Black screen and white cursor after install on xp RRS feed

  • Question

  • After instaling the trial version of Windows Live One Care it found a Trojan. I proceeded to remove it. Following that, a series of errors dipalyed and said that I had to reboot. I did so and found that my computer now only starts with a black screen and cursor. I was able to start the computer in safe mode but the black screen and cursor was still there. I also tried "last known good configuration" which did nothing to.


    Im running windows xp.


    Any advice?

    Tuesday, August 5, 2008 2:51 PM


All replies

  • Yes, contact support if this problem began with the removal of an infection: FAQ: Reaching Support



    Tuesday, August 5, 2008 7:08 PM

  • Re: Trojan Win32 Siapag

    ok, few things:


    I've repaired dozens of these already.


    Symptoms are easy enough to spot, system detected a virus, asks for the windows sp3 cd then shuts down in 60 seconds, on rebooting though ends up at a blank screen with just the cursor, booting into safe mode and the task manager don't help.


    The files this virus infects is LSASS.EXE in the C:\WINDOWS\SYSTEM32 and C:\WINDOWS\SYSTEM32\DLLCACHE folders.


    The SOURCE of the virus is strange, turns out certain downloaded copies of the SP3 installer for windows (including the one from the windows update site) were pre-infected, no way microsoft would admit to this though.

    The way to repair a downed machine is fortunatly very simple:

    1. Boot off a Windows XP Home or Pro CD (Doesn't seem to matter which one).
    2. Start Recovery Console

    (In the next step, D is my CDROM, change the letter if neccessary)

    3. Type : copy d:\i386\lsass.ex_ c:\windows\system32\lsass.exe
    4. Type : copy d:\i386\lsass.ex_ c:\windows\system32\dllcache\lsass.exe

    5. Reboot system


    Windows should start fine.


    Anyhows, that should fix it for you

    Good luck to all,


    Thursday, August 7, 2008 12:48 AM
  • Thanks Ceridan_Aus, for your posts on this problem. I've alerted Microsoft and the situation is being investigated. I'm locking this thread (and other similar ones) and directing further discussion to this one: http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=3711890&SiteID=2



    Thursday, August 7, 2008 4:24 PM