[Bern9]

Во вложении журнал ошибок за 27, когда ноут работал, первый сбой был в 10 часов. Более свежих записей нет.
Извините, не знаю как сохранить из winpe журнал событий
+ смарт

В auto runs всё драйвера Microsoft стоят как not verified

[NickM]

Извините, не знаю как сохранить из winpe журнал событий »

Скопировать из системной директории по пути:

Код:

C:\Windows\System32\winevt\Logs\

например, файлы "Application.evtx" и "System.evtx".

А, что если попробовать сделать так: разлочить встроенного пользователя "Администратор" и попробовать осуществить попытку входа из под оного?

Спасибо, что показали - СМАРТ идеален, хотя, признаться честно, всё же были другие предположения

[Bern9]

А, что если попробовать сделать так: разлочить встроенного пользователя "Администратор" и попробовать осуществить попытку входа из под оного? »

Разлочил, только проблема в том, что черный экран появляется перед выбором пользователей.

С 15.07 логи журнала прикрепил.

Спасибо, что показали - СМАРТ идеален, хотя, признаться честно, всё же были другие предположения

Вам спасибо, что помогаете

[NickM]

Bern9, Я бы обратил внимание на это событие:

Код:

Не удается найти описание для идентификатора события 0 из источника hcmon. Вызывающий данное событие компонент не установлен на этом локальном компьютере или поврежден. Установите или восстановите компонент на локальном компьютере.

Если событие возникло на другом компьютере, возможно, потребуется сохранить отображаемые сведения вместе с событием.

К событию были добавлены следующие сведения: 

\Device\hcmon
\Driver\usbfilter

Так понимаю, это от VMware (много ошибок по этому гипервизору);

Заражение системы исключено? »

Хех:

Код:

Служба "Advanced SystemCare Service 15" перешла в состояние Работает.

Я бы попробовал "лишние" службы поотключать в реестре.
Да, про теневые копии ещё никто не спрашивал - они имеются ли?

Код:

C:\Windows\LiveKernelReports\WATCHDOG\WD-20220725-0918.dmp

А вот этот дамп сможете прикрепить?
Там их больше одного должно быть, можете все крепить, может что путное подскажут.

[Bern9]

Дамп от 25.07

Скрытый текст

Microsoft (R) Windows Debugger Version 10.0.25136.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WD-20220725-0918.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 7601.24000.amd64fre.win7sp1_ldr.171231-1547
Machine Name:
Kernel base = 0xfffff800`0a05c000 PsLoadedModuleList = 0xfffff800`0a29ba90
Debug session time: Mon Jul 25 09:18:02.345 2022 (UTC + 3:00)
System Uptime: 0 days 3:40:30.750
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..............................................
Loading User Symbols
Mini Kernel Dump does not contain unloaded driver list
For analysis of this file, run !analyze -v
watchdog!WdDbgReportRecreate+0xa3:
fffff880`067eb577 488b4f28 mov rcx,qword ptr [rdi+28h] ds:002b:fffffa80`16fcb928=????????????????
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

VIDEO_TDR_TIMEOUT_DETECTED (117)
The display driver failed to respond in timely fashion.
(This code can never be used for a real BugCheck.)
Arguments:
Arg1: fffffa80184c94e0, Optional pointer to internal TDR recovery context (TDR_RECOVERY_CONTEXT).
Arg2: fffff88005773e8c, The pointer into responsible device driver module (e.g. owner tag).
Arg3: 0000000000000000, The secondary driver specific bucketing key.
Arg4: 0000000000000000, Optional internal context dependent data.

Debugging Details:
------------------

*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: dxgkrnl!_TDR_RECOVERY_CONTEXT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: dxgkrnl!_TDR_RECOVERY_CONTEXT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: dxgkrnl!_TDR_RECOVERY_CONTEXT ***
*** ***
*************************************************************************
Unable to load image atikmpag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmpag.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1858

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 9091

Key : Analysis.Init.CPU.mSec
Value: 968

Key : Analysis.Init.Elapsed.mSec
Value: 30940

Key : Analysis.Memory.CommitPeak.Mb
Value: 75

Key : Bugcheck.Code.DumpHeader
Value: 0x117

Key : Bugcheck.Code.Register
Value: 0x9ff7530

Key : WER.OS.Branch
Value: win7sp1_ldr

Key : WER.OS.Timestamp
Value: 2017-12-31T15:47:00Z

Key : WER.OS.Version
Value: 7.1.7601.24000


FILE_IN_CAB: WD-20220725-0918.dmp

BUGCHECK_CODE: 117

BUGCHECK_P1: fffffa80184c94e0

BUGCHECK_P2: fffff88005773e8c

BUGCHECK_P3: 0

BUGCHECK_P4: 0

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


VIDEO_TDR_CONTEXT: dt dxgkrnl!_TDR_RECOVERY_CONTEXT fffffa80184c94e0
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: dxgkrnl!_TDR_RECOVERY_CONTEXT ***
*** ***
*************************************************************************
Symbol dxgkrnl!_TDR_RECOVERY_CONTEXT not found.

PROCESS_NAME: System

STACK_TEXT:
fffff880`09ff74f0 fffff880`072e297f : fffffa80`184c94e0 fffff880`0732f353 fffffa80`184c94e0 fffff880`072b08ef : watchdog!WdDbgReportRecreate+0xa3
fffff880`09ff7a10 fffff880`072e3644 : fffff8a0`2254c440 fffff8a0`2254c440 00000000`00000080 fffffa80`184c94e0 : dxgkrnl!TdrUpdateDbgReport+0xcb
fffff880`09ff7a60 fffff880`072b77a7 : 00000000`00000001 fffffa80`1030e000 00000000`00000000 fffff880`000000f3 : dxgkrnl!TdrCollectDbgInfoStage2+0x220
fffff880`09ff7a90 fffff880`072e4197 : 00000000`00000000 ffffffff`fffe7960 fffffa80`184c94e0 00000000`0000000f : dxgkrnl!DXGADAPTER::Reset+0xef
fffff880`09ff7b40 fffff880`073b4091 : fffffa80`16d29490 00000000`00000080 00000000`00000000 fffffa80`102fe410 : dxgkrnl!TdrResetFromTimeout+0x23
fffff880`09ff7bc0 fffff800`0a3a4284 : fffffa80`0e232010 fffff880`009ec180 fffffa80`0d0859b0 fffff6fb`00000001 : dxgmms1!VidSchiWorkerThread+0x101
fffff880`09ff7c00 fffff800`0a108816 : fffff880`009ec180 fffffa80`0fb6cb50 fffff880`009f9140 00000000`00000000 : nt!PspSystemThreadStartup+0x140
fffff880`09ff7c40 00000000`00000000 : fffff880`09ff8000 fffff880`09ff2000 fffff880`0c990d70 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_NAME: atikmpag+fe8c

MODULE_NAME: atikmpag

IMAGE_NAME: atikmpag.sys

STACK_COMMAND: .cxr; .ecxr ; kb

FAILURE_BUCKET_ID: LKD_0x117_IMAGE_atikmpag.sys

OS_VERSION: 7.1.7601.24000

BUILDLAB_STR: win7sp1_ldr

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

FAILURE_ID_HASH: {b70bff8a-b806-614d-1edc-80dcce0daa4e}

Followup: MachineOwner
---------

Дамп от 19.07

Microsoft (R) Windows Debugger Version 10.0.25136.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\LiveKernelReports\WATCHDOG\WD-20220719-0820.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 7601.24000.amd64fre.win7sp1_ldr.171231-1547
Machine Name:
Kernel base = 0xfffff800`0a017000 PsLoadedModuleList = 0xfffff800`0a256a90
Debug session time: Tue Jul 19 08:20:34.789 2022 (UTC + 3:00)
System Uptime: 0 days 1:38:36.053
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..............................................
Loading User Symbols
Mini Kernel Dump does not contain unloaded driver list
For analysis of this file, run !analyze -v
watchdog!WdDbgReportRecreate+0xa3:
fffff880`0643d577 488b4f28 mov rcx,qword ptr [rdi+28h] ds:002b:fffffa80`176f5158=????????????????
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

VIDEO_TDR_TIMEOUT_DETECTED (117)
The display driver failed to respond in timely fashion.
(This code can never be used for a real BugCheck.)
Arguments:
Arg1: fffffa80146e7010, Optional pointer to internal TDR recovery context (TDR_RECOVERY_CONTEXT).
Arg2: fffff880070a2e8c, The pointer into responsible device driver module (e.g. owner tag).
Arg3: 0000000000000000, The secondary driver specific bucketing key.
Arg4: 0000000000000000, Optional internal context dependent data.

Debugging Details:
------------------

*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: dxgkrnl!_TDR_RECOVERY_CONTEXT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: dxgkrnl!_TDR_RECOVERY_CONTEXT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: dxgkrnl!_TDR_RECOVERY_CONTEXT ***
*** ***
*************************************************************************
Unable to load image atikmpag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmpag.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2156

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 4826

Key : Analysis.Init.CPU.mSec
Value: 827

Key : Analysis.Init.Elapsed.mSec
Value: 11906

Key : Analysis.Memory.CommitPeak.Mb
Value: 74

Key : Bugcheck.Code.DumpHeader
Value: 0x117

Key : Bugcheck.Code.Register
Value: 0x9fff530

Key : WER.OS.Branch
Value: win7sp1_ldr

Key : WER.OS.Timestamp
Value: 2017-12-31T15:47:00Z

Key : WER.OS.Version
Value: 7.1.7601.24000


FILE_IN_CAB: WD-20220719-0820.dmp

BUGCHECK_CODE: 117

BUGCHECK_P1: fffffa80146e7010

BUGCHECK_P2: fffff880070a2e8c

BUGCHECK_P3: 0

BUGCHECK_P4: 0

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


VIDEO_TDR_CONTEXT: dt dxgkrnl!_TDR_RECOVERY_CONTEXT fffffa80146e7010
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: dxgkrnl!_TDR_RECOVERY_CONTEXT ***
*** ***
*************************************************************************
Symbol dxgkrnl!_TDR_RECOVERY_CONTEXT not found.

PROCESS_NAME: System

STACK_TEXT:
fffff880`09fff4f0 fffff880`072ee97f : fffffa80`146e7010 fffff880`0733b353 fffffa80`146e7010 fffff880`072bc8ef : watchdog!WdDbgReportRecreate+0xa3
fffff880`09fffa10 fffff880`072ef644 : fffff8a0`20e6d750 fffff8a0`20e6d750 00000000`00000080 fffffa80`146e7010 : dxgkrnl!TdrUpdateDbgReport+0xcb
fffff880`09fffa60 fffff880`072c37a7 : 00000000`00000001 fffffa80`102cc000 00000000`00000000 fffff880`0000005f : dxgkrnl!TdrCollectDbgInfoStage2+0x220
fffff880`09fffa90 fffff880`072f0197 : 00000000`00000000 ffffffff`fffe7960 fffffa80`146e7010 00000000`0000000f : dxgkrnl!DXGADAPTER::Reset+0xef
fffff880`09fffb40 fffff880`073c0091 : fffffa80`17ceeb90 00000000`00000080 00000000`00000000 fffffa80`101de410 : dxgkrnl!TdrResetFromTimeout+0x23
fffff880`09fffbc0 fffff800`0a35f284 : 00000000`fffffc32 fffff800`0a200f80 fffffa80`0d0859b0 00000000`00000008 : dxgmms1!VidSchiWorkerThread+0x101
fffff880`09fffc00 fffff800`0a0c3816 : fffff800`0a200f80 fffffa80`0fb29b50 fffff800`0a210fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x140
fffff880`09fffc40 00000000`00000000 : fffff880`0a000000 fffff880`09ffa000 fffff880`0d155d70 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_NAME: atikmpag+fe8c

MODULE_NAME: atikmpag

IMAGE_NAME: atikmpag.sys

STACK_COMMAND: .cxr; .ecxr ; kb

FAILURE_BUCKET_ID: LKD_0x117_IMAGE_atikmpag.sys

OS_VERSION: 7.1.7601.24000

BUILDLAB_STR: win7sp1_ldr

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

FAILURE_ID_HASH: {b70bff8a-b806-614d-1edc-80dcce0daa4e}

Followup: MachineOwner
---------

[NickM]

VIDEO_TDR_TIMEOUT_DETECTED (117) »

Типа с видеодрайвером/ видяшкой что-то не то?

[Bern9]

Жалуется на видео\ или драйвер. Какие мои действия ? Физически отпаять видео чип от материнки?))

Bios на HP сильно урезанный, там особо не поиграешься

[NickM]

Какие мои действия?»

Прочитать личное сообщение

Физически отпаять видео чип от материнки?))»

Нет, незачем.
Возможно просто совпадение.
Я пока склоняюсь к тому, что компоненты "важного" софта побились, и которые блокируют загрузку.