me Banner
TECH
HARDWARE CISCO LINUX MICROSOFT C++ HTML JAVASCRIPT PERL SHELL SCRIPTING SQL NOTES
Windows NT/9x 'Blue Screen of Death'
[Windows XP]

Tips for Recovering from the 'Blue Screen of Death'

The STOP: 0x00000### error is the actual error
The message below it, usually_strung_together_with_underscores, is the translated error.
The rest of the business just tells what was running at the time, but the upper-left most driver or exe is usually the culprit or the victim. The rest of the info isn't too much use to Joe Average.

BSOD

Some common STOP messages and what to do about them: (These are directly from Microsoft, my comments are below these)

0x0000000A IRQL_NOT_LESS_OR_EQUAL  An attempt was made to access pageable memory at a process internal request level (IRQL) that was too high. A process can only access objects that have priorities (IRQL) of equal or lower priority than its own. This is usually caused by a device driver using improper addresses.

0x00000019 BAD_POOL_HEADER  Invalid Pool Header. There are many reasons that this would appear. Debugging the system would reveal the cause.

0x0000001E KMODE_EXCEPTION_NOT_HANDLED  This is a very common bug check. Usually the exception address (the second parameter) pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address.

0x00000024 NTFS_FILE_SYSTEM  All file system bug checks have encoded in their first ULONG the source file and the line within the source file that generated the bug check. The high 16-bits identifies the file, while the lower 16-bits identifies the source line in the file where the bug check occurred.

0x00000051 REGISTRY_ERROR  Something has gone terribly wrong with the Registry. It could indicate the Registry received an I/O error while attempting to read one of its files as a result of a hardware problem or file system corruption.

0x00000077 KERNEL_STACK_INPAGE_ERROR  The requested page of kernel data could not be read in. Caused by a bad block in paging file or disk controller error. If the error is a result of a paging error, upon system restart, AUTOCHK will attempt to map out the bad block. The second parameter identifies the cause of the error:

0xC000009A indicates a lack of non-paged pool resources.

0xC000009C and 0xC000016A both indicate a back block on the drive, while 0xC0000185 indicates improper termination of a SCSI device, bad SCSI cabling, or two devices attempting to use the same IRQ.

0x0000007A KERNEL_DATA_INPAGE_ ERROR  See 77, KERNEL_STACK_INPAGE_ERROR

0x0000007B INACCESSIBLE_BOOT_DEVICE  Unable to access boot device. Often, this indicates a disk controller configuration problem, or error in accessing the hard disk. Other possible causes include the following: during initialization of the I/O system, the driver for the boot device failed to initialize the boot device (device not available, SCSI error), or the file system could not recognize the data on the boot device. Also may indicate that a virus has infected the boot sector.

0x0000007F UNEXPECTED_KERNEL_MODE_TRAP  This means a trap occurred in privileged processor mode, and it is a trap the kernel is not allowed to have or catch. May indicate a computer RAM problem (mismatched SIMMs), a BIOS problem, or corrupted file system drivers. The first number in the bug check is the number of the trap. Consult an Intel x86 Family manual for the trap codes.

0x00000080 NMI_HARDWARE_FAILURE  A hardware error in which HAL reports what it can identify, and directs the user to call the hardware vendor.

 

My recommendations on what to do about these errors:

0x0000000A IRQL_NOT_LESS_OR_EQUAL  This error is usually caused by a bad device driver, or a 4.0 driver on a 3.51 box. Use the Last Known Good configuration if you can and get rid of this driver. Contact the vendor for an updated or correct driver. To help recover from errors like this, before adding any new drivers, make sure to run RDISK and at least update the info, the floppy is also nice to have.

0x00000019 BAD_POOL_HEADER  Not usually seen, if it is reproducable, retrace your steps and the last thing you did is probably the cause. Again, go for the Last Known Good.

0x0000001E KMODE_EXCEPTION_NOT_HANDLED  Outdated drivers, and hardware problems can cause this. If it isn't recently changed drivers, reseat the CPU(s), memory, cache, VRAM, BIOS, and any other chips that may have creeped out of their sockets. Sounds goofy, but it usually works.

0x00000024 NTFS_FILE_SYSTEM  Hope you can get back in enough to run CHKDSK /F! This will usually fix the system. But this error can keep you from getting back in. If you can't get back in, install a fresh version (Same version!) of NT to the same drive, in another directory. The setup CHKDSK will usually clean house and get things back to normal. After it's done, change the BOOT.INI to point to the original system and reboot. If all is well, delete the other version and clean out the BOOT.INI. (This is why the boot partitions are 400MB! ;-))

0x00000051 REGISTRY_ERROR  Try Last Known Good, or else you better pull out that backup.

0x00000077 KERNEL_STACK_INPAGE_ERROR  Bad L2 Cache, defective processor, defective SMP hardware, CPU needs to be reseated, cache needs reseating, Bad SIMM/DIMM. If 0xC000009A it's probably cache. If 0xC000009C and 0xC000016A you may have a failing hard drive. Try to get back in and run CHKDSK /F. If 0xC0000185 check the termination on the SCSI bus and check what controllers are using what IRQ's. Remember that SCSI busses are terminated at each "End".

Single drive Terminate controller and drive.
Internal drives only Terminate controller and only the last drive on the bus.
External drives only Terminate controller and only the last drive on the bus.
Internal and External drives Terminate last internal drive and last external drive. Do not terminate controller!

0x0000007A KERNEL_DATA_INPAGE_ ERROR  See 77, KERNEL_STACK_INPAGE_ERROR

0x0000007B INACCESSIBLE_BOOT_DEVICE   It can't find the boot partition. This can be caused by:

During Setup, did not find correct controller. Do physical check of controller and make sure that it is detected during setup, this may require a driver disk.
During Setup, detected wrong controller or not all controllers. Do physical check of controllers and make sure that they are all detected during setup, this may require a driver disk. Make certain that the controller that holds the boot drive is detected.
System reboots after normal activity, dies. Virus has infected boot sector. NT is fairly resistant in NTFS, but can still happen. Boot w/DOS floppy and run anti-virus software.
System reboots after normal activity, dies. Boot sector was corrupted from errant file activity. Use setup disks and select repair. Fix the boot sector when prompted.
After installing Win95 Boot sector was overwritten by 95. Use setup disks and select repair. Fix the boot sector when prompted. 95 will stay intact. Note that you cannot use VFAT32 with NT!
After using OS/2 Boot manager Incorrect partition marked active. Go back into boot manager and try again.

0x0000007F UNEXPECTED_KERNEL_MODE_TRAP  Make sure SIMMs and DIMMs are of same speed and type. Watch the leads on the memory, gold to tin connections can fail. Also check that the BIOS reports the correct amount of memory and processor(s) speed. A BIOS that is wrong can make NT die. Can also be caused by bad connections; reseat CPU/Cache/memory/VRAM/BIOS/etc.

0x00000080 NMI_HARDWARE_FAILURE  A NetWare server will also report this as an NMI Failure, and occasionally as a Lost Hardware Interrupt. This can be caused by using non-parity memory in a parity based system, mixing parity/non-parity memory, bad SIMMs, and L2 cache.