Revised Fix for Vista Black Screen of Death

December 30, 2008 – 3:11 pm

Here is the revised fix for the Vista Black Screen of Death thanks to Jamison West (whom has suffered more of these then he cares to admit).  Suspicion is that this recent outbreak of KSOD’s is cause by a Zenith SaaZ agent update but we have not nailed it down exactly.  Clearly Zenith SaaZ is directly involved in the cause base on sure statistics.  We will update you as we learn more.  Until then if you experience this issue please see Susan’s blog on enabling auditing/logging in Vista and report your finding to her blog or mine. 

Fix for Vista Black Screen of Death

1. On the affected machine, boot using the Vista Media and Select “Next” and then in the bottom left you will see “Repair your Computer”; select Next and then Select Command Prompt.

2. At the command prompt, launch regedit.exe and load the SYSTEM hive, following the below steps.


b. On the File menu, select Load Hive.

c. Browse to %WINDIR%\System32\Config Folder and select “SYSTEM”

d. Select Open.

e. In the Load Hive dialog box, type in “MySYSTEM” box for the registry hive that you want to edit.

3. After the hive is loaded, modify the following key: You will need to know what ControlSet the machine is currently running on, this can be determined by going to HKEY_LOCAL_MACHINE\MySYSTEM\Select and find the “Current” value in the Right hand side. (Example: Current value is 1 then the ControlSet will be ControlSet001)

Key: HKEY_LOCAL_MACHINE\MySYSTEM\ControlSet00X\Services\RpcSs (X is the Number from the Current Key from above)

Value Name: ObjectName

Old Value: LocalSystem

New Value: NT AUTHORITY\NetworkService

4. Unload the SYSTEM hive by selecting the key “MySYSTEM” and then select File -> Unload Hive… menu item.

5. Exit regedit.exe

6. Reboot the system normally

  1. 16 Responses to “Revised Fix for Vista Black Screen of Death”

  2. Thanks Mark and all who have contributed! We’ve performed this fix on two problem PCs today and it worked successfully. We also took the step to remove the Zenith agent from one of those PCs that has experienced this problem at least 10 times since it was installed last September. We’ll post back with any new information.

    By Jeff Dettloff on Jan 5, 2009

  3. Of the five systems at this location, the particular machine that was afflicted was the only one NOT running the SAAZ agent ! ?
    Value is already at NetworkService as well.
    Since we have a large Zenith base I will keep this in mind though. Thanks for the work.

    By Bill on Jan 6, 2009

  4. Very grateful to see your fix. But it didn’t work for us: the Object key was already correct.
    Instead I tried disabling the RpcSs services; after which the KSOD cycled automatically, rebooting in between; that felt like a kind of progress!

    The problem appeared for us on a Dell laptop with a dead battery (a replacement is in transit). We had just completed a full fresh install under Vista 64. At the conclusion of a normal boot, the user knocked out the power cable. The machine died, and every reboot since has been a KBOD.

    Using the ntbtlog.txt I consistently found that a McAfee service to be the last to appear. After disabling all the obvious McAfee services, the srv service, then tcpipreg… then other netweorking components, took its place (naturtally enough, I suppose, if McAfee had been the culprit, since a large number of dependencies would have been disrupted by my simply disabling the McAfee services).
    McAfee had been updated not long before the fatal boot. No conclusion found: new install required, this time with more intermediate images.

    By Tim Baigent on Jan 9, 2009

  5. Thanks Mark; though my PC issue could not be resolved through these steps but it was a nice try. The value was already set as “NT AUTHORITY\NetworkService”

    By Chidi Okonkwo on Jan 9, 2009

  6. This happened on my HP Pavillion laptop..I tried System Recovery with no luck. HP support says it is some mysterious “hardware malfunction.” Driving me crazy!!!

    By Anna on Jan 20, 2009

  7. Thanks Mark, I to tried this fix today and my finding was that the value was already set to NT Authority\NetworkService. I’ll have to keep looking, I’ll post back if I find a fix.

    By Brian Williams on Jan 25, 2009

  8. I also have the KSOD, but this didn’t help, But using the sticky keys trick got me on the explorer temporarily, if anyone has any insight send me an email.

    By Rowedahelicon on Jan 26, 2009

  9. Has anyone else found another fix to this. I tried the above and my key was already set to NT Authority. HELP!!

    By STEPHANIE on Feb 14, 2009

  10. worked for me just tonight - thanks for posting.

    By clay harris on Feb 24, 2009

  11. I’m experiencing this too, on a Vista 32-bit installation. The registry key mentioned in this article already has the new value specified.

    This all started with a “Disk Read Error” which prevented the system from booting this weekend. A “repair” from the Vista disc got past that and now I have what I have learned tonight is affectionately dubbed KSOD.

    No progress past the black screen yet…

    By Omaha on Mar 3, 2009

  12. Do not understand what is meant by open with vista media

    By Aran on May 26, 2009

  13. Aran, You only have to get to “Repair Your Computer” it doesn’t have to be via Vista Media.
    Try holding down “Control+Shift+Escape” on boot. That should get you to Windows Boot Manager. From there press “F8″.

    By Thim on Jun 3, 2009

  14. I had a prob sim to this, ‘puter was installed,b/up disk me, bought full premium,re-installed, no prob.Did W/7,then got rid of, reinstall, Its OK….So far…-)
    Larry V

    By Larry V on Jun 22, 2009

  1. 3 Trackback(s)

  2. Jan 29, 2009: SBSC & MSP Buzz » Blog Archive » Using SPIT to Fix Vista KSOD
  3. Jun 17, 2009: Tracking Vista's elusive 'Black Screen of Death' -by Scott Fulton - Windows 7 Center Forums
  4. Aug 7, 2009: SBSC & MSP Buzz » Blog Archive » Cause and Solution for Vista Black Screen of Death (KSOD) KB Posted

Post a Comment