2/13/2013

BLACKROSE DIGITAL SERVICES MANAGEMENT (BDSM,LLC.)

BlueScreenofDeath: SurvivalGuide

EveryErrorExplained |Mr.CharlesWeber.

BlueScreenofDeathSurvivalGuide:EveryErrorExplained

BSoD101:ACrashCourse

ErrorName
TherearemanypartstoaBSOD,butthemostimportantisrightatthetop.Theactualnameoftheerroris presentedinallcapswithanunderscorebetweeneachword.Insomecasesthiswillbeallthatsneededtogetto therootoftheproblem(thankstothehandyguideyouareabouttoread).Mostofthetime,however,more informationwillberequired.

TroubleshootingAdvice
NearlyeveryBSODincludesaportionoftextwithsomebasictroubleshootingadvice,thefirstofwhich recommendsrestartingyourcomputer.Gee,thanksforthetipMicrosoft.Beforeyourestart,copytheexactall capserrorcodeandhexadecimalvaluesshownaboveandbelowthisportionofgenerictext.Thenextparagraph providessoundadvice,alertingtheusertochecktomakesuretheirhardwareisinstalledproperly,ortoundoany recentsoftwareorhardwareupgrades.

MemoryDump
EveryBSODisaccompaniedbyamemorydump.WhatthismeansiswhenWindowscrashes,itdumpswhateverit isholdinginsystemmemorytoafile,andsavesthefileonyourharddrivefordebuggingpurposes.Ifyoucontact Microsoftfortechnicalassistance,theyllwanttoknowthecontentsofthisfile.

StopCode
ThetechnicalinformationsectionportioncontainstheactualWindowsstopcode,inohsoeasytoread hexadecimalform.Despiteappearingunintelligibleatfirstglance,thiscombinationofnumbersandlettersis instrumentalindeterminingthecauseofthecrash.Payparticularattentiontothefirstsetofnumbersandletters. Itprecedestheotherfour,whichareenclosedinparenthesis.Ifaspecificdriverisassociatedwiththecrash,itwill belistedontheverynextline.

IRunVista,soI'mImmunetoBSODs,Right?
Unfortunately,no.Acommonmisconceptionisthatbluescreensdon'tevenexistinVista.Thegoodnewsis MicrosoftputalotofworkintohowVistahandlescriticalerrorsandotherglitchesthatinpreviousOSswould causeasystemcrash.Mostofthetime,ifaproblemoccurs,Vistawillattempttofixtheproblemwithoutany interruption.Forexample,ifyourvideocardcrashes,youmayseeamessagesaying"Displaydriverstopped respondingandhasrecovered."InXPandpreviousOSs,thisalmostalwayswouldhaveresultedinasystemcrash.

Insomecases,Vistawillbeunablerecoveronitsown,andtheresultisabluescreen.Bydefault,Vistawillreboot itselfafterbrieflyflashingthebluescreen.Ithappenssofastyoumightmissit,butonceWindowsreloads,you'll begreetedwithanerrormessagesimilartotheabove.Youcantryclickingthe'Checkforsolution'button,justas youcantryyourhandplayingthelotto.Neitheroneislikelytoresultinanything.

 Instead,scrolldownandtakenoteofthebluescreencodes.Armedwiththisinformation,youcanperformyour owndetectivework.Alternately,ifyou'dprefertoseetheactualbluescreenratherthanautomaticallyrebooting, rightclicktheMyComputericononyourdesktop,selectProperties,andclickonAdvancedSystemSettings.Inthe SystemPropertieswindowthatappears,selecttheAdvancedtab,clickSettingsunderStartupandRecovery,and unchecktheboxthatsays'AutomaticallyRestart.'ThesamestepsalsoapplytoXP.

Inanothernodtowardsstreamliningthetroubleshootingprocess,Vista'sProblemReportsandSolutionswizard cansaveyouoodlesoftimeinPCdetectivework,andmayevenalertyoutopotentialconflictsyouweren'teven awareexisted.YoucanfindthisappletbynameinyourControlPanel,orjusttypeProblemReportsandSolutions inVista'ssearchbox.Onceloaded,click'Checkfornewsolutions'inthelefthandcolumn.IfVistafindsany conflicts,itwilllisttheminthemainwindow,alongwithanypotentialresolutions.

IRQL_NOT_LESS_OR_EQUAL(0x0000000A)

Themostcommoncauseofthisconflictisimproperlyinstalleddriversforapieceofhardwareyourecently installed. First,disconnectthehardware,anduninstallthedriversforitcompletely.Ifthatfixesthebluescreen,youcan searchforupdateddriversorcontactthemanufacturer.Ifyouhaven'tinstalledanynewdriversrecently,you'll needtodosomemoredetectivework.Startbyexaminingthebluescreentoseeifitlistsaspecificdriver.Looking atthebluescreen,checkthetextattheverybottomofthescreen.You'llprobablyseeafilename.Thisisthe driverthatcausedtheproblem.If,forexample,thedriverinquestionisnamednv4_disp.dll(annVidiarelated file),andyou'verecentlyswitchedfromanNvidiavideocardtoanATIpart,thenit'sreasonabletoassumethat eithertheolddriverwasnotuninstalledcorrectly,orthenewdriversweren'tproperlyinstalled.

SwappingVideocards
Ifyou'venarrowedyoursearchofoffendingdriversdowntothoseassociatedwithyourvideocard,turnoffthe system,disconnectthepower,andremoveandreseatthevideocard.Next,gointotheBIOS(pressF2orDelete whenyourBIOSpromptsyoutodothis,orconsultyourusermanualormotherboardmanufacturer'swebsite)and checkthebusspeedforyourvideocard.WetypicallyrecommendleavingthePCIEfrequencysettoAutointhe BIOS,butifyou'veoverclockedyoursystem,itcaninadvertentlyknockthebusspeedbeyondastablespec,which cancausebluescreens.Ifthat'sthecase,manuallysetyourPCIEfrequencyto100MHz.

 You'remoreliketoexperiencethisIRQLerrorwhenswitchingformonevideocardbrandtoanother,asthedrivers willconflictwitheachother.Thesafewaytoswapvideocardsistocompletelyremoveallremnantsofyourold videocarddriversusingautilitycalledDriverCleaner,orthefreebiealternativeDriverSweeper.Tobeginthe process,openupyourControlPanel,selectAddorRemoveProgramsinXPorProgramsandFeaturesinVista, highlightthevideocarddrivers,andclickUninstall.Rebootthecomputer,holdingdowntheF8keytoentersafe mode.RuntheDriverCleanerutilitytoscrubawayanyremnantsofthepreviousdriversthatatypicaluninstall overlooks.Afteryoureboot,installtheappropriatedriversforyournewvideocard.

SomeSoundAdvice
Whentheerrorisrelatedtoanaudiodriver,takenoteoftheprogramthatwasrunningwhentheBSoDoccurred. Makesuretheoffendingapplication'ssoundoptionsareconfiguredcorrectlyit'sespeciallyimportantthatituses thecorrectaudiodeviceanddownloadanypatchesavailablethataddressknownissues.Youshouldupdateyour soundcard'sdriversaswell.

Ifyou'reusinganaddinsoundcard,verifythatthemotherboard'sonboardaudioisdisabledintheBIOS,sothe twoaudiodriversdon'tconflictwitheachother.

ChangeDoctors
Systemservicesknowntocausethiserrorincludevirusscannersandbackuputilities.We'vehadgoodlucksticking withthemajorplayers,suchasAVG,Norton,Kaspersky,AntiVir,andNod32forourantivirusscanning,andNorton GhostandAcronisTrueImageforbackupduties.Donotrunmorethanoneantivirusapplicationonyourcomputer atthesametime!

DATA_BUS_ERROR(0x0000002E)

ThisisoneoftheeasierBSoDstodiagnose,asfaultymemorysticksarealmostalwaystoblame.Ifyougetthis error,thinkforasecond:ArethoseDIMMsyoujustaddedcompatiblewithyourmotherboard?Yourmotherboard manufacturer'swebsitewillhavealistofspecificbrandsverifiedtoworkwithyourparticularboard,although theseareoftenincomplete.

Next,aretheyinstalledinthecorrectslots?Somemotherboardsaremorefinickythanotherswhenitcomesto properslotplacement,andthesituationiscompoundedwhendealingwithadualortrichannelboard.Most motherboardsthatrundualchannelrequirethatyouinstallmatchingsetsofRAMinthesamecolorslots,while others,suchassomeMSIboards,requirethatyouinstalltheminalternateslots.AndifyouhaveaCorei7setup, youmayneedtoinstallyourRAMstartingwiththeslotfarthestfromtheCPU.Whenindoubt,RTFM. Onceyou'veverifiedthatyourRAMisinstalledcorrectlyandiscompatiblewithyourmotherboard,checktomake surethey'rerunningwithinspec.It'spossibleyoumayhavesetyourmemory'slatencytimingstooaggressive,or maybethestickscan'thandlethefrequencyyou'retryingtorunthemat.YourBIOScouldalsomisreadtheSPD settings.Whateverthecase,lookupthecorrectparametersforyourRAMandtrymanuallysettingtheminthe BIOS.

 Iftheproblempersists,theproblemislikelyabadstick.Tofindoutwhichstickisbadyoucansimplyremoveone stick,thenrunyoursystemforawhiletoseeifthebluescreensstop.Thenswapthesticksandrunyourtestagain. Ifthemachinebluescreenswithonestick,butnottheother,you'vefoundyourculprit.Youcanalsoruna diagnosticprogramsuchasMemtest86+tohelpdeterminewhichstickisdefective.Ifyou'rerunningVista,youcan alsouseMicrosoft'sWindowsMemoryDiagnosticsTool.TypethenameoftheprograminVista'ssearchbox,and onceselected,itwillrunthenexttimeyoureboot.BecausemostRAMsoldtodayincludesalifetimewarranty,be suretocheckwithyourvendorbeforeyoutossoutabadstick.

NTFS_FILE_SYSTEM(0x00000024or0x00000023)or FAT_FILE_SYSTEM(0x00000024or0x00000023)
Whilemanybluescreenscanbetracedbacktoanewhardwareinstallorbadmemory,thisparticular errorscreamsincapitallettersthatsomethingisfishywithyourharddrive.Theerrorthatgetsdisplayed dependsonthefilesystemyourOSisusing.Inmostcases,thefilesystemwillbeNTFS.Withreallyold systems,theerrorwillreadFAT16.Ifyougetthiserror,besuretodoonethingimmediately,beforeyou evenbeingtocontemplateitscause:Backupyourimportantdata.

CalltheCableGuy

Theeasiestsolutionsareoftenthemostoverclocked,buttheycanalsobethemosteffective.Checkingyourhard drive'scableconnectionsfallsintothiscategory.SATAcablesarenotoriousforworkingthemselvesloose especiallywhenusersliketokickthecomputersstoredunderthedesk.IfusingaSATAdrive,makesureyouhave onlyonepowercableconnected,nottwo(manySATAharddrivesincludeaSATApowercableandalegacyfour pinconnector).WithaPATAdrive,removetheribboncableandlookforanybentorbrokenpins.Carefullylineup thecableandpushitsecurelyintoplace.Youmightalsohaveabadcable,soifyouhaveaspacecablelyingaround oneyouknowtobegoodswapitwiththeoneinyourPC.

CheckPlease!

Nowit'stimetocheckyourdriveforerrors.Todothis,we'llfirstrunadiagnosticscan.InXP,clickStart,thenRun, andtypecmd.InVista,simplytypecmdintheStartSearchbox,thenrightclickcmd.exeandselectRunas Administrator..Attheflashingcommandprompt,typechkdsk/f/randrebootthesystemifprompted.The/fand /rswitchesattempttofixfilesystemerrors,thenlookforanmarkanybadsectorsbeforeautomaticallyrebooting whenthescancompletes.

ChangeDrivers
Eventhoughwedon'treallythinkaboutharddrivesasneedingdrivers,thecontroller'sthey'reattachedtomost certainlydo.AbuggySATAcontrollerdrivercanwreakhavoconyourdata.Yourmotherboard'schipsetdrivers includespecificdriversfortheIDE/ATAcontrollerthattheharddrivesareconnectto,soyou'llneedtoinstallthe latestversionforyourmotherboard.Tofindyourchipsetdrivers,you'llneedtogotoyourmotherboard manufacturer'swebsiteandsearchthesupportsection,orheaddirectlytoyourchipsetmanufacturer'swebsite.

UNEXPECTED_KERNEL_MODE_TRAP(0x0000007F)
Ifyouseethisbluescreen,you'reprobablyoverclockingyourCPU,butthisisnotalwaysthecase.The7Ferroris knowntoattackindiscriminately,lashingoutatmorethanjustoverclockers.ThisparticularBSoDcanrearits headinresponsetobadRAM,afaultymotherboard,orcorruptedBIOS.

OverzealousOverclocking
Ifyou'veoverclocked,thefirstthingyoushoulddotoisolatetheproblem(oranyproblem,forthatmatter)isto revertyouroverclockedcomponentstotheirdefaultspeeds.Ifthebluescreengoesaway,thenyouroverclock wastooaggressive.ThebestwaytoensurethatyouroverclockisstableistostressthehelloutofyourPC.Todo this,manyenthusiaststurntothetorturetestnamedPrime95.Thisutilitystressedyourrig'sCPUandmemory subsystems.Ifanyerrorsarefound,it'sagoodindicationthatyoursystemisnotcompletelystable.

HotPotato!
ThisBSoDcouldalsobegeneratedbyanoverheatingPC,soit'sagoodpracticetomonitoryoursystemtempsona regularbasis.Thereareseveraltempmonitoringprogramsavailable,suchasCoreTemp,RealTemp,SpeedFan, andmanyothers.

Asfarastemperaturesgo,mostCPUscangetveryhotwithoutincurringanydamage.Temperaturesof75Cunder loadaren'tunheardofforhotrunningCPUs,thoughmostnewerchipsprobablywon'tgetashigh.Ingeneral,it'sa goodideatokeepyourCPUbelow70C,andbelow50Catidle.Thiswillvarybyprocessormake,model,andeven stepping(revisions)ofthesamechip. Ifaprocessorisrunninghot,examineyourcase'sairflowandseeifthereareanyobstructions.Checkyourfansfor dustbuildup,includingthetopoftheheatsinkthat'scoolingyourCPU.Ahighqualitycoolerwillalsobring temperaturesdown.AndyoushouldalwayshavesomesortofthermalpastebetweentheCPUandthecooler.

Finally,verifythatallfansarespinning.Ifthefanispluggedinandstillnotspinning,replacethedefectivefan immediately.

TheBIOSBeckons
IfyourBIOSiscorruptorhastroublewithanewcomponent,suchasnewlyreleasedprocessorcore,yourfirst orderofbusinessistoupdatetothelatestversion.BeforeupdatingtheBIOS,youshouldchangeitssettingsback todefault(thereisusuallya"resettodefault"settingintheBIOSthatmakesthisprocesseasy,oryoucansimply cleartheCMOSviathejumperonyourmotherboard).YoushouldneverattempttoupdateyourBIOSonasystem thatisoverclockedandunstable.AsuddenrebootinthemiddleoftheBIOSflashingprocesswilldestroyyour motherboard,turningitintoafancydoorstop.Andremember:Never,underanycircumstances,restartorshut downthesystemwhileyou'reflashingyourBIOS.YoucandownloadthelatestBIOSfromyourmotherboard manufacturer'swebsite.

Whenthereareseveraldifferentversionstochoosefrom,skiprighttothelatestreleaseratherthanupdating incrementally.SomemotherboardvendorsincludeutilitiesforupdatingtheBIOSfromwithinWindows.This makestheprocesseasyenoughforevennovicestoundertake,butforobviousreasons,werecommendavoiding thisroutewhenasystemispronetobluescreens.

MatingMemory
Mismatchedorbadmemorystickscanalsocausethisbluescreen.Toscratchthisoneoffofthetroubleshooting list,runasinglestickofRAMthatMemtest86hasverifiedtobeerrorfree.Ifthissolvestheproblem,replacethe badstick.Ifnot,moveontothenextstep.

CPUisKaput
Wedon'tseethisoften,butanotherknowncauseforthisparticularerrorisabadprocessor.Mostpeopledon't havethemeanstotesttheCPUinanothersystem,soyouroptionsheremaybelimited.Localcomputerrepair shopsaresometimeswillingtoruntheprocessorforanightortwoforanominalcost,butyoucanalsocontact AMDorIntelforareplacementifit'swithinthewarrantyperiod.

OtherNotableBSoDs

PAGE_FAULT_IN_NONPAGED_AREA
Faultyhardware,includingRAM(system,video,orL2cache).

INACCESSIBLE_BOOT_DEVICE
CausedbyimproperlyconfiguredjumpersonPATAharddrives,abootsectorvirus,orincorrectIDEcontroller drives,whichcanalsooccurwheninstallingthewrongchipsetdrivers.

VIDEO_DRIVER_INIT_FAILURE
Causedbyinstallingthewrongdriversforavideocardorrebootingbeforedriverinstallationcouldcomplete.

BAD_POOL_CALLER
Causedbyafaultyorincompatiblehardwaredriver,particularlywhenupgradingWindowsXPinsteadof performingacleaninstall.

PFN_LIST_CORRUPT
CausedbyfaultyRAM.

MACHINE_CHECK_EXCEPTION
AbadCPUoronethatistooaggressivelyoverclocked,oranunderpoweredorfaultypowersupply.

AnEndRunAroundtheBSoD
Readingbluescreensofdeathisfunandall,butthere'sanother,easierwaytodiscoverwhatyourPC'sproblemis: theEventViewer.WhenanerroroccursinWindows,theOSaddsanotetothesystem'slogfiles.Theselogsare accessiblethroughWindows'sEventViewer,andtheycontainalltheinformationweneedtoknowwhatailsour poorcomputer. InXP,gotheStartmenuandopentheControlPanel.ClickAdministrativeTools,andthendoubleclicktheEvent Viewericon.Alternately,selectRunfromtheStartmenuandtypeeventvwr.msc,whichwillbringyourightinto theEventViewer.InVista,justtypeEventViewerintheStartSearchbox.

 Onthelefthandpane,highlighttheapplicationorsystemicon(underWindowsLogsinVista).Ontherighthand pane,you'llseeuptothreedifferenteventslabeledInformation,Warning,andError.Thesearesortedbythetime inwhichtheyoccurred.Scrolltotheapproximatetimeofthelastsystemrestartanddoubleclicktheevents. ThisbringsupaPropertieswindowdetailinginformationthatshouldclueyouinonanyproblem.Forexample,if oneoftheeventscontainsabugcheckmessagewith0x0000002E,weknowthisisaDATA_BUS_ERROR,andis usuallyindicativeoffaultyRAM.Ontheotherhand,theremightbeseveraleventspointingtoaspecificdriver, suchasnv4_disp.dll.Thistellsusweshouldfocusonthevideocardandanyrecentchangesrelatedtothedisplay hardware. Armedwiththisinformation,we'rereadytobeginthetroubleshootingstepsoutlinedpreviously.Iftypingthe eventIDintoGoogleandMicrosoft'sKnowledgeBase(http://support.microsoft.com)doesn'thelp,headoverto www.eventid.net.Thissitecontainsarepositoryofcommentsanderrorsfromotherusers,aswellasthesteps theytooktoalleviatetheirproblems. Irecommendyoufamiliarizeyourselfwiththeeventviewer,evenifyoursystemishealthy.Rootingoutminor problemsbeforetheyprogresswillensureyourWindowsinstallkeepshummingalonguneventfully.