1. When you are under black screen condition, if your mouse and keyboard are still usable, and you are lucky enough to have a dialog window (usually "My Document"), use this window to go
C:(or whatever drive that stores your operation system) -> "Windows" folder -> find an application called "explorer", double click and open it. Now you should be able to get your screen back to normal.
2. If you don't have a dialog window, press "Ctrl" + "Alt" + "Delete" together and transfer the screen back to the login page. Click "Task Manager" -> Click "Application" tab -> Click "New task" -> type in "explorer" and then press "Enter" key. Now you should get the desktop screen.
3. Press the Start button (the one with window icon, at the lower left corner), open the "Run" program (if you can't find it in the menu, type "run" in the search bar and search for it). Type "regedit" to open the registry editor.
4. Go to this root:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
Under this root, you should see a item named "Shell", if the data value of "Shell" is "C:\Windows\Explorer.exe C:\Windows\system32\tlntsvi.exe", here is the MALWARE!
The correct value should be "C:\Windows\Explorer.exe" only, whatever following this command is the bad guy that brings your computer to black screen of death.
5. Now MARK DOWN the NAME of the malware (in my case, mine is "tintsvi.exe"), because this malware is known to have different names. So far I've seen "tintsvi" and "pnkx".
Now delete whatever command that follows "C:\Windows\Explorer.exe". Close the registry editor.
Start "Search" program, type in the malware name (in my case, "tintsvi") and search the remains of the malware. You SHOULD find something in the "Windows" folder. I've found a "tintsvi8973.exe" application as well as a weird file called "Servx.exe" under "C:\Windows\System32" folder. Since "servx" and "tintsvi8973" were created at almost the same time, I believe it is a malware so I deleted both of them.
80 views
Usually answered in minutes!
×