Blank Screeen with just mouse pointer.

[mln]

If a System has winhelp.exe and rundll.exe running as a service no exe files opens including our toolkit Mwav.

But on killing these two process it starts working and clears the files but in the end the Administrator or all users are disabled.

By mistate if we do not enable these but restart the system starts but with a Blank screeen and just the mouse pointer.

Any solution.

[Shrinivas]

can you please replace the klif.sys file in c:\windows\system32\drivers\
by c:\program files\escan\w2k\klif.sys.

Please restart and then check.

[mln]

I have tried this it has not worked out.

It looks like the user accounts gets disabled.

[Ajay Verma]

Hi have face this problem couple of time and did't find any solution but to just format after taking backup, which is painful.

Any Solution pleeeeeeeeeeeaaase .......

[arvind123890]

Hello,
I do have faced the same problem few days back, and the resolution is
pls navigate to the below mentioned entry in the registry editor:
hklm\software\microsoft\windows nt\current version\win logon
By clicking on the above entry u will get some entries on the right hand side screen, just check there will be enrty called system.
Its value needs to be blank.
If the value will be changed(if some value is added over there) after restarting the machine u will get the problem blank screen with mouse pointer. So just make sure that its value is blank, and nothing is added in the value.
So if u r not sure after scanning the machine with mwav, pls navigate to same entry and check whether the value is blank.

[mehulc]

If you are getting this blank screen error with just mouse pointer you will have two options to get access to the registry for making the changes in it.
Either you will have to boot the machine using any bootable CD such as Bart PE OR you will have to connect the HDD of the infected machine as a secondary to other machine.

By any of the above ways you will get the access to the registry.

Then to modify the registry please follow the below procedure

1) open the registry
2) A single Left Click on HKEY_LOCAL_MACHINE
3) Go to Files > select Load Hive
4) Browse to C:\windows\system32\config\
5) select the file name Software and click on Open
6) As key name you can enter ABC or 123 , It will creat an entry (Folder) by the same key name under HKEY_LOCAL_MACHINE
7) Navigate through HKEY_LOCAL_MACHINE\123\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon
8 ) single click on Winlogon to highlight it
9) At the right hand side double click on System > Remove every thing from value data of "system" string value.
10) double click on "Userinit" string value and make its value data to "C:\WINDOWS\system32\userinit.exe, "
(Note : a comma is must after the userinit.exe)
11) Press F5 to refresh the registry
12) Go back to 123 entry to highlight it
13 )Then go to files and select unload hive
14) Press F5
15) Restart the machine and check.