Win10 opens to cmd prompt after login

Jazz1 · 08 Jun 2019

Hi;
A friend dropped of her comp for me to fix.
when starting it goes through the normal startup asks for password as normal, but then it opens to an administrative command prompt. If terminal closed nothing but black screen.
After talking to her it seems she fell for a scam that looked like it came from MS. She called the # and whoever answered gained access, made some changes then wanted a bunch of $$$.
That's when I got the call.

I am in the process of running a bootable Virus scan.

What next?? Help please.

Try3 · 08 Jun 2019

1 Boot from a disk, such as an installation disk or possibly your virus scanner, that lets you drop down into a command prompt or File explorer substitute then copy off whatever datafiles she does not want to lose that she did not already have backed up**.

2 ** Check that she did not have her backup drive connected during the attack and has not connected it since. Otherwise its contents would also be suspect.

3 Reinstall Windows 10 & all her applications.

4 Scan all the backed up & copied files thoroughly before copying them back to the computer.

Others might say that reinstallation is unnecesary & that your bootable malware scanner should be sufficient preparation for then addressing the current boot failure. But I would worry that the hostile control of the computer might have planted hard-to-find malware and I could not trust the computer without reinstallation.

Denis

Cr00zng · 08 Jun 2019

It seems that the shell is not loading.

Can you type in the command prompt: explorer.exe ?

Alternatively, type in regedit and see the setting for:

Code:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Look for the "Shell" setting, it should have only "explorer.exe"; if not, change it.

Just keep in mind that changing the registry setting requires admin right...

Cr00zng · 08 Jun 2019

Try3 said:

1 Boot from a disk, such as an installation disk or possibly your virus scanner, that lets you drop down into a command prompt or File explorer substitute then copy off whatever datafiles she does not want to lose that she did not already have backed up**. Denis

I don't disagree and have some doubt about the machine being clean...

On the other hand, it might be easier with the explorer.exe to recover user data, if it's recoverable. Just don't connect the machine to any network, especially yours...

Jazz1 · 08 Jun 2019

OK thanks for the replies.
Explorer.exe fired it up into safe mode.
Reg. key as you said it should be.
But USB Keyboard not working.
Running Malware bytes, it is slow and finding multiple issues.
I will see what happens after it completes and I try rebooting.
OK Malware found a bunch of PUPs cleared them.
Boot up still the same.
Can not open devices or security in options.
still no keyboard after login.

Cr00zng · 09 Jun 2019

At this point, as Try3 stated, your best option is to reinstall Windows, applications. You may not want to backup the data, treat this system as compromised. If she has some backup off-line, scan it prior to moving it to the reinstalled system.

There's just way too many issues to fix a possibly compromised system.

Try3 · 09 Jun 2019

Jazz1 said:

OK thanks for the replies.
Explorer.exe fired it up into safe mode.
Reg. key as you said it should be.
But USB Keyboard not working.
Running Malware bytes, it is slow and finding multiple issues.
I will see what happens after it completes and I try rebooting.
OK Malware found a bunch of PUPs cleared them.
Boot up still the same.
Can not open devices or security in options.
still no keyboard after login.

And I don't suppose you will forget to run the highly relevant Windows Defender Offline scan.

You are doing an awful lot of work for a quite ill-defined outcome.

Denis

Jazz1 · 09 Jun 2019

Can not do much with keyboard not working

- - - Updated - - -

After trying startup repair and system repair with no success I finally had to bite the bullet and do a reinstall.

Thanks for your help.