Possible KSOD (blacK Screen Of Death) Solution for Windows Vista
A few days ago, my Windows Vista on my notebook started to have the KSOD (blacK Screen Of Death) syndrome. This syndrome is that after typing your username and password on the login screen, you are presented with a black screen and a mouse, nothing else. When searching on the internet for solutions I found out that quite a few people experienced the same issue with all kinds of different solutions. I tried some suggestions like System Restore, file system check, registry changes etc etc, but nothing was working for me.
When you are presented with a KSOD, you can try to press the left SHIFT button a few times to trigger the sticky keys feature of windows. This will popup a window that contains a link. You can then click this link and from there you are able to launch different applications. Of course, if you disabled sticky keys, you are out of luck…
After wasting almost a whole day on trying everything I could think of, I stumbled upon a blog where they said that it might be related to the eventlog. To test this, I wanted to disable the eventlog. Unfortunately you cannot disable the eventlog from a running Windows because some other services are relying on it. I booted into “safe mode with command prompt”, because normal safe mode would also give me the KSOD. I disabled the eventlog and rebooted the machine and to my surprise everything worked 
The next step was to delete all eventlog files from C:\Windows\System32\Winevt\logs, switch on the eventlog again, reboot and everything was again working
Rowedahelicon said,
Wrote on May 18, 2009 @ 12:01 am
I posted this on the logitec blog 2 months ago =D
But I’m glad it worked. Your welcome lol.
Andrew from NY said,
Wrote on May 18, 2009 @ 7:53 pm
Worked for me…
All operating modes gave me the KSOD. I had to:
1)Go to recovery mode(press f8 at startup)
2)Choose comand prompt from the list
3)Type in c:
4)Then type in Regedit
5)Clicked “File>Import”
6)Clicked to show “all files” at the bottom
7)Surfed to C:\Windows\System32\Winevt\logs
8)Deleted all event logs one bye one.
closed all windows, clicked on restart and was done. I am operating on a Dell Studio with Windows Vista.
Thanks Guys!
Trevor Easytech associate said,
Wrote on June 19, 2009 @ 2:10 pm
Rowedahelicon, i saw that post of yours several months ago and so far its worked on ever KSoD case ive had. In return ive been re-posting your original to spread the word about it. In general its reletivly simple but unless you know what your doing it can be confusing. When ever i get one in i try other methods besides the sticky keys solution (incase i get one where its turned off). Only other method i have is to boot into SLAX (lynux on a jump drive) and navigate your way to the log files in system 32 and delete them. If the bios doesn’t support usb booting you can also hook up the hard drive as a slave on a stable system and do the same. I understand that not everyone has access to this but it works none the less. Thank you for your original solution!
Marc Gregoire said,
Wrote on June 19, 2009 @ 7:20 pm
I’m glad it works for you
Note that I’m not taking credits for this solution. I just found it myself after searching the net a few hours, the link is in my post. Since it took me so long to find the solution I thought it would be nice to also post it on my blog to increase likelihood for others to find it
Paul Melidosian said,
Wrote on July 3, 2009 @ 5:05 pm
This did not work for me and i’m pulling my hair out! I followed the instructions and deleted all the log files but the back screen still apears. The sticky key while enabled on my computer it dose nothing but beep at me when activated.. oh, The “RPC running under LocalSystem” fix did not work as well.
Paul
Duncan said,
Wrote on July 6, 2009 @ 3:08 pm
Paul i feel your pain man i tried everything and nothing works if somebody got a other solution il be happy to hear it then mail me duncan.douma@quicknet.nl
Chayo T. said,
Wrote on August 19, 2009 @ 3:49 pm
Wow! It worked like a magic. Thanks for your great solution!
After I used Regedit to remove the log files, I restarted my notebook (Windows Vista) and it came back to life again.
M. Bakir said,
Wrote on September 16, 2009 @ 10:21 pm
here is a new solution for the Black screen of Death.
Using the ultimate boot disk tools, used explorer to access the registery directory at C:|windows\system32\config\ found two registery files “software” and “software_previous” I renamed the “software” file into “software_corrupt” and the “software_previous” to “software”.
Guess what! it worked.
if it worked for you join my network
http://www.linkedin.com/in/mbakir
Paula said,
Wrote on September 25, 2009 @ 7:30 am
When I turn on my laptop instead of seeing the screen
Where I type in my password, it’s a completly blank
Screen, no light, no cursor, it’s like the computer is off.
I’ve typed in my password without being able to see
And it logs me in, but the screen is still blank.
I know I’m logged in because it makes the little welcome sound.
Otherwise it’s completely blnk and I’ve tried every possible thing that
I’ve found online.
Please help.
Marc Gregoire said,
Wrote on September 25, 2009 @ 8:49 am
Do you see anything on your screen? Do you see the Windows boot logo? Do you see your BIOS messages?
If not, it might be your screen that is broken…
fred said,
Wrote on October 3, 2009 @ 12:44 am
THANKS to Marc for this blogthread!
Currently bashing a client’s notebook with VIsta KSOD bad bad
No combination of recovery disk or boot sequence “fixer” works,
can get command line in safemode, but have no rights to delete things.
Best I could do there was msconfig to lean up startup.
Have now booted the latest Mepis live disk and been able to delete any and every i choose,
now THAT’s FREEDOM, as in free software.
It’s rebooting now… hang on….
fred said,
Wrote on October 3, 2009 @ 12:47 am
no such luck, back to KSOD.
will now use the HP install image thing, and move on.
It was worth a try, but did not work for the HP pavilion dv6000 that got a bad update on top of tons of leechware.
Thanks anyway guys.
Next time!
fred flintstone
Hynes said,
Wrote on October 6, 2009 @ 10:43 am
Hi everybody, after trying so many options which i must say should have solved the ever so famous KSOD, i discovered hitting the enter key(softly) at a reasonably speed for a number of times cos the the windows(in my case windows 7) to load. wasn’t sure if it sorted the problem but after a restart it works fine!. you could try that! hope it helps!
Jazz said,
Wrote on November 3, 2009 @ 1:49 pm
I tryed al of this and i didnt see a link when i pressed shift 5 times.
And when u pressed enter hyens the login screen popped up or after the restart ?
Marc Gregoire said,
Wrote on November 3, 2009 @ 6:35 pm
The pressing SHIFT key 5 times is a feature called Sticky Keys in Windows. If you have disabled the Sticky Keys feature in Windows you cannot use this method. Unfortunately, I don’t know of another way.
Gus said,
Wrote on November 4, 2009 @ 3:22 pm
It worked guys!!!!!
the solution of M.Bakir saved me
M. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. BakirM. Bakir
Barue said,
Wrote on December 2, 2009 @ 2:21 am
Thanks Mark Gregoire after trying many solutions I stumbled across this and it actually worked! Kudos on re-blogging this I encourage anyone experiencing KSOD to try this fix.
Only difference I tried in my case is renaming Logs to Logs.old and creating new Logs folder.
UBCD4WIN also helps a good deal for any unfamiliar with command line.
michael ventura said,
Wrote on December 2, 2009 @ 5:30 pm
I fixed my black screen problem by realising that the bios boot section had moved my usb drive to the main boot drive. the only way to get around this is to disconnect all usb devices (leave keyboard attached) boot the comp 1 - 5 secs go into your bios make sure that the main boot device is the hard drive with windows on it, save and boot again and it should load windows (7) in my case, if not then boot and 1 - 5secs in press F8 and manually choose your hard drive to boot from, I realise that differnt motherboards have different keys to press, but they all should allow you to choose which hard drive to boot from manually. After you get into windows create a back up and then fix the comp with windows repair and it should successfully rewrite the boot commands again. I hope this helps.
G Skooks said,
Wrote on December 2, 2009 @ 8:10 pm
I don’t have the KSOD-problem, but if you accidently disabled SHIFT sticky key, then there might be one other way to explore your computer… Press control+alt+delete and enter task manager. Once you did this, click on the butten ‘New Task’ and typ in ‘C:\Windows\explorer.exe’. Now you can explorer your computer and edit everything they sad here, but, like I sad, I don’t have the problem and I don’t know if you have any acces to the task manager.
Skooks
Marc Gregoire said,
Wrote on December 3, 2009 @ 12:50 am
Unfortunately, pressing Ctrl+Alt+Del to get to the taskmanager didn’t work in my case. If I had disabled the SHIFT sticky keys, I don’t know what I would have done…
Ponyboy Lebowski said,
Wrote on December 3, 2009 @ 6:23 pm
None of the usual tricks worked for me. Here’s what worked for me (caveat that I’m glossing over steps here):
(1) Boot from your installation CD and choose Recovery Console.
(2) Use the “listsvc” command to list all services.
(3) I started with AVG antivirus, disabled about 6-8 services related to it using their names from the “listsvc” command and using the “disable XXXX-service-name” command for services, then rebooted to see what happened.
(4) Reboot worked fine, no KSOD, so I uninstalled AVG, and then re-installed another antivirus.
In my case, it looks like the users had older AVG installations that were EOL’d (plus they’d just installed new versions over old versions over the years). Hope this is useful to someone else because when Safe Boot doesn’t work, well, you’re left with very few options. And I’m too much of a geek to just reinstall without learning what is really happening.
mike said,
Wrote on December 14, 2009 @ 10:10 pm
my issue turned out to be malware, it destryed my AV and my system when it was removed I needed to completely reinstall vista. Thank God I retained my files upon reinstall! I spent 12 hours 3 of which with a Mcafee tech trying to solve this problem I ended up having to reinstall from the OS disk. I feel bad for anyone else that has this issue!
Chris said,
Wrote on January 16, 2010 @ 2:37 am
I have to reboot my PC up to 6-7 times before Vista starts up. I can’t delete the files in :\Windows\System32\Winevt\logs. Every time I try that Vista tells me the action can’t be completed before the file is open in another program. Via cmd I can’t get access to \Winevt which is strange.
Marc Gregoire said,
Wrote on January 19, 2010 @ 9:45 am
You cannot delete those files as long as the event log service is running. So try to disable the event log service as described in this blog post.
Taimoc said,
Wrote on February 1, 2010 @ 12:16 am
How do you disable the event log?
Marc Gregoire said,
Wrote on February 1, 2010 @ 9:32 am
As mentioned in my post you cannot disable it from a normal running windows.
You need to do it from safe mode with command prompt.
The command line to disable it is:
net stop eventlog
valio said,
Wrote on February 6, 2010 @ 3:37 pm
m. bakir’s solution works. /thank you
ann said,
Wrote on February 7, 2010 @ 5:43 am
In my case…nothing seemed to work.
I couldn’t get to any version of SAFE MODE…
======
I found a couple or three blogs which mentioned three files.
c:\windows\EXPLORER.exe
c:\windows\system32\TASKMGR.exe
c:\windows\system32\WINLOGON.exe.
I did not have a VISTA CD available & found a VISTA recovery
program on the web. It gave me screens & allowed me to run
SYSTEM RESTORE & run a DOS prompt.
I found another computer running VISTA & made copies
of the three files above.
======
I ran the RECOVERY disk & went to a dos prompt.
I made a renamed the first file (something like explorer.old).
Then copied the version that I took from the working computer.
I noticed that the two files were not the same size.
When I rebooted the system, some things started to work but it was
still not working properly.
I ran the RECOVERY disk again & renamed the second & third files.
Then copied the files that I took from the working machine.
The third file was a different size.
TASKMGR.exe was the same size & when I ran a file compare
(FC firstfile secondfile), they were identical.
This time when I rebooted, the system came up.
Subsequently, the system was operating nominally.
In my opinion, I found two files that became corrupted.
In my case, I thought that this was the case because the computer
was experiencing power problems. The laptop’s battery was dead & the
AC supply had an extremely bad connection. So it was quite likely
that the computer was going on & off at random.