Black Screen Of Death?

Discussion in 'Malware Help (A Specialist Will Reply)' started by Chaos Annihilator, Dec 23, 2025.

  1. Chaos Annihilator

    Chaos Annihilator Private First Class

    Merry Christmas!
    I believe I've encountered the new black screen of death. I have the computer running now, but I am wondering if it could have happened because of a virus, and I am wondering if there is any other steps I need to take.

    Here is what happened and what I've done so far:

    Since updating to Windows 11 in October, both of my laptops have been really slow. My older laptop (only by a year or so) continued to fail to install the latest security update. I read that running chkdsk /f might help. It did help, and also helped with the extreme slowness. So I ran it on the newer laptop as well, even though the updates were downloading properly (the newer laptop is this one in question with the black screen of death).

    After running chkdsk /f on this laptop, it worked fine for a couple of days. I regularly run a full virus scan (windows defender) on Monday nights, so last night I did a scan. When I got up this morning, all seemed good. It said nothing was found, so I restarted the computer.

    During restart, it looked like chkdsk /f was running again, the same "fixing" followed by numbers and percents was running across the bottom of the screen. I wondered why this was happening, but let it run its course.

    Then the screen became black, with this message
    "Your device ran into a problem and couldn't be repaired. Click or press enter to see other recovery options. Couldn't connect to the network:..." and then listed something in my C drive system 32, which I failed to copy word for word.

    I clicked for other recovery options, and selected the option to try to let my device repair itself. It could not.

    I looked on the Microsoft website, and the first troubleshooting option I found was to turn off the computer, unplug new hardware, and turn it on. I had no new hardware, the only hardware was my mouse (which has needed replaced for many years now), but I figured it was worth a try. So, I selected the option to shut down, let it shut down, unplugged my mouse, turned the computer back on, and all seems fine.

    Can all be fine? Do I need to check for viruses, or take any other steps?

    I am going to run another windows full system scan while waiting for a reply. Any help is appreciated.
    Thanks.
     
  2. Oh My!

    Oh My! Malware Expert Staff Member

    Greetings and welcome back to the Major Geeks Malware Forum.

    Let's start with this.

    ===================================================

    Farbar Recovery Scan Tool (FRST)

    --------------------
    • Download FRST64 and save the file on your Desktop
    • If your computer language is other than English right click on the FRST64 icon and rename it to FRST64english
    • Right click on the icon and select Run as administrator
    • Note: If you receive any warning about the download it is a false positive and you can ignore it. Click on More info to get the Run anyway option
    • Click Yes to the disclaimer
    • Click Scan and allow the program to run
    • When completed, FRST.txt and Addition.txt reports will be saved on the Desktop
    • Please attach the reports to your reply
    ===================================================

    Things I would like to see in your next reply.
    • Attached reports
     
  3. Chaos Annihilator

    Chaos Annihilator Private First Class

    Thank you for responding so close to Christmas! The windows full system scan is still running, but it didn't find anything last night. Should I stop it to do this, or let it finish, or work on FRST at the same time?
     
  4. Oh My!

    Oh My! Malware Expert Staff Member

    Let it finish.
     
    Chaos Annihilator likes this.
  5. Chaos Annihilator

    Chaos Annihilator Private First Class

    The scan finished, and still found nothing. Attached are the logs.

    Normally, after running a scan, I would restart the computer. But, since running a scan and then restarting was what I had done before the problems began earlier today, should I restart at this point or wait for further instructions?

    Thanks.
     

    Attached Files:

  6. Oh My!

    Oh My! Malware Expert Staff Member

    I will evaluate the reports you posted. I may not be replying until tomorrow.
     
  7. Chaos Annihilator

    Chaos Annihilator Private First Class

    Okay, thanks
     
  8. Oh My!

    Oh My! Malware Expert Staff Member

    Thank you for your patience.

    This is why chkdsk is triggered.

    I do not see any evidence of malicious software but there are some corruptions we need to address.

    Please do this.

    ===================================================

    Uninstalling Programs Using Revo Uninstaller Free Portable

    --------------------

    • Download Revo Uninstaller Free Portable and save it to your Desktop
    • Right click on the folder and select Extract All..., then click Extract
    • Double click on the RevoUninstaller-Portable folder
    • Right click on RevoUPort and select Run as administrator
    • Click OK on the License Agreement
    • From the list of programs double click on the listed program(s), or anything similar, to remove it (if it exists)
    Code:
    Spybot - Search & Destroy
    
    • If the program's uninstaller appears work through the steps to remove the program(s)
    • Be sure the Advanced option is selected then click Scan
    • For each window that may appear identifying leftover items click Select All, Delete, then confirm the deletion
    • Once done click Finish
    • Reboot your computer
    ===================================================

    Uninstalling Adobe Flash Player

    --------------------

    Note: Adobe Flash Player is no longer supported and is a security risk.

    • Download Adobe Flash Player Uninstaller and save it to your Desktop
    • Right click on the icon and select Run as administrator
    • Click Uninstall then Done to reboot your computer
    ===================================================

    Running Chkdsk /R

    --------------------

    • Click Start, type cmd, then select Run as administrator
    • Type chkdsk C: /r and press Enter
    • When asked to schedule the disk check for next reboot, press Y then hit Enter
    • Restart your computer and allow the process to run unhindered
    ===================================================

    ListChkdskResult by SleepyDude

    --------------------
    • Download ListChkdskResult and save it to your Desktop
    • Right click on the file and select Run as administrator
    • When completed copy and paste the contents of the ListChkdskResult.txt report in your reply
    ===================================================

    Farbar Recovery Scan Tool - Run Fix Using Attached File

    --------------------
    • Download the attached file and save it in the same location as FRST.exe (example, Desktop, USB device) <<< Important
    • Right click on FRST and select Run as administrator
    • Click Fix and once completed your computer will reboot
    • The tool will create a log on the desktop called Fixlog.txt
    • Copy and paste the contents of the report in your reply. If it is too large you can attach it or uploaded here
    ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
    • Spybot uninstalled?
    • Adobe uninstalled?
    • ListChkdskResult report
    • Fixlog
     

    Attached Files:

  9. Chaos Annihilator

    Chaos Annihilator Private First Class

    Thank you for your help. Sorry it's taking me so long, I followed your instructions down to Chkdsk /R, which is still running and taking a long time.
     
  10. Oh My!

    Oh My! Malware Expert Staff Member

    Thanks for the update. It can take quite awhile when the file system needs to be repaired.
     
    Chaos Annihilator likes this.
  11. Chaos Annihilator

    Chaos Annihilator Private First Class

    Okay, it is done.
    Spybot is uninstalled,
    Adobe is uninstalled

    I am pasting the ListChkdskReport, and attaching the Fixlog:

    ListChkdskResult by SleepyDude v0.1.7 Beta | 21-09-2013

    ------< Log generate on 12/24/2025 6:19:47 PM >------
    Category: 0
    Computer Name: LAPTOP-DDK31LC2
    Event Code: 1001
    Record Number: 15058
    Source Name: Microsoft-Windows-Wininit
    Time Written: 12-25-2025 @ 00:13:19
    Event Type: Information
    User:
    Message:

    Checking file system on C:
    The type of the file system is NTFS.
    Volume label is Windows.

    A disk check has been scheduled.
    Windows will now check the disk.

    Stage 1: Examining basic file system structure ...
    2385408 file records processed.

    File verification completed.
    Phase duration (File record verification): 3.51 minutes.
    49514 large file records processed.

    Phase duration (Orphan file record recovery): 12.29 milliseconds.
    0 bad file records processed.

    Phase duration (Bad file record checking): 1.54 milliseconds.

    Stage 2: Examining file name linkage ...
    52227 reparse records processed.

    2697734 index entries processed.

    Index verification completed.
    Phase duration (Index verification): 13.03 minutes.
    0 unindexed files scanned.

    Phase duration (Orphan reconnection): 5.61 seconds.
    0 unindexed files recovered to lost and found.

    Phase duration (Orphan recovery to lost and found): 3.55 milliseconds.
    52227 reparse records processed.

    Phase duration (Reparse point and Object ID verification): 41.09 seconds.

    Stage 3: Examining security descriptors ...
    Cleaning up 29 unused index entries from index $SII of file 0x9.
    Cleaning up 29 unused index entries from index $SDH of file 0x9.
    Cleaning up 29 unused security descriptors.
    Security descriptor verification completed.
    Phase duration (Security descriptor verification): 175.19 milliseconds.
    156164 data files processed.

    Phase duration (Data attribute verification): 1.69 milliseconds.
    CHKDSK is verifying Usn Journal...
    39799320 USN bytes processed.

    Usn Journal verification completed.
    Phase duration (USN journal verification): 1.86 seconds.

    Stage 4: Looking for bad clusters in user file data ...
    2385392 files processed.

    File data verification completed.
    Phase duration (User file recovery): 3.04 hours.

    Stage 5: Looking for bad, free clusters ...
    176343310 free clusters processed.

    Free space verification is complete.
    Phase duration (Free space recovery): 16.21 minutes.

    Windows has scanned the file system and found no problems.
    No further action is required.

    975353855 KB total disk space.
    266901636 KB in 1037459 files.
    534604 KB in 156165 indexes.
    0 KB in bad sectors.
    2544375 KB in use by the system.
    65536 KB occupied by the log file.
    705373240 KB available on disk.

    4096 bytes in each allocation unit.
    243838463 total allocation units on disk.
    176343310 allocation units available on disk.
    Total duration: 3.60 hours (12982503 ms).

    Internal Info:
    00 66 24 00 a3 36 12 00 c3 73 1e 00 00 00 00 00 .f$..6...s......
    fe 01 00 00 05 ca 00 00 00 00 00 00 00 00 00 00 ................

    -----------------------------------------------------------------------
    Category: 0
    Computer Name: LAPTOP-DDK31LC2
    Event Code: 26226
    Record Number: 14731
    Source Name: Chkdsk
    Time Written: 12-23-2025 @ 19:14:48
    Event Type: Information
    User:
    Message: Chkdsk was executed in scan mode on a volume snapshot.

    Checking file system on \Device\HarddiskVolume3
    Volume label is Windows.

    Stage 1: Examining basic file system structure ...
    Found corrupt basic file structure for "\ProgramData\TEMP <0x191,0x310e>"
    ... queued for offline repair.
    2385408 file records processed.
    File verification completed.
    Phase duration (File record verification): 4.86 minutes.
    49512 large file records processed.
    Phase duration (Orphan file record recovery): 46.68 milliseconds.
    0 bad file records processed.
    Phase duration (Bad file record checking): 0.00 milliseconds.

    Stage 2: Examining file name linkage ...
    52238 reparse records processed.

    ----------------------------------------------------------------------


    Stage 1: Examining basic file system structure ...
    Deleted corrupt attribute list entry
    with type code 80 in file 310E.
    Unable to locate attribute of type 0x80, lowest vcn 0x0,
    instance tag 0x6 in file 0x310e.
    Deleted corrupt attribute list entry
    with type code 80 in file 310E.
    Unable to locate attribute of type 0x80, lowest vcn 0x0,
    instance tag 0x3 in file 0x310e.
    Deleted corrupt attribute list entry
    with type code 80 in file 310E.
    Unable to locate attribute of type 0x80, lowest vcn 0x0,
    instance tag 0x4 in file 0x310e.
    Unable to locate attribute with instance tag 0x3 and segment
    reference 0x19100000000310e. The expected attribute type is 0x80.
    Deleting corrupt attribute record (0x80, 008586AE)
    from file record segment 0x310E.
    Unable to locate attribute with instance tag 0x4 and segment
    reference 0x19100000000310e. The expected attribute type is 0x80.
    Deleting corrupt attribute record (0x80, 14266E2F)
    from file record segment 0x310E.
    Unable to locate attribute with instance tag 0x6 and segment
    reference 0x19100000000310e. The expected attribute type is 0x80.
    Deleting corrupt attribute record (0x80, D9B840AB)
    from file record segment 0x310E.

    Stage 2: Examining file name linkage ...

    -----------------------------------------------------------------------
    Category: 0
    Computer Name: LAPTOP-DDK31LC2
    Event Code: 26228
    Record Number: 14611
    Source Name: Chkdsk
    Time Written: 12-23-2025 @ 01:39:48
    Event Type: Information
    User:
    Message: Chkdsk was executed in verify mode on a volume snapshot.

    Checking file system on \Device\HarddiskVolume3
    Volume label is Windows.

    Examining 1 corruption record ...

    Record 1 of 1: Corrupt File "\ProgramData\TEMP <0x191,0x310e>" ... Attribute list entry with type code 80 in file 310E is corrupt.
    Unable to locate attribute of type 0x80, lowest vcn 0x0,
    instance tag 0x6 in file 0x310e.
    Attribute list entry with type code 80 in file 310E is corrupt.
    Unable to locate attribute of type 0x80, lowest vcn 0x0,
    instance tag 0x3 in file 0x310e.
    Attribute list entry with type code 80 in file 310E is corrupt.
    Unable to locate attribute of type 0x80, lowest vcn 0x0,
    instance tag 0x4 in file 0x310e.
    Unable to locate attribute with instance tag 0x3 and segment
    reference 0x19100000000310e. The expected attribute type is 0x80.
    Attribute record (80, 008586AE) from file record segment 310E
    is corrupt.
    Unable to locate attribute with instance tag 0x4 and segment
    reference 0x19100000000310e. The expected attribute type is 0x80.
    Attribute record (80, 14266E2F) from file record segment 310E
    is corrupt.
    Unable to locate attribute with instance tag 0x6 and segment
    reference 0x19100000000310e. The expected attribute type is 0x80.
    Attribute record (80, D9B840AB) from file record segment 310E
    is corrupt.
    corruption found.

    1 corruption record processed in 16.3 seconds.

    Windows has examined the list of previously identified potential issues and found problems.
    Please run chkdsk /scan to fully analyze the problems and queue them for repair.

    -----------------------------------------------------------------------
    Category: 0
    Computer Name: LAPTOP-DDK31LC2
    Event Code: 1001
    Record Number: 14165
    Source Name: Microsoft-Windows-Wininit
    Time Written: 12-20-2025 @ 21:07:48
    Event Type: Information
    User:
    Message:

    Checking file system on C:
    The type of the file system is NTFS.
    Volume label is Windows.


    A disk check has been scheduled.
    Windows will now check the disk.

    Stage 1: Examining basic file system structure ...
    Cleaning up instance tags for file 0x310e.
    2385408 file records processed.

    File verification completed.
    Phase duration (File record verification): 3.66 minutes.
    49590 large file records processed.

    Phase duration (Orphan file record recovery): 15.99 milliseconds.
    0 bad file records processed.

    Phase duration (Bad file record checking): 1.51 milliseconds.

    Stage 2: Examining file name linkage ...
    52387 reparse records processed.

    2697180 index entries processed.

    Index verification completed.
    Phase duration (Index verification): 14.85 minutes.
    0 unindexed files scanned.

    Phase duration (Orphan reconnection): 5.58 seconds.
    0 unindexed files recovered to lost and found.

    Phase duration (Orphan recovery to lost and found): 54.61 seconds.
    52387 reparse records processed.

    Phase duration (Reparse point and Object ID verification): 42.75 seconds.

    Stage 3: Examining security descriptors ...
    Cleaning up 5336 unused index entries from index $SII of file 0x9.
    Cleaning up 5336 unused index entries from index $SDH of file 0x9.
    Cleaning up 5336 unused security descriptors.
    Security descriptor verification completed.
    Phase duration (Security descriptor verification): 3.66 seconds.
    155887 data files processed.

    Phase duration (Data attribute verification): 2.04 milliseconds.
    CHKDSK is verifying Usn Journal...
    Usn Journal verification completed.

    Windows has made corrections to the file system.
    No further action is required.

    975353855 KB total disk space.
    258159004 KB in 1037271 files.
    534332 KB in 155888 indexes.
    0 KB in bad sectors.
    2505143 KB in use by the system.
    65536 KB occupied by the log file.
    714155376 KB available on disk.

    4096 bytes in each allocation unit.
    243838463 total allocation units on disk.
    178538844 allocation units available on disk.
    Total duration: 20.32 minutes (1219639 ms).

    Internal Info:
    00 66 24 00 d2 34 12 00 e6 6f 1e 00 00 00 00 00 .f$..4...o......
    fc 01 00 00 a7 ca 00 00 00 00 00 00 00 00 00 00 ................

    -----------------------------------------------------------------------
     

    Attached Files:

  12. Chaos Annihilator

    Chaos Annihilator Private First Class

    I don't know if this helps you any, but during all of the rebooting required, this computer always restarted with no issues.

    A few questions:

    I notice you often have me uninstall Spybot. Is Spybot not a good thing to install?

    Many of the games I play automatically reinstall Adobe after you have me remove it. Is there something I can use instead?

    Did I break something when I ran chkdsk /f?

    Again, sorry it took so long. I understand if you can't get back to me tomorrow.

    Have a merry Christmas!
     
  13. Oh My!

    Oh My! Malware Expert Staff Member

    Merry Christmas to you as well.

    There are a few alternatives to Adobe Flash. I don't know much about them but Ruffle seems to be popular.

    -----

    The program is disabled and out of date. I recommend downloading a new version if you'd like to use the program.

    -----

    You did not break anything running chkdsk /f.

    There was an issue that could not be resolved when the operating system was up and running. By selecting yes (Y) after running the command chkdsk C: /r the computer was instructed to run chkdsk again but do it before the operating system loaded. That "offline" environment allowed access to the corruption.

    -----

    There is one more system corruption we need to address.

    Please do this.

    ===================================================

    Farbar Recovery Scan Tool Fix

    --------------------
    • Right click on the FRST64 icon and select Run as administrator
    • Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
    • There is no need to paste the information anywhere, FRST64 will do it for you
    Code:
    Start::
    CloseProcesses:
    cmd: Dism /Online /Cleanup-Image /RestoreHealth
    End::
    
    • Click Fix
    • When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
    ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
    • Fixlog
     
    Chaos Annihilator likes this.
  14. Chaos Annihilator

    Chaos Annihilator Private First Class

    Thanks for the information, and for responding today. I'm glad I didn't break anything!

    The log follows, but it seems it had to terminate early? I'm not sure if it worked:

    Fix result of Farbar Recovery Scan Tool (x64) Version: 20-11-2025
    Ran by Hellhound Hunter (25-12-2025 13:11:46) Run:2
    Running from C:\Users\Hellhound Hunter\Desktop
    Loaded Profiles: Hellhound Hunter
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    Start::
    CloseProcesses:
    cmd: Dism /Online /Cleanup-Image /RestoreHealth
    End::
    *****************

    Processes closed successfully.

    ========= Dism /Online /Cleanup-Image /RestoreHealth =========


    Fixing is terminated due to reaching maximum fixing time of 60 minutes. <==== ATTENTION
     
  15. Chaos Annihilator

    Chaos Annihilator Private First Class

    I notice the last thing we fixed had something to do with images. Since upgrading to Windows 11, this computer has had a very difficult time with images. They don't load at all, and stay white, or they are very blurry and take forever to pixelate in, if they ever do. Could this have fixed that?
     
  16. Oh My!

    Oh My! Malware Expert Staff Member

    It is very possible.

    FRST64 times itself out after 60 minutes. That is what happened during the last attempted Fixlist. In order to avoid that we need to run the command a different way.

    Please do this.

    • Click Start, type cmd, then select Run as administrator
    • Copy and paste Dism /Online /Cleanup-Image /RestoreHealth after the command prompt then hit Enter
    • Allow the process to complete. It may take less time this time.

    Report whether it completed successfully.
     
  17. Chaos Annihilator

    Chaos Annihilator Private First Class

    It says:
    "The restore operation completed successfully.
    The operation completed successfully."
     
  18. Oh My!

    Oh My! Malware Expert Staff Member

    Perfect.

    Please run Windows Update until there are no more updates available or you receive an error message. If your receive an error, provide the error information in your reply.
     
  19. Chaos Annihilator

    Chaos Annihilator Private First Class

    Hello,
    I just checked for updates, and it says it is up to date. At some point yesterday, it updated. Maybe in the evening? I can't remember. It was a quick update, not an all-night-pull-your-hair-out one.

    What causes things to corrupt? Does it just happen over time? Is there some place where Windows alerts you to system corruption?
     
  20. Oh My!

    Oh My! Malware Expert Staff Member

    Corruptions are common and there are a lot of potential causes. Windows Update hiccups, improper shutdowns, conflicts involving drivers or software, hardware issues, etc.

    On occasion you may get an alert because a file is missing or a program may not run. For the most part we address potential corruption issues as a part of our overall strategy in evaluation a computer where something seems to be amiss.
     
  21. Chaos Annihilator

    Chaos Annihilator Private First Class

    Thanks for all your help. I am a book learner, is there a book about computers that you would recommend?

    Do you think this computer is okay and ready to go now?
     
  22. Oh My!

    Oh My! Malware Expert Staff Member

    Your computer is all set and fit for use.

    I am not familiar with and training books but there are resources available. It depends on what aspect of computers you are interested in.
     
    Chaos Annihilator likes this.
  23. Chaos Annihilator

    Chaos Annihilator Private First Class

    Great, thanks!

    I hope to really get into computers when I have more time later. For now it would be good to have enough knowledge to be able to use it without freaking out and running to you every time something unexpected happens :)

    When we updated to Windows 11, I bought a few Windows 11 for Dummies books, but I found no information on the black screen I was seeing this time, and worried that following their instructions for helping an update that wouldn't download had caused the whole problem (which I guess we decided it didn't, but I was still worried).

    I really appreciate what you do, and how you helped me even during the holiday! Thank you so much!
     
  24. Oh My!

    Oh My! Malware Expert Staff Member

    You are quite welcome and always welcome here.

    Computers are complex beasts and the getting to the root cause of a symptom can be a daunting task. In the past there were training programs you could enroll in to be trained on how to deal with these issues. Unfortunately all of the training programs have been closed, including the one at BleepingComputer.com where I was trained and spend most of my time.

    A quick Google search for malware training programs provided some information including one from Microsoft. I would recommend you dabble in these types of sites to get a feel of where you stand in relation to current computer understanding and how that might fit with what you would like to learn.

    For now I would recommend you give it your best shot at trying to resolve your own issues but don't hesitate in posting for help if it gets to be too much. You could even look through the topics at BleepingComputer (many more topics there) just to see how problems are presented and how helpers try to help.
     
    Chaos Annihilator likes this.

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds