Solve Windows Blue Screen ProblemsTo begin with, as the stop error occurs you should note down all relevant information including error number and error code that is being displayed on the screen.
Settings within WinXP could be changed to prevent loss of useful information and data.
If you are using Windows XP, right click on My Computer > Properties > Select the 'Advanced' tab > and under 'Startup and Recovery,' click the 'Settings' button. This will open a new window, and under the 'System Failure' heading, uncheck 'Automatically restart.'
Now, power off your computer and attempt to restart it normally into Windows. If the error took place while booting Windows, you may find a troubleshooting menu and you will need to select 'Attempt to start Windows normally.' If your PC starts functioning properly, just store the error information for future reference.
If your PC is still erring and the stop message happens again, you are required to reboot the system and during this process, press F8 repeatedly when the POST (memory checking) screen comes up.
If your system does not start correctly or the stop message happens again, reboot the system. When the POST (memory checking) screen comes up, press F8 repeatedly. This will take you to the Windows advanced options menu where you should choose Safe Mode and the Windows will attempt to boot into safe mode. Safe mode will most likely load correctly if erring software or drivers are the culprit behind the stop error Blue Screen.
In case if your system is not able to load safe mode correctly or the Blue Screen problem persists, pressing F8, go to advanced options menu and go for ‘Restore Last Known Good Configuration’ option. This will enable the Windows XP’s built in system restore utility to restore the most recent save point at which any drivers or other software were loaded. Now, boot the system again and if it boots correctly, most likely the stop error is resolved.
Following are the sections on a BSoD
- The actual error message.
- The Microsoft® Windows NT® modules that are already loaded into memory.
- The modules that were about to be loaded had the error not occurred.
- The current status of the Kernel Debugger.
Figure 1.3 shows the actual error message which comprises of an error code number, a text code displaying the type of error and the addresses where the error took place.
Figure 1.3: An actual Blue Screen error message.
NTFS_FILE_SYSTEM
This error is largely caused by corrupt hard disk. To fix this problem you should run CHKDSK /F on all of your partitions if your PC is bootable. On the other hand try to install a new copy of Windows NT in a different directory if the PC is not bootable. With the help of this new copy, you can run the CHKDSK program. Now, you can edit your BOOT.INI file to make your computer start your original copy of Windows NT.
KMODE_EXCEPTION_NOT_HANDLED
KMODE_EXCEPTION_NOT_HANDLED usually occurs when device drivers are incorrectly configured. Errors codes on the Blue Screen will help you to figure out which driver is causing the BSoD.
REGISTRY_ERROR
REGISTRY_ERROR is caused when the system fails to read the registry from the hard disk or if the system’s registry is corrupt. If you encounter such an error, you should restore from backup.
INACCESSIBLE_BOOT_DEVICE
This error occurs when the Windows NT fails to read from the hard disk which may be caused by faulty device drivers or a bad small computer systems interface (SCSI) terminator. If the problem persists after examining these you can check for boot sector viruses.
KERNEL_DATA_INPAGE_ERROR
KERNEL_DATA_INPAGE_ERROR occurs when the Windows NT fails to read a page of kernel data from the page file. This can be a result of incorrectly terminated SCSI devices, a corrupt PAGEFILE.SYS, a bad processor or Bad memory. You can get rid of this problem by recreating the PAGEFILE.SYS file.
DIVIDE_BY_ZERO_ERROR
DIVIDE_BY_ZERO_ERROR error occurs when an application tries to divide by zero. You should check the memory dump if you are not sure as to which application caused it.
UNEXPECTED_KERNEL_MODE_TRAP
In most of the cases UNEXPECTED_KERNEL_MODE_TRAP error occurs because of faulty memory. If you encounter this error, ensure that all of your single inline memory modules (SIMMs) are the same type and speed. Also make sure that your computer's Complementary Metal Oxide Semiconductor (CMOS) is set for the correct amount of RAM. You may also replace the memory of the computer.
NMI_HARDWARE_FAILURE
NMI_HARDWARE_FAILURE errors could be caused by mixing parity and non-parity SIMMs, or by bad SIMMs but in this case hardware abstraction layer can't report on the true cause of the error. The possible option is to call the hardware vendor to get rid of the problem.
BAD_POOL_HEADER
BAD_POOL_HEADER error message may be displayed after you have made certain changes to your system. If this error occurs try undoing the recent changes.
IRQL_NOT_LESS_OR_EQUAL
Faulty device driver or an actual hardware conflict is largely the culprit for this error. You may remove your recently added hardware and similarly you should try to use ERD Commander Professional Edition, by Winternals Software if you have recently loaded a new device driver. This will temporarily disable the new driver and most likely you problem will be resolved.
Modules That Have Loaded
Figure 1.4 indicates the modules that have already been loaded into memory by Windows NT. Going through the modules, you can be sure that no listed module is causing the Blue Screen behavior.
Figure 1.4: Modules that have been loaded into the memory.
Modules That Were About to Load
Figure 1.5 shows the modules that were next to load when the error took place. This section may provide you with information as to which module is causing the error, particularly in case of KMODE_EXCEPTION_NOT_HANDLED one.
Disable the network card driver if you have ERD Commande Professional Edition by Winternals Software and boot your system again. As the system boots, you will be able to get rid of the driver problem.
Figure 1.5: Modules that were about to load.
Kernel Debugger
Figure 1.6 shows the current status of the kernel debugger which enables you to link two computers running Windows NT via a RAS connection or a null modem cable. The crash dump information is sent to the functional computer for diagnosis when the stop error occurs.
Figure 1.6: The status of the Kernel debugger.
Both systems must be running the same version of Windows NT, and have the symbol set installed in order to use the kernel debugger. The debugging software must also be installed. Setting up of kernel debugger is a complicated process but you can also resort to simpler ways.
Memory Dump
When the Blue Screen error is displayed, you can set Windows NT to create a memory dump file, if your system is bootable. For this, you should open the System Properties dialog box from Control Panel, go to the Startup/Shutdown tab and set the options shown in Figure 1.7. While doing so you should make sure that the partition where you store the memory dump file must have enough free space to accommodate your page file, physical RAM space and an additional space of one MB.
Figure 1.7: Options for creating a memory dump file.
When your memory dump file is created you should create a report of the crash by using the DUMPEXAM.EXE program in the \SUPPORT\DEBUG\I386 directory of your Windows NT CD-ROM, as shown in Figure 1.8.
Figure 1.8: A report of the crash.
You can also resort to ‘Restore Last Known Good Configuration’ option as discussed earlier which will cost you all your recent changes made by you but may restore the functioning of you PC.
BUG CHECK/ERROR CODE
Also known as Error Code, Kernel Error or stop error, a bug check occurs when the Windows operating system terminates suddenly.
In case of a critically corrupt driver, a bug check is sometimes made to occur deliberately with the help of KeBugCheck or KeBugCheckEx function as a last option to resolve the problem.
The system will write a log entry that will contain information regarding the bug check provided that it is enabled.
The system will break into the debugger if a kernel debugger is connected and active while the bug check takes place, thereby helping the investigation into the cause of the crash. A Blue Screen error, called a bug check screen or a blue screen, is displayed if no debugger is attached.
Only Windows NT kernel support bug checks while the Windows DDK and the WinDbg documentation both have reference information about most bug checks.
