[Guide] Blue Screens of Death

To diagnose and repair the problem, we need to discover where the problem lies.
The first thing we need to do is record the STOP code, or error number.

1. The first place to get the information is from the Blue Screen itself. Write down all of the long numbers, the description that's in all Caps with underscores ( _ ) between the words, and any file names that may be mentioned

2.The next place to find the information is in the Event Viewer.

3.The last place to find the information is on your hard drive. Search your hard drive for files ending in .dmp and .mdmp. You're looking for the most recent file (or the one closest to the last BSOD that you experienced). Once you find it, we can perform an analysis of the memory dump, which I will explain in a later section.

4.Sometimes, when Error Reporting is enabled, the dump files will be stored temporarily on your system and are erased once the report is sent. To save this info, you'll have to copy the dump file before sending the report. To do this, just click on the "Details" link in the error report and you'll see some file locations listed. Choose the one that ends in .dmp or .mdmp, locate it in Windows Explorer, and copy it to your Desktop (you'll have to enable viewing of hidden files to do this). Here's an example of the Details:

If we suspect that the memory is the cause of our BSOD, head to http://www.memtest86.com, and follow the directions to download and burn the image. Run the program for at least 12 hours if you want a thorough test. It basically passes information to and from the memory repeatedly. Additionally, if you are a bit more tech savvy, you can open up your computer and remove one stick at a time from the motherboard. Try to reproduce the problem. If you still get a BSOD, replace the stick you removed, and remove another one. No more blue screens? Congratulations, you have found your sick stick and are one step closer to fixing the problem.

If we determine that a driver is to blame for the problems, we then need to determine WHICH driver is the guilty party. There are hundreds of drivers in your system. The easiest way, aside from analyzing the dump file, to find out which driver is to follow this simple troubleshooting model:

How long have the blue screens been happening?
Any new software (programs) or hardware (physical components) installed on the system?

Once you establish how long this has been happening, you have two options: Windows System Restore (rolls your computer back to a specific date), or Device Driver Rollback*. I recommend using System Restore if you don't have the slightest clue as to which driver is causing problems, but if you have pinpointed the faulty driver correctly, the Device Driver Rollback can be used.

*For further information on Windows System Restore or Device Driver Rollback, consult http://support.microsoft.com, and search for either of the aforementioned services.

Please note that though this process may appear long and daunting, it has been explained in such a way so that the steps will be easy to follow.

A memory dump is what happens when Windows crashes. The memory is dumped into the pagefile and saved for the next reboot. Once Windows reboots, it reclaims the memory dump data from the pagefile and saves it to a file, which usually ends with the .dmp extension. Analyzing these dump files can help to figure out what's causing your system to crash. While they don't offer a "sure" fix, they provide clues to the cause of a crash so that we can work on fixing them. In my experience most system crashes are caused by faulty/corrupted drivers, malware, or hardware failures (in that order). Following the steps below will help us determine what may be causing your computer to Blue Screen, or crash.

The first thing to do when your system crashes is to reboot. Doing so will create the memory dump file so it's able to be accessed. Windows may also ask permission to send the file for online analysis. I suggest that you always allow it to be sent. Most times you won't get anything back, but occasionally it will point out the problem and save you a lot of work trying to determine it on your own. Also, quite often the first crash is the only crash as Windows will fix the problem when it reboots, so there's no need to worry unless Windows crashes repeatedly.

The next thing to do is to ensure that you are free of malware. If malware is present on your computer, it may have corrupted your installation, and be the cause of your crashes. I suggest you perform one of the free online scans that can be found at the following links:

http://housecall.trendmicro.com
http://www.pandasecurity.com/homeusers/solutions/activescan/
http://www.kaspersky.com/virusscanner Scan Only - no removal
http://www.bitdefender.com/scan8/ie.html
http://support.f-secure.com/enu/home/ols.shtml
http://us.mcafee.com/root/mfs/default.asp
http://onlinescan.avast.com/
http://ca.com/us/securityadvisor/virusinfo/scan.aspx
http://www.eset.com/onlinescan/

ADVISORY: Some or any of the above listed scanners will pick up items listed as "in quarantine" from other anti-virus programs. Therefore review your results carefully:


Once you have completed an online scan, or two, please search your hard drive for files ending with the .dmp extension. There are several types of memory dumps that Windows may create. These are distinguished below:1. A complete memory dump or a kernel memory dump that are usually saved in the C:\Windows directory and named MEMORY.DMP.

2. A small memory dump, aka a minidump, which are usually saved in the C:\Windows\Minidump directory. These are named Miniwwxxyy-zz.dmp, where the ww is the number of the month, the xx is the number of the day, the yy is the number of the year, and the zz is the number of the crash dump that day. For example, a minidump with the name of Mini070108-03.dmp is the 3rd minidump generated on July 1, 2008.
On some systems the directories where the dump files are stored are protected by being Hidden and System files.

To show Hidden and System files in Windows Explorer, click on the Start button, then select All Programs, then select Accessories, and finally select Windows Explorer.1. Once opened, select the Tools menu and then select the File Options menu item. In Vista you may have to press and hold the Alt key to view this menu.

2. Then go to the View tab and check the box labeled Show Hidden Files and Folders and uncheck Hide Protected Operating System Files

3. You will now be at a dialog that asks you if you're sure you want to do this. Click on the Yes button to allow the change to take place.

4. Then click the OK buttons at the prompts to exit the dialog. You will now be able to view hidden and system directories.
Warning - These files are hidden for a reason and messing with some of them may cause problems with your system.


Once you've located the memory dump file(s), then you'll have to get a debugger to analyze them. The one that I'm familiar with is the free Microsoft Debugging Tools for Windows. Download the version, 32 or 64 bit, that's appropriate for the operating system that you'll be running the debugger on. The debugger can be found at the following link: http://msdn.microsoft.com/en-us/windows/hardware/gg463009.aspx

Once it's downloaded, double click on it to install it. Once it's installed, open the debugger by doing the following:1. Click on the Start Menu.

2. Click on the All Programs menu.

3. Select the Debugging Tools for Windows program folder.

4. Click on the WinDbg icon to start the program.
Once you've opened the program, click on the File menu item, then on Symbol File Path.


In the window that opens, insert the exact text on the next line in the Symbol File Path box. This is a critical step, and if done incorrectly you'll end up with symbol errors:

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

The easiest thing to do is copy the above bolded text and then paste it into the box. Once that is done, click on OK to exit the dialog. Next, click on File menu and then select the Save Workspace menu option. This will save the symbol path for future use.

NOTE: You MUST be connected to the internet in order to use the Symbol server listed above.

Next, click on the File menu and select the Open Crash Dump option. When the dialog box opens, click on the Browse button and browse to the location of the memory dump file and then double-click on it to load it into the Debugger. You may be prompted to save the workspace again, but just click on the No button. A window will now open and the dump file text will fill the debugging screen.

Here's an example of of an analysis report from a Minidump file. If this was a complete or kernel dump, it would be much larger.

+ Show Spoiler +

The next step is to click on the !analyze -v link that's highlighted in blue in the report above. This will generate more information, which would look something like this:

+ Show Spoiler +

Once this is done, we want to copy the text of the dump file analysis report. To do this, select the Edit menu item in the Debugging Tools window and then select Copy Window Text to Clipboard. Feel free to PM me with it and I'll have a look.