Debugging My PC Which Hangs on a Black Display Prior to the Login Screen

S

Seymour Skinner

Member
Mar 30, 2025
9
Hi everyone,

I'd appreciate any help that can be provided on this issue I'm experiencing, as despite being very interested in learning about fixing a Windows 11 OS, it has got to a point where it has me stumped. As it states in the title, my PC gets stuck in the boot process just before the logon screen would be displayed and just presents a black image. This started happening after failing to boot onto a windows 10 OS (which I have successfully accessed in the past) installed on another SSD. Afterwards, attempting to boot onto the Windows 11 OS causes the symptoms described earlier.

To fix the problem I have attempted:
  • Booting into safe mode.
  • Troubleshooting my hardware.
    • Disconnecting all my external peripherals and the Windows 10 SSD.
    • Removing the GPU and using integrated graphics instead.
    • Removing one RAM stick at a time.
    • Running Memtest86 successfully.
    • Running the NVMe test in the BIOS
    • Running and passing the Sea Tools SSD test
    • Loading default BIOS settings.
  • Formatting and rebuilding the system partition.
  • Running Checkdisk sucessfully.
  • Running DISM Restorehealth successfully.
  • Running SFC Scannow successfully.

I have also created a small partition on the Windows 11 SSD, on which I have installed another copy of Windows 11 which boots successfully.

I am very interested in trying to work out what is causing my problem, so I ordered a USB debugging cable and am now up to debugging the kernel. I have never attempted this before, so I have been reading multiple guides online about doing so using windbg. However, I am now a bit stuck on actually diagnosing the problem. I have managed to break into the system at around the point where it appears to get stuck, but I can't tell what it is actually stuck on. I am able to list the processes and threads running at this time, but nothing appears to be obviously wrong. Setting subsequent breakpoints show different threads from different processes appearing to complete successfully and move onto the next. I guess this is where I need more knowledge on the Windows boot sequence, so hopefully you can help me out here.

Is there anything in particular that I should be looking out for, or setting a break point on to determine what should be happening that isn't? Or is there a command that I can run that might shed more light on the issue?

Unfortunately I don't think I'm able to run the Sysnative File Collection App, as I can't boot into the OS. However, I'm happy to provide any more information that might be required.

Thanks in advance for any assistance that you can provide!


  • System Manufacturer?
    • Self-built
  • Laptop or Desktop?
    • Desktop
  • OS? (Windows 11, 10, 8.1, 8, 7, Vista)
    • Windows 11
  • x86 (32bit) or x64 (64bit)?
    • x64
  • What was original installed OS on system?
    • Windows 11
  • Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)?
    • Full retail version
  • Age of system? (hardware)
    • 2 years
  • Age of OS installation?
    • 2 years
  • Have you re-installed the OS?
    • No
  • CPU
    • Ryzen 7800 X3D
  • RAM (brand, EXACT model, what slots are you using?)
    • G.Skill Trident Z5 Neo RGB, DDR5-6000 CL30-38-38-96, 2x16GB
    • Slots: DIMM_A2 and DIMM_B2
  • Video Card
    • EVGA RTX 3060
  • MotherBoard - (if NOT a laptop)
    • ASUS X670E-E
  • Power Supply - brand & wattage (if laptop, skip this one)
    • Corsir RM1000x 1000w
  • Is driver verifierenabled or disabled?
    • Not sure, I haven't run it.
  • What security software are you using? (Firewall, antivirus, antimalware, antispyware, and so forth)
    • Windows defender.
  • Are you using proxy, vpn, ipfilters or similar software?
    • No
  • Are you using Disk Image tools? (like daemon tools, alcohol 52% or 120%, virtual CloneDrive, roxio software)
    • No
  • Are you currently under/overclocking? Is there overclocking software installed on your system?
    • No
 
The memory is supported - and if this is a new issue, memory support is unlikely to be related. It could be that a memory stick is failing, but as you've tested each individually, it's less likely to be a faulty RAM stick.


@Seymour Skinner - has this issue always happened on this motherboard + AM5 ? AM5 chips are notorious for slow startup prior to login due to memory training - does the issue happen before or after the POST screen (and do you see the POST screen from the motherboard?)

Did anything in your configuration or hardware change prior to the issue happening? Is the machine totally unusable at present?

Some other things to try:
- Update motherboard BIOS - AM5 BIOS have had multiple updates to address startup issues - flashing a newer BIOS may help improve this.
- Disable Fast Startup - usually enabled by default, and also known for causing startup lag on occasion.
- Enable/Disable EXPO (probably disabled by default, but also consider enabling it if you haven't in the past)
 
Hi thanks for the replies,

Nah the issue is new and beyond the memory training phase of the boot. I see the POST screen and the issue occurs pretty much exactly when the Windows login screen would normally appear.
If it's useful to get an idea as to what point my system reaches, looking at windbg, the following processes appear to be running: System, Secure System, Registry, smss.exe, csrss.exe, wininit.exe, services.exe, LsaIso.exe, lsass.exe, winlogon.exe, svchost.exe, fontdrvhost.exe, upfc.exe, NVDisplay.Container.exe, amdfendrsr.exe, atiesrxx.exe, dbInstaller.exe, TrustedInstaller.exe, amd3dvcacheSvc.exe, ArmouryCrate.Service.exe, AsusUpdateCheck.exe, AsusROGLSLService.exe, armsvc.exe, Cobian.Reflector.VSCRequester.exe, AsSysCtrlService.exe, BluetoothMouseThemeNotificationService.exe, MigrationService.exe, gameinputsvc.exe, GameSDK.exe, NahimicService.exe, IntelAnalyticsService.exe, nvcontainer.exe, RemoteMouseService.exe, RtkAudUService64.exe, logi_lamparray_service.exe, LogiRegistryService.exe, ROGLiveService.exe, IntelProviderDataHelperService.exe, MpDefenderCoreService.exe, RemoteMouseCore.exe & FileOperator.exe.

There was no hardware change prior to the issue happening. I booted onto a second SSD containing a dormant copy of Win10 which has worked in the past, but this time appeared to be corrupted (black login screen with components missing, then after logging in just a black screen with movable mouse). Returning back to the Win11 SSD, Windows attempted a recovery operation and then the corruption seems to somehow have spread to it.

The original installs of Win11 and Win10 are unusable, but a subsequent installation of Win11 on a new partition of the original Win11 SSD works normally.

I forgot to mention that I have updated the BIOS since the issue occurred.

Fast startup has been disabled.

I haven't enabled EXPO, but I can try enabling it to see if it makes a difference.

Yeah, the motherboard has a clear CMOS button. I haven't tried it yet but I can.
 
Okay, interesting - so just to clarify - is this correct?

  • SSD1: Windows 10 - does not boot. (Does this hang in the same place, during startup before the login screen?). Not able to access Safe Mode.
  • SSD2 Partition 1: Windows 11 - does not boot - hangs before login screen. Not able to access Safe Mode.
  • SSD2 Partition 2: Windows 11 v2 - boots successfully.

Do both Win 10 and Win 11 installs have the same symptoms? Did both Win 10 and Win 11 issues happen at exactly the same time?

---------------------

Windows hanging at this stage is more likely to be a driver/core windows file corruption - you might be able to identify which driver/process via the debugging tool, but if your priority is to fix it then I'd probably try and do a repair installation using a USB drive (startup repair may resolve the corrupted files).

What concerns me is that the issue jumped from the Win 10 install to the Win 11 install - there aren't that many reasons for a corruption issue to jump across multiple installs...

  • Same faulty driver on both installs - if you had something that auto-updated and has the same driver for both (or breaks a Windows driver), it could theoretically have broken both installs at the same time, just via updating. This might not perfectly match what you're describing though.
  • Hardware fault - could still be a hardware issue, although the fact it's failing during Windows startup, and you have one partition that's fully working, makes it less likely.
  • Malware on the system - this would explain the jump between SSDs, and why both are seeing the same issue. Could be malware that corrupted both drives simultaneously when it was first run.

I'd also consider running some malware scans on the affected partitions, and seeing if it shows up anything. Running an offline tool may also help (USB av tool or something like MSFT Defender Offline)

@Maxstar and @PeterJ have more experience than me at dealing with corruption issues, and might have some insight as well.
 
Yep that's correct, Win10 and Win11 v1 do not boot and hang before the login screen, both with and without safe mode. Win11 v2 boots without issue.

Yes both the win10 and win11 installs have the same symptoms and the win11 issues started on the first boot after the issues were discovered with win10.



I've been trying to identify the problem for a little while now and my priority is still to try and fix it myself, as I'm finding this process very interesting.
Yeah, I'm thinking that it must be a driver or core file issue. Though at the moment I'm not skilled enough with the debugger to be able to identify which it is.

It was surprising to me as well that both installs went down at the same time. During the first win11 boot after the win10 failure, I do recall seeing a windows repair message at the bottom of the screen which indicated that files were being copied to one of my windows installs. I have a loose theory that after windows detected the boot problem with win10, the repair operation was conducted onto the win11 disk as this was the Windows I loaded after the restart..... or something like that.

  • I think it's unlikely that an auto updated driver caused the issue in the win10 installation because, as I haven't mentioned yet, that install of windows hasn't been connected to the internet in a couple of years now. Though, the last time that I booted into this Windows (a couple of weeks prior), I did use some of Window's internal disk cleanup tools to attempt to make some more space on the drive.
  • Yeah I'm still keeping my eye out for a hardware issue, but no obvious issue has arisen yet.
  • Hopefully it isn't malware. I have installed and run the Microsoft Safety Scanner tool, but it did not find any malware. I don't know how effective this tool actually is so I can try the tools you recommended.
 
Seymour Skinner said:
It was surprising to me as well that both installs went down at the same time.
Click to expand...

This is the bit that concerns me the most - there aren't that many reasons for two different installs to break at the same time, spread across multiple disks. Especially as these are different versions of Windows.

Seymour Skinner said:
I have a loose theory that after windows detected the boot problem with win10, the repair operation was conducted onto the win11 disk as this was the Windows I loaded after the restart..... or something like that.
Click to expand...

I don't know for sure, but I'd be surprised if Windows could corrupt across different disks, just from a repair operation. The different drives will also have different bootloader partitions, and which one is booted is controlled by the motherboard/BIOS. S

Someone here might have more info on how the repair environment loads, but Windows knows where it's installed during repair operations. If you saw a specific repair environment then maybe it's a different story.


If malware checks don't come up with anything, I'd probably just try running a repair install via USB and see if that resolves it.


The other thing I can suggest - if you have access to the filesystem from the working W11 install, grab the CBS logs and create a Windows Update thread:
niemiro

Thread 'Windows Update Forum Posting Instructions'

Welcome to Sysnative's Windows Update forum.

Here you may seek help and support for Windows Update errors, System File Checker (SFC) corruptions, DISM corruptions, Side by Side Configuration errors, System Service errors, and related errors, corruptions, and problems. These instructions apply to all of the above problems.

If you are, for whatever reason, not able to complete part of these instructions, please just create a new thread with a description of your problem and we will help you from there.

Important Information​

Warning: Please do not follow the...
  • Thanks
  • Love
 
The issue in the thread below seems to be very similar to this one, and after repairing the Components Store the issue persists.

D

Thread 'Windows 10 Pro cannot boot after converting MBR to GPT'

Guys,

Please help. I have dual boot system, Windows 11 and Windows 10 on separate SSD disks.

I recently changed my hardware and everything was fine, both Windows booted all right in MBR disks scenario and Legacy Boot. After I changed MBR to GPT and made changes in BIOS, CSM disabled and Secure Boot on, created EFI partitions on both disks with BCDEdit commands, I can boot Windows 11, it just disabled WinRe partition, which I enabled by CMD commands and putting GPT IDs to partition with recovery, but I could not boot Windows 10. It start booting, Windows logo, spinning circles and after...
 
Will said:
If malware checks don't come up with anything, I'd probably just try running a repair install via USB and see if that resolves it.
Click to expand...
Just to clarify, is the repair method that you are referring to the method that installs a fresh copy of windows onto the drive and moves the original installation into the windows.old folder?


Will said:
The other thing I can suggest - if you have access to the filesystem from the working W11 install, grab the CBS logs and create a Windows Update thread:
Click to expand...
I do have access to the file system of the broken win11 and have the CBS log. It shows that an update was conducted the day before the crash, though I was able to boot win11 on crash day successfully, it was only after shutting it down, loading win10 and then loading win11 again that it failed. Unless the time on the log isn't system time (Australia) but US time? Then the events listed in the log could have taken place just before the crash?


Maxstar said:
The issue in the thread below seems to be very similar to this one, and after repairing the Components Store the issue persists.
Click to expand...
Yes this person's issue does feel very familiar! I'll be following it closely to see if you can find a solution. It seems like you are at a point where you are trying to get the sfc to run successfully. If it helps, I was able to get the scannow operation to complete successfully but it did not solve my problem.
Is there a way that I could determine the cause of my problem via kernel debugging?
 
Seymour Skinner said:
If it helps, I was able to get the scannow operation to complete successfully but it did not solve my problem.
Click to expand...
For now it's completely unclear to me what could be the core issue, however it seems it could be an issue with the SOFTWARE hive. So can you provide a copy of it in an private message?

This because the hive contains sensitive information. So please upload a copy of X:\Windows\System32\Config\SOFTWARE and sent me the download link in a private message.
 
Maxstar said:
So can you provide a copy of it in an private message?
Click to expand...

Yep I'm happy to send that to you but I appear to be unable to send anyone a private message. I saw a post where someone explained that to do this you need to hover the mouse over your profile and select private message, but I don't have that option. Can you send me a message that I can reply too?

Oh don't worry, I worked it out 3 seconds after posting this haha
 
Thanks for sharing the SOFTWARE hive and as expected it was corrupt, I've sent the repaired hive in a private messsage.

1 So please rename the current SOFTWARE hive to SOFTWARE.bad
2.Copy the 'repaired' SOFTWARE hive which I've sent to X:\Windows\System32\Config
3.Reboot the system and let us know the result.
 
I followed your instructions but unfortunately the problem still persists, my computer still can't boot to the login screen.

Could another registry hive be the problem?

Out of curiosity, how did you detect that my SOFTWARE hive was corrupted and then fix it?
 
Thanks for linking that thread, I went through and analysed all the hives in the config folder as well as the ntuser.dat hive using the Registry Explorer and SequenceNumberChecker tools.

I didn't find any issues with the Components, ELAM, SAM and NTUSER.DAT hives, but the DEFAULT, DRIVER, SECURITY, SOFTWARE and SYSTEM hives all prompted the "Primary and secondary sequence numbers do not match" error. The DEFAULT hive also produced warnings: "Hbin header incorrect at absolute offset “0x1DE000”!!! Percent done: “82.99%”" and "Extra, non-zero data found beyond hive length! Check for erroneous data starting at “0x1DE000”!". The DRIVERS hive produced similar warnings but on top of them it also produced: "Hive length (“0x7B3000”) does not equal bytes read (“0x79A000”)!! Check the end of the hive for erroneous data"

I repaired the corrupted hives using the RegistryExplorer tool, copied them back into the config folder and booted into the effected OS, but the problem remained. I then tried repairing the hives using the SequenceNumberChecker tool, but this also did not fix my problem.

I did notice however, that when I analysed the repaired hives in the config folder after I had attempted to boot into their OS, the DEFAULT, SECURITY, SOFTWARE and SYSTEM (DRIVERS remained clean) had become corrupted again and produced the "Primary and secondary sequence numbers do not match" error. Is Windows corrupting the hives during the boot process?
 
Yes, I've seen that in the other thread too, it seems that every time the system cannot boot correctly and shut down normally, some hives became corrupted again! No I don't now what's happening and I'm not sure if the used memory (6000 MHz) is fully compatible with your motherbord which says it can only support 4800Mhz clock speeds? But don't pin me on that, my hardware knowledge is pretty rusty.
 
Yeah it's a doozy of a problem haha, I'll have a think and keep an eye on the other thread too. Are there any other areas worth exploring? I had another look inside the kernel but couldn't find any processes or threads behaving obviously unusually.

Yeah, I'm 99% sure that the RAM is compatible, it's rated up to 6000 MT/s and 3000 MHz whereas the motherboard appears to support up to 8000 MT/s and the CPU 5200 MHz. My motherboard appears on the RAM's official QVL and the CPU was used on three of the test platforms of the RAM's AMD EXPO™ Technology Memory Profile Self-Certification Report. Both my RAM and CPU are listed as compatible products when using the support tool on my motherboard's official web page. I'm also not running EXPO at the moment, so my RAM is currently only running at 4800 MT/s and 2400 MHz.
 
I've made a small amount of progress with the win10 disk, but I just need a bit of help running the /restorehealth command.

I've so far been focusing on the win11 disk, but I recently tried to repair the image of the win10 disk. I ran /restorehealth on it without specifying a source and it detected 10 CSI Payload Corruptions and fixed 2 of them. I then ran sfc scannow which fixed 3 files but failed to fix 7 others. I attempted to boot into the OS and it got a little further than last time. It loaded extremely slowly but over the course of an hour I was able to get to the win10 logon screen, login to a black screen, briefly see some adobe update screen, saw my screensaver appear, was able to activate the ctrl+alt+del display, selected task manager which took about 20min to load, a message about the page file configuration appeared, I was taken to the virtual memory options window and once task manager started I was able to see that the Windows Font Cache Service and Windows Error Reporting service were taking up a relatively high amount of system resources (2 of the corrupted files appeared to be related to these services). The system then sat like this for another couple of hours but didn't appear to make any more progress. I tried to logoff and enter the RE but it was responding too slowly so I just held the power button down.

I then tried to fix the remaining corrupted files by using as a DISM source, a Windows installer of the same Win10 version downloaded from UUP Dump, but after trying a few variations of the command it was unable to find the source files. When I previously restored the health of the win11 image, I had very little success using .wim files as sources and ended up resorting to installing the same version of win11 on a separate partition and then using it as a source. Surely there's a better way than that, so I was wondering if you could tell me what I'm doing wrong?


A summary of the file corruption repair process is below.

Windows 10 version: 10.0.19045.2965

The command syntax I used to repair the image.
  • dism /image:f:\ /Cleanup-Image /Restorehealth /source:wim:g:\sources\install.wim:1 (I then tried: dism /image:f:\ /Cleanup-Image /Restorehealth /source:g:\sources\install.wim /limitaccess)

  • f:\ is the win10 image.
  • g:\ was the drive letter given to the installer after double clicking on its ISO file. The wim file details are below.
    • Only one index, Index: 1 with the below details:
      • Index : 1
      • Name : Windows 10 Pro
      • Description : Windows 10 Pro
      • Size : 19,425,715,752 bytes
      • WIM Bootable : No
      • Architecture : x64
      • Hal : <undefined>
      • Version : 10.0.19045
      • ServicePack Build : 2965
      • ServicePack Level : 0
      • Edition : Professional
      • Installation : Client
      • ProductType : WinNT
      • ProductSuite : Terminal Server
      • System Root : WINDOWS
      • Directories : 32851
      • Files : 121637
      • Created : 31/03/2025 - 1:01:33 PM
      • Modified : 31/03/2025 - 1:08:41 PM
      • Languages :
        en-US (Default)

Files DISM was unable to repair:
  • amd64_microsoft-windows-errorreportingconsole_31bf3856ad364e35_10.0.19041.2546_none_cab0968ad830fc10\werconcpl.dll
  • amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1566_none_e2d33b2e4df989bf\Magnify.exe
  • amd64_microsoft-system-user-component_31bf3856ad364e35_10.0.19041.1741_none_d9c7f44bf0037320\UserMgrProxy.dll
  • amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.2193_none_f4b71718d84fd066\SettingSyncHost.exe
  • amd64_microsoft-windows-b..core-fonts-jpn-boot_31bf3856ad364e35_10.0.19041.1_none_3f0d37efc90f3433\meiryo_boot.ttf
  • amd64_microsoft-windows-clipboard-userservice_31bf3856ad364e35_10.0.19041.1503_none_6445ca7b1f9ae25e\CBDHSvc.dll
  • amd64_microsoft-windows-rasbase-rascustom_31bf3856ad364e35_10.0.19041.2193_none_6df16fe771dcec8c\rascustom.dll
  • x86_microsoft-windows-d..gement-winproviders_31bf3856ad364e35_10.0.19041.1741_none_cfbd5351a1e9dda0\f\OSProvider.dll
Files SFC was able to repair:
  • Wininit.exe
  • Bootmgr.exe.mui
  • mscormmc.dll
File SFC was unable to repair:
  • UserMgrProxy.dll
  • meiryo_boot.ttf
  • CBDHSvc.dll
  • Werconcpl.dll
  • Magnify.exe
  • Rascustom.dll
  • SettingSyncHost.exe

And also why not, the log files are attached too.
 

Attachments

Hi,

Attached the corrupt / missing files:

1. Unzip Files.zip to X:\Files
2. Replace X with the correct drive letters
3. Run the following command

Code: 
DISM /Image:X:\ /Cleanup-Image /restorehealth /Source:X:\Files\WinSxS\ /LimitAccess
 

Attachments

Has Sysnative Forums helped you? Please consider donating to help us support the site!


Write your reply...
Back
Top