Get IT Done: Understanding the Windows 2000 Blue Screen of Death, part 1

Understand fatal system crash error messages in Windows 2000

Despite claims that Windows 2000 is the greatest operating system the world has ever seen, it isn’t infallible. Although Windows 2000 is a great operating system, the infamous Blue Screen of Death (BSOD) is alive and well. In this two-part series, I’ll discuss the Windows 2000 Blue Screen of Death in detail. In part one, I will discuss the anatomy of the Blue Screen and discuss techniques that you can use to get rid of it. In part two, I’ll discuss several specific error messages that you might find on a Blue Screen, and I’ll explain what those messages mean in plain and simple English.

What’s a Blue Screen of Death?
If you’ve been a long-time Windows NT user, you’ve probably seen the Blue Screen of Death a few times; but if you haven’t, or if you’re just getting into Windows, I'll take a moment to explain what the Blue Screen of Death is.

The BSOD refers to an error message that’s displayed on a blue screen. Such an error is serious enough that it brings down the entire operating system, leaving the user no choice but to cold boot. Although it probably sounds as if I made up the phrase “Blue Screen of Death,” I didn’t. It’s actually a Microsoft term, and you can often find references to it in Microsoft documents

Stop messages vs. Hardware messages
Regardless of what you call the BSOD, it’s something that you need to understand, because sooner or later you’ll probably have to deal with one. The Windows 2000 BSOD differs considerably from the Windows NT BSOD. One major difference is that the Windows NT BSOD contains only one general type of Stop message. A Stop message is the actual error code. In Windows 2000, there are two basic types of messages: Stop messages and Hardware messages.

A Stop message occurs when the Windows 2000 kernel detects a software error that it can’t recover from. A Hardware message, on the other hand, occurs when Windows 2000 detects a serious hardware conflict. For example, if you mismatch microprocessors in a dual-processor computer, you would see one of the hardware malfunction messages.

Anatomy of a BSOD
When a Stop error occurs, Windows crashes. All that’s left is a blue text screen displaying the error codes. You can see an example of a BSOD in Figure A.

Figure A
The various sections of the BSOD contain vital troubleshooting information.

As you can see, the BSOD is divided into several sections. Each one of these sections has its own purpose and contains vital troubleshooting information.

The bug check section
The bug check section is the portion of the BSOD that contains the actual error message. The bug check section looks similar to this code:
*** Stop: 0x0000001E (0xF24A447A, 0X00000001, 0X0000000)

*** Address F24A447A base at f24A0000, DateStamp 35825ef8d - wdmaud.sys

The main items that you need to be aware of within the bug check section are the error code and the error symbol. The error code is the hexadecimal number that immediately follows the word Stop. This number may be followed by up to four other numbers. The error symbol is the word that follows the error code. In the error that I’ve listed above, the error symbol is KMODE_EXCEPTION_NOT_HANDLED.

In some BSOD error messages, a memory location and a filename follow the error symbol. This information indicates the memory location and file with which the error occurred. Whether you see this information depends on what type of Stop error has occurred. In some cases, you may only see the first line of the Stop error. This usually indicates a problem with the video services.

The recommended user action section
The recommended user action section looks something like the message shown below:
If this is the first time you've seen this Stop error screen, restart your computer. If this screen appears again, follow these steps:
Check to be sure you have adequate disk space. If a driver is identified in the Stop message, disable the driver or check with the manufacturer for driver updates. Try changing video adapters.
Check with your hardware vendor for any BIOS updates. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.
Refer to your Getting Started manual for more information on troubleshooting Stop errors.

As you can see, the recommended user action section typically contains a generic message detailing steps that you might take to correct the problem. As you can see in the message, curing a BSOD might be as simple as rebooting or freeing up some disk space. Although such techniques occasionally work, getting rid of a BSOD is often much more complicated.

The debug port information section
The debug port information section contains information about how the kernel debugger is configured. The kernel debugger allows you to link a malfunctioning computer to one that is working correctly for diagnostic purposes. I’ll discuss debugging mode in detail in a future Daily Drill Down. However, it's important that you at least know what the kernel debugger is and see an example of what to expect. You can see an example of the kernel debugger information below:
Kernel Debugger Using: COM2 (Port 0x2f8, Baud Rate 19200)
Beginning dump of physical memory
Physical memory dump complete. Contact your system administrator or technical support group.

The four types of Stop messages
A Stop error occurs when a program or driver produces an unhandled error or tries to execute an illegal instruction. Stop messages are usually one of four basic types:
  • Stop messages that occur during regular use of Windows 2000
  • Stop messages that occur during Windows 2000 installation
  • Stop messages that occur during phase 4 of Windows 2000 installation
  • Stop messages that can be traced to a software trap

General Stop messages
General Stop messages are often the most difficult to correct because there are a countless variety of things that can cause them. General Stop messages occur when a program or driver produces an unhandled error or tries to execute an illegal instruction. Later in this Daily Drill Down, I will outline several procedures that you can use to troubleshoot such errors.

Installation Stop messages
When you encounter a Stop message during Windows 2000 installation, it’s almost always because a hardware component in your system isn’t on the Windows 2000 hardware compatibility list. If this occurs, review your system’s hardware to determine which item isn’t on the list.

If you find an unsupported device, try contacting the device’s manufacturer to see if they offer a Windows 2000 driver. If they don't, try removing the device from your system and replacing it with a hardware-compatibility, list-compliant device.

If all of your hardware is compliant, you may have a hardware conflict between two devices. To get around such a problem, remove any non-essential hardware and try loading Windows 2000 again. Once Windows has loaded, add the devices back onto your system one at a time. Doing so often resolves conflicts and, at the very least, will tell you where the conflict is.

Executive installation Stop messages
A Stop message during the executive portion of the Windows 2000 installation program can be difficult to track down. The executive installation routine has two phases. The first phase disables hardware interrupts and loads a few basic components such as the hardware abstraction layer. The second phase initializes all of the hardware in your system.

If you receive a Stop message during this portion of the installation program, run diagnostic programs against your hardware to see if it’s working correctly. If it is, turn the PC off and try reinstalling Windows 2000 from scratch. If you still receive the error message, contact Microsoft’s Technical Support department.

Software trap Stop messages
Software trap Stop messages occur when a program tries to execute an invalid instruction. For example, if a program tries to write characters to a variable that’s reserved for numbers, such an error may occur. If you receive this type of error, write down the information found on the BSOD and contact the manufacturer of the software that’s causing the problem to see if they have a newer version of the software or a patch that will correct the problem.

Troubleshooting tips
If a Stop error is persistent, there are a few things that you can do to try to get rid of it. First, as with any other computer problem, try to remember if anything has changed recently on the system. If it has, then the change is probably the source of the problem. Try removing any new hardware or software to see if the problem goes away. If it does, check to see if that hardware or software was intended for Windows 2000.

Next, check the hardware in your system. Begin by running a hardware diagnostic program. You can download many such programs from the Internet. You might also reseat all of your memory and expansion cards (be sure to turn the power off first) and make sure that all of your computer’s internal and external cables are attached tightly. Sometimes cards and cables can vibrate loose, thus causing Stop messages.

If the Stop message occurs during or slightly after boot, you may have a problem with a service or a device driver. If you find this to be the case, try booting into safe mode. By doing so, you’ll load Windows with a minimal driver and service set. If Windows boots correctly in safe mode, your suspicions are correct. If the problem still occurs in safe mode, the problem is something more serious, such as faulty hardware. If your computer does boot in safe mode, check the event log for more information on what may be causing the error.

If the problem still occurs, check to make sure that your antivirus program was designed for Windows 2000 and is up-to-date. Some viruses can infect low-level system files and may cause BSOD errors as a result.

Finally, if you still can’t make the error go away, go into your computer’s CMOS setup and disable any BIOS options, such as caching or shadowing, and reboot. If the problem still occurs, reapply any service packs that might exist. (None exist at the time of this writing, but give Microsoft time.) If reapplying the current service pack doesn’t work, try reloading Windows.

Contrary to popular belief, the BSOD is alive and well in Windows 2000. In this Daily Drill Down, I’ve discussed the anatomy of a BSOD. I then went on to examine the various types of Stop messages contained within the BSOD. Finally, I discussed some general procedures for troubleshooting such error messages. In part two of this series, I’ll discuss several specific error messages that you may encounter and some ways of getting rid of them.

Brien M. Posey is an MCSE who works as a freelance technical writer and as a network engineer for the Department of Defense. If you’d like to contact Brien, send him an e-mail. (Because of the large volume of e-mail he receives, it's impossible for him to respond to every message. However, he does read them all.)

The authors and editors have taken care in preparation of the content contained herein, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for any damages. Always have a verified backup before making any changes.

Editor's Picks

Free Newsletters, In your Inbox