Win7 Black screen of death with cursor on all boot modes

KSOD with cursor
I usually fix my computers (that I build) myself, but I'm appealing to the accumulated wisdom here because I'm at my wits end and trying to avoid reinstalling Windows from scratch and putting back software for a week... Needless to say I went through all the tutorials and how-tos on BSOD, KSOD, Windows won't boot and the like, especially on this forum.

My computer is running Windows 7 Ultimate x64.

Symptoms:
My computer wouldn't come out of hibernation (happens once in a while), so I forced it shut and restarted it. Since then it won't boot:

Boot in Normal mode: Black screen with cursor. Keyboard active (num, caps work), no mouse
CTRL-ALT-DEL or any other key combination = nothing

I'm able to go into the Windows boot menu by pressing F8, so:

Safe Mode: same, with bigger cursor
Safe Mode w/ Networking: same
Safe Mode w/ Command Prompt: same
Last Known Good Configuration: same
Low resolution boot: same
Leaving the black screen on for some time: nothing

What I attenpted so far (to avoid unnecessary responses and waste of time):

- Went to the "Repair options" screen (from windows boot menu):
- Startup Repair (numerous times): Disn't find any problems
- System Restore: Could not find restore point (which is false, as I have some automatic restore points)
- System Image Recover: Couldn't find image
- Windows Memory Diagnostics: no problems found

Then I went to the command prompt, and everything I tried from here on was from there:

- Chkdsk on the boot disk = no problems found. I could check that all my data (which sits on different disks anyway), is there and safe, so rescueing's not the issue.

- Windows Defender Offline: Ran that, no issues

- SFC Scan: Now this is interesting, because it will run with the usual options (/scannow /offwindir=c:\windows /offbootdir=c:\, it will report that it found corrupt files and successfully repaired them, but I think it does nothing at all.
The cbs.log file holds lots of stuff, but absolutely no sign of any relevant action - neither which files had an issue and were fixed, nor of the fix itself. I searched for the [SR] marker, and there are none to be found.

It's like SFC found problems, but could neither fix them nor tell me about it. I attached a copy of the CBS.LOG file, if its contents mean something to someone...

If anyone can help me with this, they would be my savior!!

Thanks to all

Please post exact sfc command you did. (I think it was correct btw). It took many minutes to complete? did it report "no integrity errors found" ?
It doesn't create a logfile because you ran it in recovery environment. To create a logfile:
after that run the SFC command. When it has finished you have a file C:\CBS.LOG

Hi Kaktussoft, initially I thought you hadnt read my post through, as not only does SFC create a log file, but I attached it to my first post! The file is created in X:\windows\logs\cbs, and is different each time I run SFC.

FYI, the exact SFC command sequence & response is:

But reading your post I changed the environment variable just in case, and guess what - I get a completely different CBS.log in C:\!

Unfortunately, I looked at it and it doesn't help me solve my problem - I get a million entries, and a certain number of them report something like:

"POQ 18957 starts:
0: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\863b0e2bc4f5ce01525a000010029402.$$.cdf-ms", Destination = [l:80{40}]"\??\C:\Windows\WinSxS\FileMaps\$$.cdf-ms"

Which doesn't make much sensefor me, but I attached the file (zipped) in case it makes some for you.
What I'm sure of is that SFC doesn't actually DO anything, since I get the same report (with different timestamps) each time I run it...

The SFC command DID fix some problems. Can you run it again and recreate and post a logfile?

What do you see when trying to boot to safe mode? Do you see all drivers scrolling over screen? It freezes at CLASSPNP.SYS?

YES absolutely! The safe mode file list stops dead at CLASSPNP.SYS, then I get the black screen.

At some point yesterday I asked for a boot logfile (ntbtlog.txt) for a normal boot, and there classpnp.sys loads normally in the middle of the log somewhere. The last entry is successful, it's srv.sys.

I appended the latest CBS.log, I did 2 reruns.

Thanks for spending time on my problem, I really appreciate it.

erpol said:

YES absolutely! The safe mode file list stops dead at CLASSPNP.SYS, then I get the black screen.

At some point yesterday I asked for a boot logfile (ntbtlog.txt) for a normal boot, and there classpnp.sys loads normally in the middle of the log somewhere. The last entry is successful, it's srv.sys.

I appended the latest CBS.log, I did 2 reruns.

Thanks for spending time on my problem, I really appreciate it.

Click to expand...

CLASSPNP.SYS isn't the culprit, it is just the last driver in the list... .same on this machine.

It looks like sfc command did fix the problems. But why do these problems reoccur???!!!

please run the sfc command again 2 times. Then set the environment variable to create a log file. Then run sfc command again. No reboot in between!! Post the log file created.

I know, it's totally incomprehensible for me as well. From the outside, everything seems to be perfect.

To be fair, it's not correct to say that Windows isn't booting - it does up to a point, then stops somewhere short of the login screen, with no clear reason, and not totally hung either.
And it's consistent over time, I booted perhaps a 100 times with always the same results, even changing the HD location etc. I also ran SFC a fair amount of times, with or without reboots in between.

One other thing that baffles me is why the "repair environment" doesn't find any restore points? I'm fairly sure that there are a number of them, even automatic ones when I update a driver and such (which I didn't do recently, to remove this question)... Isn't there any other way of accessing them?

One other thing I tried as well (scary but not so risky): I renamed the 5 registry files, then replaced them with their saved versions in C:\Windows\System32\config\RegBack. The backup was of 2 days prior to the problem. Same results! Put them back.

Now I did exactly as you suggest: I ran SFC twice, then set the environment variable, then ran it again. Didn't reboot, the log is in the zip file. Hope it helps, but I have the impression of performing a magic ritual here!

PS: I'd love to see the bright side of life right now! It's been 4 days and this is my main work rig...

To be fair, it's not correct to say that Windows isn't booting - it does up to a point, than stops somewhere short of the login screen, with no clear reason, and not totally hung either.

Click to expand...

Not totally hung??? Please explain.


Restore points are gone .... don't know why. SFC did fix many things, but next run the problems are still there.. very strange.

Did you run an offline virusscan already?

Did you install/uninstall something just before the problems started?

By "not totally hung", I mean that the keyboard reacts (caps lock, numlock), which is not the case if all is frozen... Now apart from that, I must admit that it's all but hung...

Yes, I did run the Microsoft offline virus scan on a bootable key. It found nothing.

And no, I installed nothing on the computer for the week before the crash.

One thing I noticed by looking at the directories on the disk, is that the "Internet explorer" folder is accessed at every pass of SFC - both in program files and program files (x86).

At this stage I would even try a paying 3rd party utility, if one existed that could help solve my problem...

One thing I noticed by looking at the directories on the disk, is that the "Internet explorer" folder is accessed at every pass of SFC - both in program files and program files (x86).

Click to expand...

How do you see that (except in cbs.log)?

Please download/burn a linux live CD (for example ubuntu) and boot from it. Can it display graphics? No problems at all?

So far it's not a virus, not a faulty program, not a faulty disk, not a faulty patch. What a strange problem!
Did you make a backup already? At least save the important stuff to external device.

Sorry for the late response, I was out for a day

Yes, it's a VERY strange problem.

I know the IE directories's content was modified because their timestamp is changed to the last SFC run, and also the contents of CBS.log

I don't think there's any need to make a Linux disk, I can boot the computer without any problem from a USB key with Win64 SP1 on it, and the graphics work fine.

But I did another crazy test:

(I moved back and forth the system disk as a secondary drive on another PC to do what is described below)

- Cloned the drive to another disk, to be safe
- Put it back in the original PC, then made a "clean" install of Windows on it (graphics worked fine, including hi-res). Of course, it creates a "windows.old" where it puts all the stuff from the previous install
- Copied all the registry files and all the user context from the win.old to the current windows
- Booted: directly to BSOD. Of course, I had forgotten the drivers!
- Copied system32\drivers and SysWOW64\drivers as well. Guess what? SAME PROBLEM as from the start. Exactly, no changes, black screen with cursor in all modes and all...

So this means that it's not an issue with corrupted system files, as they are all new from a clean install. And not a driver problem either, or it would work in safe mode. A mystery!!

I'm preparing to reinstall Windows from scratch, and all the programs too...

It still can be a driver problem! "safe mode" uses drivers as well. Best thing to do is indeed.... clean install

Yes, but as I understood it safe mode uses a fixed set of "generic" Windows drivers for the main HW. SO if it works once, it should work always? And if I knew where those drivers are located, I could change only those.

erpol said:

Yes, but as I understood it safe mode uses a fixed set of "generic" Windows drivers for the main HW. SO if it works once, it should work always? And if I knew where those drivers are located, I could change only those.

Click to expand...

I think you'll never know. Make backup... clean reinstall.... restore important documents. Try to forget this disaster

Just had this and MAN this was frustrating, LOL. Long time "computer nerd" here and I fixed this in about 3 hours of frustration, before it "hit me". The problem is a corrupt Windows environment boot up issue and therefore, it needs to be fixed in the registry. Without getting complicated in the details, I'm going to give you the instructions that I GUARANTEE will fix this... ready? Reboot your system and start hitting F8 and F12 repeatedly. When you get your Windows Safe Boot Screen, choose the top most command to Startup Repair your windows. Click enter on keyboard (usually defaults to US or whatever country you're in) and then for Login, hit enter the same (password if applicable). From inside here, click down to the bottom most option for Command Prompt. A window should open and should have Administrative Rights assigned to it. You will also notice the letter X:\ as the drive you are on. That's because you are in a virtual or rather, boot alternative to your true operating system. So, we need to get to your real copy of Windows. At the command prompt, type: C:\ and hit enter. You should see C:\ as such and you are on your C: drive. Type cd.. and hit enter. You are now on the root directory to see all of your folders from here. Type: dir /o/p and hit enter. This will now show a list of directories from your computer. They should look familiar to you and so, as this list scrolls by (hit the space bar to continue as the /p makes it pause so you can read them all), until you get to the bottom where the Windows directory is. If you see a <DIR> Windows, you are most likely on the correct drive. Now type the following: cd C:\Windows\System32\config and hit enter. From here you are going to want to type dir /o/p again. We are looking for the RegBack directory so type: cd Regback and hit enter. Type dir and you should see the following files in CAPS: DEFAULT SAM SECURITY SOFTWARE SYSTEM and with that, a date and file size next to each of them. If the dates listed next to them are within the past few days or weeks, this is where you want to be. Now for the fix! Type: xcopy cd C:\Windows\System32\config\RegBack C:\Windows\System32\config and you will get a prompt asking you (Y/N/A)? Hit A for All. It's the SYSTEM file we are really after to change, but, it doesn't hurt to change them all. You should now get a reply stating that all 5 files were copied. At this point, you can type: exit and hit enter and it will bring you out of the Command Prompt. Exit each screen and reboot your computer and you should be seeing your Windows 7/8/10 again, simple as before the problem started. Let me know how it goes... I just fixed this and am posting this reply everywhere that has it listed as a problem. Good luck! Johnathan