How to trace Blue Screens of Death

Introduction to Stop Errors

Stop errors in a nutshell are errors that are serious enough to cause Windows to stop. They are similar to the blue screen errors that were present on Windows 9x, however there is no option to try and resume the session in a Windows NT Stop Error (Windows 2000 and all XP members included).

On Windows XP, when a stop error occurs it can seem like the system is just rebooting its self. You might see a flash of blue just before the machine restarts itself. This is because Windows XP is set to automatically restart by default when a blue screen error occurs (see image below).

bsod settings

The first step to try and solve your problem is to make the error actually readable. Open your system properties, click the advanced tab and then the settings button under startup and recovery. Uncheck 'Automatically Restart' and OK all of the open windows. Next time a stop error is generated you should be able to see it now.

Stop errors can be caused by a wide variety of things such as faulty hardware, bad device drivers, overclocking/over heating issues or software trying to do things it shouldn't or is not allowed to under Windows NT.

When you see a blue screen message occurs Windows Enters a debug mode to help with troubleshooting and displays an error on the screen such as

Stop 0x0000001e (c000009a 80123f36 02000000 00000246)
Unhandled Kernel exception c000009a from 8123f26
Address 80123f36 has base at 80100000 - ntoskrnl.exe

It is important to note a few key bits of information, firstly if a system file is mentioned such as ntoskrnl.exe, secondly make a note of the eight digit hex number such as 0x0000001e and also the error text part of the error message such as IRQL_NOT_LESS_OR_EQUAL or DATA_BUS_ERROR. Next step is to look up these details on the Microsoft Online Knowledge Base.

For this example I will use Microsoft Knowledge Base Article - 149817

In this case the system file in question is Isotp.sys with
STOP: 0x0000000A (00000595 00000002 00000000 8010da41)
IRQL_NOT_LESS_OR_EQUAL

Noting the said information go to the online knowledge base, select your operating system from the drop down menu and then enter the details of your error in a condensed for, in this case I entered 'STOP: 0x0000000A Isotp.sys'. Once you have searched you will be presented with a list of known issues that contain any know issues for the details you have entered for the product you searched on. However not all errors are covered by Microsoft in their knowledge base, you can lookup the error text message at MVP Jim Eshelman's site http://www.aumha.org/kbestop.htm. Jim has amassed a long list of error text details and also additional information on getting to the cause of your blue screen error.

No comments: