Windows Server 2012 Black Screen

8,083

Check for this file "C:\Windows\SysWOW64\lsassw86s.exe" (or that folder or System32 for recently added file.
It was added on sunday on our server. https://www.virustotal.com/en/file/23c6139eef0be9f1c89d409aff9e06b9c9f8b25f742250b3d578a23771cff012/analysis/1507617932/.
I'm just going to wipe it... Also HP Blade, W2012R2.
There was also a service called "Windows Security Accounts Manager".

Share:
8,083

Related videos on Youtube

WordySK
Author by

WordySK

Updated on September 18, 2022

Comments

  • WordySK
    WordySK over 1 year

    So, i have a HP proliant server with windows server 2012 installed, all worked fine until last weekend power went off for couple of hours. it was on external power source, but it's battery wasn't strong enough to stay powered. Well since that windows server is not running as it should. It boots up perfectly until the stage when you should have a login screen. It's just black screen without anything. CTRL ALT DEL is not working. you can't do anything that will make something to appear, just black screen. However i think windows is running it's just not visible because you can see everything on network, you can ping and things like this. Second problem i have is that RDP is not working, you cant login to it by any other methods i know, like remote powershell or network regedit since non of that was configured to run. I tried to run Chkdsk and sfc through installation dvd but when i would like to see what are the partions used through "diskpart" there is nothing visible. Any ideas what to do?

    PS: i tried to find safe boot but it's not there. ALso I don't know specifications of server nor configured settings in it since it's not my job and i'm not the guy for that. (that guy was fired and he left no notes or anything)

    Sorry for my english.

    Edit1: i think RDP services or registry keys are damaged that's why it's not working and you can't login to it

    Edit2: startup repair does absolutely nothing

    Edit3: okay i found that at the same time as server was online, one user was logged through RDP with opened Outlook and firefox. So maybe it's not windows problem but could be some sort of a virus. I scanned network folders with malwarebytes and newest Eset smart security, but those were clear. so could it be that system files got corrupted because of malware?