Black Screen after login in Windows 7

[NoelDP]

That was obviously run in Safe Mode - the 0x8007043c error code makes that plain.

Can you still not get into Normal Mode?

Did you manage to change that registry value OK? Does Device manager show the SPLDR driver as flagged, still?

 

[ejardinado]

I followed what you instructed me to do. And the SPLDR is still flagged.

 

[ejardinado]

And I still can log on into Normal Mode.

 

[NoelDP]

OK - let's check the registry entry again, and see what it has to tell us now....

Please run the following commands, and post the results.

REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR /S

 

[ejardinado]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr
DisplayName REG_SZ Security Processor Loader Driver
ErrorControl REG_DWORD 0x3
Start REG_DWORD 0x0
Type REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr\Enum
0 REG_SZ Root\LEGACY_SPLDR\0000
Count REG_DWORD 0x1
NextInstance REG_DWORD 0x1
INITSTARTFAILED REG_DWORD 0x1


C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPL
DR /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR
NextInstance REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000
Service REG_SZ spldr
Legacy REG_DWORD 0x1
ConfigFlags REG_DWORD 0x400
Class REG_SZ LegacyDriver
ClassGUID REG_SZ {8ECC055D-047F-11D1-A537-0000F8753ED1}
DeviceDesc REG_SZ Security Processor Loader Driver
Capabilities REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000\Control


C:\Windows\system32>

 

[NoelDP]

That looks normal apart from the INITSTARTFAILED entry - which should have cleared itself.

Please run the following command and post the results

SC QUERYEX SPLDR

Please also open Event Viewer
In the left pane, navigate to the Windows Logs
right-click on Applications and select 'Save all events as...' save as Apps.evtx
repeat for the System logs - save as Sys.evtx
Compress both files, and attach to your reply.

 

[ejardinado]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>SC QUERYEX SPLDR

SERVICE_NAME: SPLDR
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED
WIN32_EXIT_CODE : 31 (0x1f)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>

 

[NoelDP]

The first error after the reboot relates to the Computer Browser service, which fails to start because of a dependency failure in the Server service.
Just before that, there's a flag that three boot services/drivers failed to start..
discache
spldr
Wanarpv6

so lets see if we can track it back that far...

open an Elevated Command Prompt, and run the following commands

SC QUERYEX BROWSER
SC QUERYEX LANMANSERVER
SC QUERYEX DISCACHE
SC QUERYEX WANARPV6
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DISCACHE /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WANARPV6 /S

Post the results, and I'll look at them tomorrow - time for bed

 

[ejardinado]

Good day!

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>SC QUERYEX BROWSER

SERVICE_NAME: BROWSER
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1068 (0x42c)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QUERYEX LANMANSERVER

SERVICE_NAME: LANMANSERVER
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1068 (0x42c)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QUERYEX DISCACHE

SERVICE_NAME: DISCACHE
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED
WIN32_EXIT_CODE : 31 (0x1f)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QUERYEX WANARPV6

SERVICE_NAME: WANARPV6
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED
WIN32_EXIT_CODE : 31 (0x1f)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DIS
CACHE /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DISCACHE
NextInstance REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DISCACHE\0000
Service REG_SZ discache
Legacy REG_DWORD 0x1
ConfigFlags REG_DWORD 0x20
Class REG_SZ LegacyDriver
ClassGUID REG_SZ {8ECC055D-047F-11D1-A537-0000F8753ED1}
DeviceDesc REG_SZ @%systemroot%\system32\drivers\discache.sys,-102
Capabilities REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DISCACHE\0000\Contr
ol


C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WAN
ARPV6 /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WANARPV6
NextInstance REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WANARPV6\0000
Service REG_SZ Wanarpv6
Legacy REG_DWORD 0x1
ConfigFlags REG_DWORD 0x400
Class REG_SZ LegacyDriver
ClassGUID REG_SZ {8ECC055D-047F-11D1-A537-0000F8753ED1}
DeviceDesc REG_SZ @%systemroot%\system32\rascfg.dll,-32012
Capabilities REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WANARPV6\0000\Contr
ol


C:\Windows\system32>

 

[NoelDP]

Both the LANMAN services failed to start due to dependency issues...
Let's run through them....
Run the following commands, and post the results


SC QUERYEX MUP
SC QUERYEX SRVNET
SC QUERYEX SRV
SC QUERYEX SAMSS
SC QUERYEX NSI
SC QUERYEX BOWSER
SC QUERYEX MRXSMB10
SC QUERYEX MRXSMB20

 

[ejardinado]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>SC QUERYEX MUP

SERVICE_NAME: MUP
TYPE : 2 FILE_SYSTEM_DRIVER
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QUERYEX SRVNET

SERVICE_NAME: SRVNET
TYPE : 2 FILE_SYSTEM_DRIVER
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1084 (0x43c)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QUERYEX SRV

SERVICE_NAME: SRV
TYPE : 2 FILE_SYSTEM_DRIVER
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1084 (0x43c)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QUERYEX SAMSS

SERVICE_NAME: SAMSS
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1084 (0x43c)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QUERYEX NSI

SERVICE_NAME: NSI
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 916
FLAGS :

C:\Windows\system32>SC QUERYEX BOWSER

SERVICE_NAME: BOWSER
TYPE : 2 FILE_SYSTEM_DRIVER
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QUERYEX MRXSMB10

SERVICE_NAME: MRXSMB10
TYPE : 2 FILE_SYSTEM_DRIVER
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QUERYEX MRXSMB20

SERVICE_NAME: MRXSMB20
TYPE : 2 FILE_SYSTEM_DRIVER
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>

 

[NoelDP]

I keep forgetting you're in Safe Mode!
All those results are normal -
I just rechecked my VM in Safe Mode, and discovered that the SPLDR driver doesn't load there, either! (I would have been prepared to lay money on it running)
So we're back to trying to troubleshoot a boot to normal mode...
Please open Event Viewer, and clear both the System event log, and the Application event log
Close all, and reboot to normal mode.
once it's got as far as it's going to, reboot back to Safe mode, and post the two new logs
That way we don't have too much else going amiss.

Once back in Safe Mode, try Clean boot into normal mode How to perform a clean boot to troubleshoot a problem in Windows 8, Windows 7, or Windows Vista
Does it get any further?
post the new logs again once you have a functioning system (either normal or Safe Mode)

 

[ejardinado]

Okay, here is the event log.

Ill do the Clean boot now.

 

[ejardinado]

I did a clean boot and nothing changed. Im still getting the black screen with the mouse cursor only.

Here are the two new logs.

 

[NoelDP]

There's only one serious error in the System log at boot -
Client Virtualization Handler service failed to start because the service sflist appears not to be installed.
please run the following commands and post the results.

SC QC CVHSVC
SC QC SFLIST
DIR C:\WINDOWS\CVHSVC*.* /S
DIR C:\WINDOWS\SFLIST*.* /S

 

[ejardinado]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>SC QC CVHSVC
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: CVHSVC
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\Program Files (x86)\Common Files\Microsoft Shar
ed\Virtualization Handler\CVHSVC.EXE"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Client Virtualization Handler
DEPENDENCIES : sftlist
SERVICE_START_NAME : LocalSystem

C:\Windows\system32>SC QC SFLIST
[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.


C:\Windows\system32>DIR C:\WINDOWS\CVHSVC*.* /S
Volume in drive C has no label.
Volume Serial Number is 248D-7CDE
File Not Found

C:\Windows\system32>
C:\Windows\system32>DIR C:\WINDOWS\SFLIST*.* /S
Volume in drive C has no label.
Volume Serial Number is 248D-7CDE

Directory of C:\WINDOWS\System32\migwiz

06/10/2009 04:05 PM 3,225,610 SFLISTLH.dat
06/10/2009 04:05 PM 2,119,152 SFLISTW7.dat
06/10/2009 04:05 PM 1,445,052 SFLISTXP.dat
3 File(s) 6,789,814 bytes

Directory of C:\WINDOWS\SysWOW64\migwiz

06/10/2009 04:44 PM 3,225,610 SFLISTLH.dat
06/10/2009 04:44 PM 2,119,152 SFLISTW7.dat
06/10/2009 04:44 PM 1,445,052 SFLISTXP.dat
3 File(s) 6,789,814 bytes

Directory of C:\WINDOWS\winsxs\amd64_microsoft-windows-migrationengine_31bf3856
ad364e35_6.1.7600.16385_none_b49cc959f4f1037b

06/10/2009 04:05 PM 3,225,610 SFLISTLH.dat
06/10/2009 04:05 PM 2,119,152 SFLISTW7.dat
06/10/2009 04:05 PM 1,445,052 SFLISTXP.dat
3 File(s) 6,789,814 bytes

Directory of C:\WINDOWS\winsxs\amd64_microsoft-windows-migrationengine_31bf3856
ad364e35_6.1.7601.17514_none_b6cddd21f1df8715

06/10/2009 04:05 PM 3,225,610 SFLISTLH.dat
06/10/2009 04:05 PM 2,119,152 SFLISTW7.dat
06/10/2009 04:05 PM 1,445,052 SFLISTXP.dat
3 File(s) 6,789,814 bytes

Directory of C:\WINDOWS\winsxs\x86_microsoft-windows-migrationengine_31bf3856ad
364e35_6.1.7600.16385_none_587e2dd63c939245

06/10/2009 04:44 PM 3,225,610 SFLISTLH.dat
06/10/2009 04:44 PM 2,119,152 SFLISTW7.dat
06/10/2009 04:44 PM 1,445,052 SFLISTXP.dat
3 File(s) 6,789,814 bytes

Directory of C:\WINDOWS\winsxs\x86_microsoft-windows-migrationengine_31bf3856ad
364e35_6.1.7601.17514_none_5aaf419e398215df

06/10/2009 04:44 PM 3,225,610 SFLISTLH.dat
06/10/2009 04:44 PM 2,119,152 SFLISTW7.dat
06/10/2009 04:44 PM 1,445,052 SFLISTXP.dat
3 File(s) 6,789,814 bytes

Total Files Listed:
18 File(s) 40,738,884 bytes
0 Dir(s) 199,213,715,456 bytes free

C:\Windows\system32>

 

[NoelDP]

Good - the probability is that we can remove the CVH service completely (it's probably a hangover from the Office install)

Please open an Elevated Command Prompt and run the following commands

REG EXPORT HKLM\SYSTEM\CurrentControlSet\Services\CVHSVC %userprofile%\desktop\cvhsvc.log
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\CVHSVC

That will create a backup of the entry on your desktop (just in case) and then delete the entry.

reboot to normal mode - and leave the system for at least 15 minutes before forcing another reboot.

once back in a functioning system, post the new Event logs again.

 

[ejardinado]

Done.

Normal mode is still black. Ill leave it there for at least 15 minutes. Then Ill reboot. Do I try to reboot in Normal mode first or just go to Safe mode?

 

[NoelDP]

A comment from one poster who had a similar problem.....
This turned out to be an application conflict. I had installed a program that allowed me to use my iPad as a second monitor. It was that program that was causing the problem. I removed the program and the problem was solved.

The error involved was

Log Name:      Application
Source:        Desktop Window Manager
Date:          27/03/2013 18:03:44
Event ID:      9009
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      iMichael
Description:
The Desktop Window Manager has exited with code (0x40010004)

 

[NoelDP]

Done.

Normal mode is still black. Ill leave it there for at least 15 minutes. Then Ill reboot. Do I try to reboot in Normal mode first or just go to Safe mode?

go to Safe mode - and check for auxiliary screens