Microsoft

Extract troubleshooting info from Windows XP BSOD error messages

Windows expert Greg Shultz explains how to interpret the key information in common Windows XP BSOD error messages.

Originally published on July 22, 2008.

Microsoft Windows XP systems are notorious for crashing for any number of reasons and in a number of ways. Some of these crashes are mild and can easily be overcome simply by closing a nonresponding application or by rebooting the system. However, others are more serious and can bring the entire system to its knees. Microsoft calls these types of crashes "Stop errors" because the operating system stops responding. When a Stop error occurs, the GUI is replaced by a DOS-like blue screen with a cryptic error message followed by a code number. This screen is affectionately referred to as the Blue Screen of Death, or BSOD for short.

I'm going to show you how to analyze BSODs and extract the relevant troubleshooting information. I'll then take a look at some of the more common Windows XP BSOD errors. I'll also provide a link to an article in Microsoft's Knowledge Base that describes the troubleshooting steps and possible solutions in detail. To view screen shots of these BSOD error messages, along with an explanation of each one, check out this photo gallery.

This blog post is also available in PDF format as a TechRepublic download.

Dissecting a BSOD

Although Stop errors can be caused by both hardware and software malfunctions, the most typical cause is a hardware malfunction. Each Stop error is accompanied by a specific error description and an eight-digit hexadecimal number error code. It may not be immediately apparent when you see a BSOD (mostly due to the shock factor that hits you when a BSOD occurs), but you can use the description and code to identify the type of error that is occurring. You just need to be able to identify the key parts of the message so you'll have a direction and focus for your troubleshooting expedition. The trick is in finding the relevant information on the BSOD.

Let's suppose that you encounter the BSOD shown in Figure A.

Figure A

This Stop error indicates that requested data was not in memory.

At the top of the Windows XP BSOD, you'll find the error description, which will be in all uppercase letters with multiple words tied together with underscore characters. In the following BSOD excerpt, the text KMODE_EXCEPTION_NOT_HANDLED is the error description:

A problem has been detected and Windows has been shut down to prevent damage to your computer.PAGE_FAULT_IN_NONPAGED_AREA

Immediately following the error description, you'll find some general troubleshooting steps. In some cases, following these steps will lead you to a solution. (Keep in mind that this same information appears in just about every BSOD.)

If this is the first time you've seen this error screen, restart your computer. If this screen appears again, follow these steps:

Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.

After the general troubleshooting information, you'll find the Technical Information section, which contains the eight-digit hexadecimal number error code. The code is usually accompanied by four error-dependent values enclosed in parentheses. (These values typically aren't necessary information, but you may want to take note of them.) If a file was directly associated with the problem that caused the BSOD, it will also be listed here. In this case, you can see that the file ati3diag.dll is tied to the problem:

Technical information: *** STOP: 0x00000050 (0x8872A990, 0x00000001, 0x804F35D7, 0x00000000)*** ati3diag.dll - Address ED80AC55 base at ED88F000, Date Stamp 3dcb24d0

Following the Technical Information section, you'll see another generic section. This one alerts you to the fact that Windows XP has dumped the contents of system memory to a file on the hard disk:

Beginning dump of physical memory. Physical memory dump complete. Contact your system administrator or technical support group for further assistance.

Armed with these details, you can visit Microsoft's online Help and Support page and search the Knowledge Base for more detailed troubleshooting and solution information.

Common BSODs in Windows XP

Now that you have a good idea of how to dissect a BSOD and pull out the relevant pieces of information from all the gibberish on the screen, let's look at some of the more common BSODs in Windows XP. I'll cover just a few of the BSOD conditions, but there are lots of possible Stop errors. For each BSOD I discuss, I'll provide a link to an article on the Microsoft Knowledge Base that covers that particular Stop error. (Since more than one article might address a Stop error, you may want to search the Knowledge Base if you discover that you need more information.)

STOP: 0x0000000A IRQL_NOT_LESS_OR_EQUAL

This Stop error, which can be caused by either software or hardware, indicates that a kernel-mode process or driver attempted to access a memory location it did not have permission to access or a memory location that exists at a kernel interrupt request level (IRQL) that was too high. A kernel-mode process can only access other processes that have an IRQL that's equal to or lower than its own.

Troubleshooting a Stop 0x0000000A error in Windows XP

STOP: 0x0000001E KMODE_EXCEPTION_NOT_HANDLED

This Stop error indicates that the Windows XP kernel detected an illegal or unknown processor instruction. The problems that cause this Stop error can be either software or hardware related and result from invalid memory and access violations, which are intercepted by Windows' default error handler if error-handling routines are not present in the code itself.

Possible Resolutions to STOP 0x0A, 0x01E, and 0x50 Errors

STOP: 0x00000050 PAGE_FAULT_IN_NONPAGED_AREA

This Stop error indicates that requested data was not in memory. The system generates an exception error when using a reference to an invalid system memory address. Defective memory (including main memory, L2 RAM cache, video RAM) or incompatible software (including remote control and antivirus software) might cause this Stop error.

Possible Resolutions to STOP 0x0A, 0x01E, and 0x50 Errors

STOP: 0x0000007B INACCESSIBLE_BOOT_DEVICE

This Stop error indicates that Windows XP has lost access to the system partition or boot volume during the startup process. Installing incorrect device drivers when installing or upgrading storage adapter hardware typically causes this Stop error. This error could also indicate a possible virus infection.

Troubleshooting Stop 0x0000007B or "0x4,0,0,0" Error

STOP: 0x0000007F UNEXPECTED_KERNEL_MODE_TRAP

This Stop error indicates a hardware problem resulting from mismatched memory, defective memory, a malfunctioning CPU, or a fan failure that's causing overheating.

General causes of "STOP 0x0000007F" errors

STOP: 0x0000009F DRIVER_POWER_STATE_FAILURE

This Stop error indicates that a driver is in an inconsistent or invalid power state. This Stop error typically occurs during events that involve power state transitions, such as shutting down or moving in or out of standby or hibernate mode.

Troubleshooting a Stop 0x9F Error in Windows XP

STOP: 0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL

This Stop error indicates that the system attempted to access pageable memory using a kernel process IRQL that was too high. The most typical cause is a bad device driver (one that uses improper addresses). It can also be caused by faulty or mismatched RAM or a damaged pagefile.

Error Message with RAM Problems or Damaged Virtual Memory Manager

STOP: 0x000000EA THREAD_STUCK_IN_DEVICE_DRIVER

This Stop error indicates that a device driver problem is causing the system to pause indefinitely. Typically, this problem is caused by a display driver waiting for the video hardware to enter an idle state. This might indicate a hardware problem with the video adapter or a faulty video driver.

Error message: STOP 0x000000EA THREAD_STUCK_IN_DEVICE_DRIVER

STOP: 0x00000024 NTFS_FILE_SYSTEM

This Stop error indicates that a problem occurred within Ntfs.sys, the driver file that allows the system to read and write to drives formatted with the NTFS file system. (A similar Stop message, 0x00000023, exists for the file allocation table [FAT16 or FAT32)] file systems.)

Troubleshooting Stop 0x24 or NTFS_FILE_SYSTEM Error Messages

STOP: 0xC0000218 UNKNOWN_HARD_ERROR

This Stop error indicates that a necessary registry hive file could not be loaded. The file may be corrupt or missing. The registry file may have been corrupted due to hard disk corruption or some other hardware problem. A driver may have corrupted the registry data while loading into memory or the memory where the registry is loading may have a parity error.

How to Troubleshoot a Stop 0xC0000218 Error Message

STOP: 0xC0000221 STATUS_IMAGE_CHECKSUM_MISMATCH

This Stop message indicates driver, system file, or disk corruption problems (such as a damaged paging file). Faulty memory hardware can also cause this Stop message to appear.

"STOP: C0000221 unknown hard error" or "STOP: C0000221 STATUS_IMAGE_CHECKSUM_MISMATCH" error message occurs

About

Greg Shultz is a freelance Technical Writer. Previously, he has worked as Documentation Specialist in the software industry, a Technical Support Specialist in educational industry, and a Technical Journalist in the computer publishing industry.

31 comments
jnager
jnager

This is because you have problems in Windows Registry. It is a common cause of Windows crashes and error messages. Registry problems can occur for many reasons, including references left behind after uninstalling, incorrect removal of software, missing or corrupt hardware drivers or orphaned start-up programs. This will significantly increase the Registry size and slow down your computer, because Windows will need more time to load, search, and read data from the Registry. Scan your system for errors with Digeus Registry Cleaner http://www.digeus.com/products/regcleaner/registry-cleaner.html

andrewgauger
andrewgauger

So this issue does extended to current versions of Windows, however, instead of stopping at the stop error, you will likely need to dissect Event Viewer to find out the details. Go to the system event log and filter by Event Source and check "Bug Check" The same details of the BSOD will be here. Although this doesn't help if you can't get into the operating system. Unless you use a boot cd to copy the event viewer files off the system and view them on another machine. This also will not include BSOD errors that are only prevalent during boot.

Ceespace
Ceespace

not just me then actually it only ever happens on shutdown and if I have been hammering the machine in visual basic - so I can't complain

conrady
conrady

I get a black SOD upon shutting down windows (definitely not blue), as if the problem was at a lower level than windows; it flashes for less than a second. Is there some way to retrieve what it has displayed?

alaniane
alaniane

The last BSOD I got was about couple of months ago. A loose fan was what caused it. It was the southbridge fan that had broken away from the motherboard. Once it was reattached the BSOD went away. Most of my BSODs have come from developing/testing software, but this last one came unexpectedly since it wasn't my test machine.

ed.adams
ed.adams

I see these about twice a week in my computer repair shop. The most common by far is not mentioned here, UNMOUNTABLE_BOOT_VOLUME, which is usually an easy fix with chkdsk /r. Second most common is probably IRQL_NOT_LESS_THAN_OR_EQUAL_TO.

Mark W. Kaelin
Mark W. Kaelin

I haven't seen the blue screen of death on my Windows XP systems for over a year (knock on wood). When was your last experience with the dreaded BSOD error message and what caused the problem?

chuckt
chuckt

I'm having the same problem as Conrady on an older Dell notebook, except that it occurs on the book. This means that the BSOD wording can't be read nor can I get into the computer at all--except by booting from the XP cd. I don't want to lose data if possible, but would like to know if it is a hardware or software issue. Any way to capture that message? I doubt that there is a log file, but will check using the R option & DOS-like screen.

cnemo1
cnemo1

Can't read BSOD screen since computer does immediate re-boot

mikehigdon
mikehigdon

One thing to mention, you should boot off the Windows XP CD and use the recovery console to issue the chkdsk /r. This does usually fix the pesky unmountable_boot_volume BSOD. Mike

cnemo1
cnemo1

WHere would I look to find the crash dump? What do I look for in the dump to find ascertain the BSOD cause?

cnemo1
cnemo1

Since the BSOD causes an immediate re-boot, I can never see the message to read the codes that can be analyzed for the cause. I think I need to change something in the CMOS so the BSOD does not cause an immediate re-boot; what do I need to change in the CMOS?

Kostaghus
Kostaghus

Less than a month... It was a memory error on my home system. The culprit was a malfunctioning memory module. Changed it and it all went back to normal.

Capt. Midnight
Capt. Midnight

I'd get a KMODE_EXCEPTION_NOT_HANDLED BSOD when a multi-memory card reader was NOT plugged into a USB port on an aftermarket PCI based USB 2.0 four port card. Leaving it plugged in, everything worked fine so I never bothered with it till a month ago. Turns out it was a buggy driver on the USB 2.0 card provided by the manufacturer. Rolling back to the generic Microsoft driver fixed everything, so I deleted the manufacturer's driver to insure it would never be used again. When in doubt, use what Microsoft provides.

Neon Samurai
Neon Samurai

I'm attributing it to overworking the graphics card though. I was getting arbitrary reboots and BSOD regularly with nothing now since the new GPU's burn in period. At work, I don't think I've seen one that I haven't knowingly cause. The hardware and software are in a controlled environment though too. I see programs crash out but haven't blue screened or rebooted randomly. These days it's more about shots of BSOD in public places. The best one of those is a BSOD showing sideways.. so you know it's a widescreen on it's end but that's not the stinger - it's an Iphone display. That's right.. the giant Iphone's in your local phone store run Windows. I wish I could find the "top 10 BSOD" link now a month ago or more off techeblog. Airport displays, dispense machines, bank machines.. Windows is no surprise but..

Excelmann
Excelmann

Dell laptop blue screens but reboots so fast that you can't read but a few sententces. Are there ways of "catching/caching" the BSOD message?

mudpuppy1
mudpuppy1

I had two (XP). One at home and one at work. The one at home went away after a reboot and hasn't reappeared so I don't know why it happened. First one in years. The one at work happened because my hard drive died after about 4 years. Dug out another drive and rebuilt it. Fortunately, the drive wasn't so dead that I couldn't recover the data.

jsaubert
jsaubert

The last time I saw a BSOD was about 8 months ago after I let someone else work on my computer because I was out of town and I need it fixed so I could remote into it. (Never again!) Not counting that case if would have to be about 3 years now. (I know this is a XP topic, but the one thing I will say about Vista is I haven't been able to crash it. My Dell has been up 24/7 on an APC for over a year.)

dave
dave

Last one I had was a year ago on a desktop that had a bad RAM chip. This from an office that contains about 100 PC's. My opinion is that any blue screens these days are almost entirely hardware related, or less possibly driver related. And unless I'm very lucky, I have never experienced a driver related BSOD issue for a really long time.

mastertexan
mastertexan

My computer at work BSOD'd on me. Its a Dell Dimension 9200 and we've had it since Oct 06. I got the Unmountable boot error and the 0x7B error. Whats bad is my hard drives are setup as raid0 and I lost everything!!!

pgit
pgit

Not my machine, I haven't used windows for 10 years now. But clients often bring in their BSOD problems. I am usually able to fix, but occasionally I have found a reinstall is the quickest route. The last one was last Friday, it turned out to be bad memory. Thanks for the article, and the links. I do see a couple of those specific errors on occasion. On average I'd say (averaging over a year) I see 2 BSODs a month. Not bad, as I handle around a hundred machines a month. A 2% BSOD rate.

Doug Vitale
Doug Vitale

...since Windows XP bluescreened on me. It can get unresponsive when I run certain apps (like Google Earth) but it never freezes up totally or blue screens. Actually, when I tried to install XP on my new Dell last year (which came with Vista), XP kept bluescreening during the installation because the vanilla edition of XP I was using (from 2001) was too old to recognize the new hardware architecture of my box, so I had to slipstream SP2 and make a new installation disc.

omegafire
omegafire

Got one of these bad boys... Stop: c000007b {Bad Image} Came up every time I booted my machine. No clear solution on the internet Did a full repair of windows which took a full 2 hours.

matthew.patrick
matthew.patrick

I have honestly never had my own personal PC get a BSOD using windows XP.

cnemo1
cnemo1

Thanks for tip to disable auto restart on system failure which erases BSOD screen in 1-2 seconds so you can't see anything except it was a blue screen.

T_Mac
T_Mac

I would agree with booting from the Windows XP CD and the chkdsk /r approach from recovery console. I've used this approach often - can work on registry hive errors too. This has either corrected the issue ongoing or allowed me to get the system up and running long enough for the client - and me - to back up data and move on to a re-image if required. Then there's some of the other tools available in recovery console. Trish

cnemo1
cnemo1

I was told this but haven't tried it yet. "Disable automatic restart on system failure in the advanced startup options, and you will be able to see the BSOD long enough to gather the stop code and 4 params."

?/\/\?|???\/???
?/\/\?|???\/???

... tell Windows to generate a larger dump file, and the BSOD will stay up until the dump is written. Depending on the system and what was running, this may or may not be long enough. The details should also be logged to the event log but in certain cases may not be.

Editor's Picks