Dec 2 12:15, 2009
- jack on Dec 2 14:42, 2009
- LB on Dec 2 15:22, 2009
- Bill on Dec 2 16:21, 2009
- wing on Dec 2 16:27, 2009
- patrick on Dec 2 16:37, 2009
- mike on Dec 2 16:58, 2009
- John on Dec 2 17:21, 2009
- Tom on Dec 2 17:30, 2009
- Michael on Dec 2 17:30, 2009
- Nate on Dec 2 17:51, 2009
- jim on Dec 2 19:27, 2009
- James Sutherland on Dec 2 20:17, 2009
- Sebastian K. on Dec 2 22:59, 2009
- Graham on Dec 3 3:53, 2009
- Tom on Dec 3 10:52, 2009
- hank on Dec 3 17:05, 2009
- Rogo on Dec 3 18:55, 2009
- 30yearVeteran on Dec 3 20:39, 2009
Well who's problem is it? Microsoft says it has nothing to do with the recent updates but the Prevx Fix- Fixed my problem on Windows 7 32bit!
Thanks for the extra info!
TH
every time MacAffee Security center sends an update (anything more than a tiny definition tweak), I get the black screen of death when I boot up the next time. I'm not sure if it's windows Part of the problem is definitely MacAffee, but it could be a conflict between windows and MacAffee.
P.S. once it reboots in safe mode, its fine, I reboot again, and it's all cool. The first time or two it happened scared to death of losing data or my machine. And like the previous guy I did the restore the first time and the stupid macaffee installed the update immediately, rebooted and crashed it again.
Now when macaffee does an update, I reboot before I close down for the night. get my BSOD but this is eventually going to fry my machine. which is why I bought an imac on black friday. (fwiw my machine is a nearly 3-year old vista machine bought when vista was brand new);
Got a black screen condition on my laptop running vista. It was running just fine, i shut it off and on next start up I had nothing. It would boot up and show the first microsoft loading screen, then go to black with only the pointer showing. would not change in safe mode. Control, alt, delete did not bring up task manager. Booted using F keys. checked all files & hard disk. nothing reported as problem. Tried system restore, all prior files were gone. Tried windows repair, showed no repairable problems. I had to reload vista system from factory backup. down loaded all required up dates, system is running fine now. Was this the black sceen problem, or something else?
Hi,
Like I asked yesterday in your previous blog (the comments have still not appeared - I wonder why?), how would those patches have caused any issues with registry ACL's or changes similar to these issues?
Perhaps 30 seconds of reflection would have show you that the Windows Defender and Time Zone updates could not have caused these issues in the first place.
Simon
Hi,
I had the problem since the updates of november and now the problem had evolved into a very bad situation; I have no more access to my machnie, it looks like my HD has crashed !!! Any help is welcome! thx
This happened to my wife's Acer Aspire laptop with Vista. There was a Windows Update, then black screen.
On reboot, it tried and failed to enter Windows. A utility opened to restore startup, and failed. I selected all the other options, one by one, such as 'restore to an earlier time' and 'restore from backups' and all failed.
I managed to get into DOS and saw the C drive was still there, which was encouraging, as I had believed we had lost it (and all our family photos).
I inserted a Windows 7 disk and managed to install. (Then burned a CD with our family files.)
On reboot, it went immediately into Checkdisk and found 8 bad sectors and other HD errors, and fixed them. Then Windows 7 worked ok.
I have sent the laptop back to Acer, as I believe that this was a HD failure.
I have a black screen. I am not technical and have resorted to my iPhone. Next time I will buy an Apple product I have had so many problems with Vista. I always make the minimum of changes to my computer because I am not technical. Never again will I buy a Windows product !
I bought a very cheap computer, installed Xubuntu on it and now I will not have any problems with WINDOWS anymore :-)
I am using windows vista and have been experiencing this problem for about two months now. If I shut my system down and then restart the system very thing will load all the way to my desktop then all of a sudden without any warning screen goes black, keyboard and mouse do not respond which leaves me with the only option to do a hard shut down. This problem doesn't always occur on every shut down,so if I lucky enough I've been trying to keep the machine from shutting down or doing any restarts once I get by without a black screen.
I am to the point now that I almost believe that Microsoft has done this intentionally in order to get more people to win7,but now that I see that system is also having issues leads me to believe that possibly Its one of there early updates that might apply to both systems. I must thank Prevx for bring this problem into the open, I hope this continues to be addressed.
I am going to try Prevx's fix. Hopefully this works for me.
Thank you Prevx
2 of my machines had a blue screen on November first week... Have not been able to resolve either one.
Any help is welcome
It's good to know that Prevx offers a solution and is trying to keep Microsoft honest. About a third of our computers had the "black screen" problem immediately after the Windows update. Our IT staff fixed the problem without too much trouble.
I think, like us, most users found a solution and didn't report the problem to Microsoft. It was just too much of a coincidence to say it wasn't related to the Windows updates. Microsoft should just own up to the mistake and apologize.
Prevx should be commended for it's efforts.
Last week, I had reformatted and reinstalled a Windows XP computer with the most current updates from Microsoft in office at work. For no known cause, every time when I finished remote access the office computer, and tried to log back on to the
office computer, the monitor would turn blank black except a message was displayed
(internally from the LCD monitor itself, not from XP) about resolution and no signal from the computer. I had to reboot the computer. Very strange. Now I think it has
to do with the updates after reading this article. Thanks Prevx for bringing up this problem.
I, too, applied the latest MS patches, and as mentioned before, was only affected at about the three weeks later time frame. Using Firefox, it first simply disappeared, leaving the desktop. The second and third times, I lost the browser and then the box came up asking if I want to send the report to FF, and then restart it. I did that. The fourth and fifth times, everything went black. I started pressing the escape key, cont.-alt.-del., enter, and then I had the desktop back, although I can't say I know if any icons, etc., went missing, or what keys I hit to get it back. I went back to surfing the net and stumbled onto an article mentioning the problem which linked to the Prevx article and fix. I applied the fix and have not had the problem return.
I'll be watching the Windows Secrets newsletter I love for their esteemed findings.
Thanks, Prevx.
i have had this issue on build 7100 for as long as i can remember , just assumed it was a RC oddity , if i have to reboot everything works perfect except no icons appear and no mouse pointer is evident, if i Ctrl Alt Del the expected screen appears and all seems well as is normal but leaving Ctrl Alt Del and returning to the desktop just presents a blank screen
I have tried closing and restarting explorer but this has no affect, the black screem remains , the only fix i have found is more reboots until my icons appear ??
Other machines i use with W7HP full versions and not RC versions have all the updates applied but no Black screen has been found, just my RC version is suffering which is no big issue as it will soon be replaced with a full W7 install
"It's good to know that Prevx offers a solution and is trying to keep Microsoft honest."
WoW! what a mis-interpetation of what Previx has just said in this blog entry. There is no "trying to keep Microsoft honest." from Previx here. Previx is admitting that it made a mistake in their initial assesment of the issue. Their fix may fix the issue, but the issue is not related to the updates.
And,,,my thanks to Previx for their blog entry clarifying the issue. That shows integrity.
reading the article sounds like Microsoft pointed out that its due to a registry change that hasnt been changed in these patches and is most likely malware, blaming microsoft for side affects of malware does push the popular microsoft bashing to new levels, in regards to mcafee being a contributing factor we have it on every machine in our enterprise (4000+ machines in uk) and also have the latest patches and havent had any black screens of death to date (touch wood), just feels abit like alot of these issues are more to do with the interface between the chair and the keyboard although I may be wrong.
Thank you for the update
My Vista machine was blue screening randomly, and I saw the black screen of death periodically for the last 3 months. I installed Windows 7, no change. I am proud of my new machine. I thought it was something I did for the longest time.
Turns out... my 4 year old HP printer was the cause. It has card slots for removable media (CF cards etc...) that wigged the system out. I unplugged the usb connection and have been problem free for 2 weeks now. It feels so good now!! Windows 7 has been the best OS I have ever used.
Boy am I glad that I use Linux.
I give up on Windows at Windows98, the registry setup has always been the Major problem in Windows and they still use it.
Linux doesn't use a registry , if something should happen it doesn't lockup the whole computer, it will just tell you that you have a problem with one function and bypass it and continue on and run the computer.
I've had a few Vista machines with the Black Screen of Death (KSOD?); a desktop and a laptop developed this after applying Windows Updates (but were cured by rolling back far enough in System Restore - re-applying the Windows updates did not repeat the problem). A second laptop had this intermittently; eventually, updating the graphics drivers seems to have cured it. (After repeated chkdsks, checking registry entries and BIOS settings, privileges of various system services, purging log files, disabling power saving...)
I'd be surprised if the Shell registry value caused the KSOD I was seeing: nothing was appearing apart from the mouse pointer, and the Secure Attention Key (SAK - ctrl-alt-del), supposed to be handled by winlogon.exe and immune from non-privileged interference including a wonky shell. Winlogon.exe hitting a bug trying to spawn the shell might explain it, I suppose; I wish I could attach a kernel debugger to a machine hitting this problem to work out what's happening, but that would be tricky.
I had the problem today. I turned on my laptop, it booted normally, I entered my Windows password, and then only the folder ...MYNAME\documents showed up. The rest was black. After trying again several times, I solved the problem by booting again in "safe mode with command prompt", typed in explorer.exe so the task bar showed up again, then I restored the system to 30 Nov 2009. It booted normally again, then I opened my anti-virus software, which found 3 viruses on my system, and since then, everything seems to be working again.
I hope this is it. And I'm looking forward to someone finding the true reason behind all this.
I have had this for the last couple of weeks. It seems to be starting up OK then it just stops on a black screen with mouse pointer working but nothing else. I restart Windows and it offers a repair back to the last restore point. This gets it going again. Right now I try not to shut down, I just hibernate. If I forget (happened three times) I have to go through the repair/restore. I'm on Windows 7 64 with Automatic Windows updates. Virus/malware scans from different vendors find nothing. I have had Avast installed for a long time. None of the other 3 PC's in my house are affected (2 windows 7 32 bit, one windows XP prof)
I had the same experience as Rod Smith: I applied the latest XP SP to a fresh--and working-- install of XP on a Dell laptop, and am left with nothing but a white cursor on a black screen. If it wasn't the update, I have no idea what it could be. I reformatted the drive before installing XP from the OEM CD, and the reason I applied the patch was that I had no working wifi driver. The first time I went online (via ethernet) was to download the patch. Under those conditions, I don't see how it could possibly be malware, unless Microsoft's own servers are spreading the malware.
I'm the IT director for a public school system running XP SP3 almost exclusively on all of our laptops and desktops. One of my users experienced the Black SoD which we resolved by rolling back the windows updates w/ System Restore. Made me nervous that the same thing would happen to other users with similarly configured systems, but interestingly enough, so far it's just that one. Hope it stays that way...
Who ever owns the problem. The Prevx fix made my laptop usable again. Thanks for the fix.
OK, had a client system, XP Home, that locked up a few seconds after login.
No BSOD, just a solid lockup.
With Safe Mode and System Restore narrowed down to Update associated with MS KB969947, as referenced by Prevx.
I now have this particular update "hidden" so it will not install again.
I'd gotten this system in on, I believe, the 20th and resolved within a couple days, maybe an hour of my time. Well before I'd seen the Prevx announcement.
I am by no means a Microsoft basher. I'm an MS Partner. I even love Vista.
However, it seems pretty conclusive and consistently repeatable. This update locks up this system every time when installed and when rolled back the system is fine. I'll grant that there may be extenuating circumstances.
I don't know about "millions of systems" but in principal, the Prevx apology might be premature.
I am thankful that I use an OS that allowed me to easily troubleshoot and resolve the problem. I have a vast amount of computer knowledge but I didn't really need to use that here, a little patience, common sense, and process of elimination did the trick. I didn't have to go out and by a mac or reformat over all my data and applications and install Linux.
Whether or not Microsoft acknowledges the problem I am confident that the patch will be re-released without problems at some point. They're good about that.
I've had this issue on a couple of machines where I work, both in the last two weeks and only after windows updates, no other software changes.....
On both boxes I reverted the OS back to before the 'Black Screen' issue using System Restore, I then applied all recent updates, one at a time - on one machine this issue returned after KB976098. The other one has not seen this issue since..... this is definitely random....