Black Screen of Death (KSOD) for Windows Vista

Here is something I ran into lately, it was one of those annoying black screen of death errors also known as a KSOD (presumably called such since BSOD was taken already).

The issue:
The computer only showed a black screen with a mouse cursor shown on the screen. This occurs in safe mode and other modes.

The troubleshooting:
Here are the things that I tried but they didn’t work for me in this case. If you haven’t tried one of these you may want to try it before trying out my solution:

  • Verified that the RpcSs service was started with NT Authority\NetworkService. This should be located at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs
  • Verified that the winlogon shell was set to explorer.exe
  • Backed up and replaced winlogon.exe with a known good suitable replacement.
  • Cleared the event log files (*.evt)
  • Backed up and restored hives from the RegBack directory.
  • Attempted to boot into Low Resolution Mode
  • Disabled Driver Signing Enforcement
  • Did an SFC /scannow
  • Tried waiting it out to see if something comes up

So what did I do to fix this?

The solution:
I copied the following to a blank notepad file and named it fix_perm.bat:

icacls Windows /t /c /grant "NT SERVICE\TrustedInstaller":(F)
icacls Windows /t /c /grant SYSTEM:(M)
icacls Windows /t /c /grant SYSTEM:(F)
icacls Windows /t /c /grant Administrators:(M)
icacls Windows /t /c /grant Administrators:(F)
icacls Windows /t /c /grant Users:(RX)
icacls Windows /t /c /grant Users:(GR,GE)
icacls Windows /t /c /grant "CREATOR OWNER":(F)

icacls "Program Files" /t /c /grant "NT SERVICE\TrustedInstaller":(F)
icacls "Program Files" /t /c /grant SYSTEM:(M)
icacls "Program Files" /t /c /grant SYSTEM:(F)
icacls "Program Files" /t /c /grant Administrators:(M)
icacls "Program Files" /t /c /grant Administrators:(F)
icacls "Program Files" /t /c /grant Users:(RX)
icacls "Program Files" /t /c /grant Users:(GR,GE)
icacls "Program Files" /t /c /grant "CREATOR OWNER":(F)

icacls "Program Files (x86)" /t /c /grant "NT SERVICE\TrustedInstaller":(F)
icacls "Program Files (x86)" /t /c /grant SYSTEM:(M)
icacls "Program Files (x86)" /t /c /grant SYSTEM:(F)
icacls "Program Files (x86)" /t /c /grant Administrators:(M)
icacls "Program Files (x86)" /t /c /grant Administrators:(F)
icacls "Program Files (x86)" /t /c /grant Users:(RX)
icacls "Program Files (x86)" /t /c /grant Users:(GR,GE)
icacls "Program Files (x86)" /t /c /grant "CREATOR OWNER":(F)

icacls Users /t /c /grant SYSTEM:(F)
icacls Users /t /c /grant Administrators:(F)
icacls Users /t /c /grant Users:(RX)
icacls Users /t /c /grant Users:(GR,GE)
icacls Users /t /c /grant Everyone:(RX)
icacls Users /t /c /grant Everyone:(GR,GE)

I then saved the file to a flashdrive and put it into the sick computer and booted it with a Windows Vista cd. When the cd booted up I entered the recovery console and located the drive letter associated the flashdrive (remember that drive letter we are going to need it). Then I located the drive associated with their Windows installation and entered that drive and executed the batch file on the flashdrive like so:
C:
F:\fix_perm.bat

You should of course replace the drive letters with the correct ones for your setup. After this runs you should be able to get into Windows proper.
Unfortunately, we are not done yet, in my case when the computer had a checkdisk ran on it, it reset the permissions itself and made the computer show a KSOD again. So after getting back into Windows run Tweaking.com – Windows Repair tool. Choose the reset file permissions and allow that to run. Once that is finished to be on the safe side I would run a checkdisk just to make sure that the computer will not revert again.

Leave a Reply

Your email address will not be published. Required fields are marked *