Windows 9x/ME
In Windows 9x/ME this error is less serious but more common. You can usually recover from the error by simply pressing [Ctrl] + [Alt] + [Del] and restarting the computer, or by switching off the PC and switching it back on. However, the error message will contain very little information that you can use in troubleshooting.
1. Problems causing the BSOD
The BSOD is the main way for virtual device drivers to report a problem. The error description will state that Windows faced a problem (exception) at a particular memory address (a portion of the RAM) in a certain file, usually with the prefix VxD (virtual device driver), or the file name may have the DLL extension. At the minimum, it indicates that there was a problem with that particular file. Typically, this may have been caused by some action of the user that Windows does not allow—like accessing a document from a floppy and then removing the floppy before closing document. In other cases it may indicate that there is a problem with a particular software or hardware. If the BSOD repeats with the same message, then there is potentially something seriously wrong, and you should investigate further.
2. The basic approach
Use the file name in the error message to give you a clue as to what is causing the problem. Search the hard disk for the filename and look at the folder in which the file is located to give you an idea of which software program or hardware uses this file. Also search the Internet for any information on this file. Once you have identified the software or hardware associated with the filename, uninstall or remove the software or hardware. Verify that the software or hardware, as the case may be, is compatible with your version of Windows. Get updates if applicable and reinstall it.
2.1 System Restore in Windows ME and Windows XP
In addition to the above, Windows ME/XP provides the extremely useful System Restore tool. System Restore takes daily snapshots of the system state—every 10 hours the system is on and every 24 hours of real-time. The snapshot contains all the information required to restore the system to that particular point in time. To restore the system to a previous point in time do the following:
i) Go to Start > Programs > Accessories > System Tools > System Restore.
ii) Choose “Restore my computer to an earlier time” and click Next.
iii) On the calendar on the left, choose the last day you remember that Windows operated without problems. On the right, choose the Restore Point description; if there are multiple restore points that day, choose the one you’re most certain about or choose the latest time. Click Next.
iv) Make sure you’ve closed all open files and running programs, and click OK.
v) The system will roll back to the settings of that restore point and you can continue working normally.
2.2 Windows 2000/XP
Error reporting in Windows 2000/XP is more robust, nevertheless, when you get a BSOD, it is just as mysterious at first glance. The “Windows Stop Message”, which is the official name for the BSOD, occurs when Windows encounters a problem from which it cannot recover. At this moment Windows stops and displays the error message shown on the screen. Additionally, the contents of the system memory are dumped to a file. This memory dump file can be analysed by competent support technicians to troubleshoot the problem in depth. All the stop errors are numbered according to the circumstances that caused the error. This is a big step up from Windows 9x/ME, where the stop errors were more generalised and hence were much more difficult to troubleshoot.
3. Problems causing the BSOD
The BSODs are generally associated with five problems faced by Windows:
i) Software or device drivers may have a problem
ii) A hardware device is malfunctioning, or was removed while Windows was running, or does not fully support Windows. On older machines, outdated BIOS information can also cause errors.
iii) Hardware or hard disk errors during installation of Windows.
iv) Corrupted startup files, hardware and driver software during Windows startup can also be the cause. This type of error will always require troubleshooting before Windows can start up normally.
v) Intermittent errors that appear randomly. These can be caused by an overheating processor, a defective memory system, a dying or dead hard disk, or faulty software and device drivers.
4. Possible solutions to the BSOD
When a BSOD occurs, the first step is to note down the Stop number, the ‘friendly name’ of the error and also the name of the file that is reported as the cause of the problem. The Stop number will be in hexadecimal format—something like this:
STOP : 0x0000000A (0xDB000000, 0x00000001, 0x00000002, 0xB04FB0DB)
The friendly name will be something like this: IRQL_NOT_LESS_OR_EQUAL
If the error comes up very briefly, before you can note it down, and the system restarts, you will need to change a setting to tell Windows not to automatically reboot. Right-click My Computer, select the Advanced tab, and click “Startup and Recovery”, in Windows 2000, clear the “Automatically Reboot” checkbox. In Windows XP, click Settings and clear the “Automatic Restart” checkbox. This, of course, assumes that Windows has rebooted normally and you are able to change the setting. If you are not able to boot normally, restart Windows and press [F8] repeatedly during the POST cycle. This will take you to the Advanced Options menu. Choose Safe Mode. Windows will attempt to load with a minimum set of drivers. If Windows is able to boot into Safe Mode, this most likely means that the problem is with a particular software, and is not hardware-related. If Windows is not able to boot into Safe Mode, restart the computer, bring up the Advanced Options screen (by pressing [F8] during POST) and select “Last Known Good Configuration”. Windows will then attempt to load the last settings where everything worked normally. If that doesn’t work, then it most likely means you have a serious hardware or critical startup system file error. If this error has occurred after any recent hardware additions, remove the hardware and try to boot again.
If you are able to boot into Safe Mode, first perform a virus and spyware scan using a tool such as Norton AntiVirus and Spybot S&D. Uninstall any recently added software, and remove or roll back any updated device drivers. (To roll back device drivers, go to the Properties page of the device in Device Manager, select the Driver tab, and click Roll Back Driver). In XP, you can perform one additional step—running System Restore, as explained above for Windows ME. Restart the computer normally and check if the problem recurs. If it is an intermittent problem, and occurs at random, you can note down the error number the next time it occurs, since you disabled Automatic Restart after a crash. Boot into Safe Mode and see if you get the same random error. If you do, then the problem is likely hardware-related. Resolve the issue by following the hardware troubleshooting steps explained below. If the error only occurs in normal mode, then it is likely a software problem.
Look in Device Manager and troubleshoot any hardware device conflicts as explained in the Troubleshooting Hardware Device Conflicts in Windows section. You can remove or disable the device, or roll back its driver to a previous version. If the BSOD is caused by a faulty program that crashes Windows at system startup, you can disable the software from starting up by using msconfig.exe. Type Start > Run, type in “msconfig” and press [Enter]. Select the Startup tab and disable any or all software you think may be the ones causing the problem. Better still, you could disable all the software in the list, enable them one at a time, and reboot the computer to identify the offending software.
If the BSOD is caused by faulty hardware, remove any recently added hardware—after switching off the PC, of course! If the BSOD still occurs, or there are no newly added hardware, test the RAM for errors by using a memory diagnostic program such as Windows Memory Diagnostic (http://oca.microsoft.com/en/windiag.asp). If the diagnostic reports errors, then you’ve found the culprit. Replace the defective RAM. If the BSOD is due to corrupt system startup files, you can repair Windows by performing a Repair Install. Boot the PC from the Windows installation CD, press [Enter] to set up Windows XP, press [F8] to accept the license agreement, and then press [R] to start the Repair Installation. Windows will reinstall all the system files and redetect all the hardware.
Note: You will have to visit the Windows Update site to reinstall any patches and Service Packs, since the repair installation will remove them.
If you are still getting BSODs, switch off the PC, open the cabinet and remove all but the essential hardware: the mouse, keyboard, hard disk, CD-ROM, display card and RAM, along with the PSU and processor of course! Now, first attempt booting into Safe Mode, and if that works, reboot normally. If you are successful, the problem is with one of the peripheral devices. Add all the peripherals back one by one till you get a BSOD again—the last added peripheral is the culprit. If you are getting BSODs during installation, then the problem could be with the RAM, hard disk, processor, or one of the peripherals. Test the RAM using a memory diagnostic tool as described above, check the hard disk for errors (most hard disk manufacturers provide software utilities that can diagnose errors), verify that the CPU is not overheating by following the instructions in the Motherboard section of this guide, and remove all peripherals and run the installation with the minimum configuration as described above. If the installation is successful, you can troubleshoot the rest of the hardware devices from within Windows.
5. Common Stop Message error codes and suggested resolutions
These are some of the most common Stop Messages along with their cause and suggested resolution:
Stop Code: STOP 0x0000000A
IRQL_NOT_LESS_EQUAL
Code Meaning : Faulty device drivers, or services from backup utilities or virus scanners
Recommended Resolution: Remove, disable or stop the offending drivers, backup utilities or anti-virus programs. Get updated software from the manufacturer.
Stop Code: STOP 0x0000001E
KMODE_EXCEPTION_NOT_HANDLED
Code Meaning: Some driver files may be causing a problem.
Recommended Resolution: Remove, disable or update the driverfile listed in the error message. Verify if new hardware installation is correct.
Stop Code: STOP 0x00000024
NTFS_FILE_SYSTEM
Code Meaning: Usually caused by disk corruption in the NTFS file system or third-party disk defragmenters.
Recommended Resolution: Use hard disk diagnostic software to verify that the hard disk is working. Remember to always Use Microsoft-certified disk defragmenters.
Stop Code: STOP 0x0000002E
DATA_BUS_ERROR
Code Meaning: Caused by a parity error in the system memory. Almost always caused by hardware problems—a configuration issue, defective hardware, or incompatible hardware.
Recommended Resolution: If physical RAM was recently added to the system, remove it and see if the error still occurs. If the error persists, try disabling memory caching in the BIOS. Else remove, repair or reinstall the defective hardware.
Stop Code: STOP 0x00000050
PAGE_FAULT_IN_NONPAGED_AREA
Code Meaning : Caused when requested data is not found in memory; the system checks the page file, but the missing data is identified as unable to be written to the page file.
Recommended Resolution: Remove any newly-added hardware or run diagnostic software supplied by the manufacturer to check if the component has failed. Install updated device drivers or roll back to a previous driver.
Stop Code: STOP 0x0000007B
INACCESSIBLE_BOOT_DEVICE
Code Meaning: Caused when Windows loses access to the system partition during the Startup process. This can be caused by: an incorrect driver for a SCSI, RAID, or UDMA IDE controller; incorrect ARC path in the Boot.ini; or a failed boot device.
Recommended Resolution: Verify that the disk storage device is installed correctly and working. Reinstall or update the device driver. Verify that the BIOS setting for the device is correct. Verify the integrity of the hard disk.
Stop Code: STOP 0x0000007F
UNEXPECTED_KERNEL_MODE_TRAP
Code Meaning: Caused when the CPU generates an error that the kernel does not catch. Usually hardware related—especially RAM. Can also be caused by CPU overclocking, or defective components on the motherboard.
Recommended Resolution:
1. Run the memory diagnostic to test RAM.
2. Restore overclocked settings to previous values.
3. Repair/replace the motherboard.
4. Disable sync negotiation in SCSI BIOS; check SCSI termination.
Stop Code: STOP 0x000000D1
DRIVER_IRQL_NOT_LESS_OR_EQUAL
Code Meaning: Occurs when the system attempts to access pageable memory at a process IRQL that is too high
Recommended Resolution: Very similar to STOP 0xA. Remove, disable or stop the offending drivers, backup utilities or anti-virus programs. Get updated software from the manufacturer.
Stop Code: STOP 0xC000021A
STATUS_SYSTEM_PROCESS_TERMINATED
Code Meaning: Caused when the user-mode subsystem (Winlogon or CSRSS) is fatally compromised and security cannot be guaranteed. The most common causes are third-party applications or mismatched system files.
Recommended Resolution:
1. Remove, disable, or roll back any newly-installed device driver.
2. Uninstall any newly-installed software.
3. Use Windows-compatible backup/restore programs.
4. Restore full control permissions to the local SECURITY account on the systemroot folder by doing a fresh parallel installation of Windows on a separate partition.