BLUE SCREEN ERROR

The following paste comes from Oreilly.com 's book "Windows XP Annoyances for Geeks, 2nd Edition"
By David A. Karp, ISBN : 0-596-00876-7

6.2.11. Blue Screen of Death
The Blue Screen of Death (BSoD) is aptly named. It's blue, it fills the screen, and it means death for whatever you were working on before it appeared. Microsoft refers to BSoD errors as "Stop Messages," a euphemism for the types of crashes that are serious enough to bring down the entire system.

 A single error is no cause for concern. Only if an error happens a few times, or repeatedly, do you need to pursue any of the solutions listed here.

By default, Windows restarts your computer as soon as the BSoD appears, leaving almost no time to read the error message before it vanishes. To change this, go to Control Panel  System  Advanced tab, click Settings in the Startup and Recovery section, and turn off the Automatically restart option. (See below for more information on the Write debugging information options.)

However, turning off the Automatically restart option may not really be necessary. Every time you get a BSoD, Windows logs the error, although not in the standard Event Log (eventvwr.msc) as you might expect. Instead, a single .wdl (WatchDog Log) file is created in the \Windows\LogFiles\Watchdog folder for each crash. Just open the most recently dated file in your favorite text editor (or Notepad) to view details of the crash and some related information.

In addition to the .wdl file created for each crash, a .dmp file is created in the \Windows\Minidump folder. These files are known as memory dumps and contain some (or all) of the information in your computer's memory when the crash occurred. Typically only developers will be able to make use of this information, but it might be worth investigating if you're trying to solve a problem. To read the .dmp files, open a Command Prompt window (cmd.exe) and type dumpchk filename, where filename is the full path and filename of the .dmp file. To control how much information is written to the .dmp files, or to disable .dmp file creation altogether, return to the aforementioned Startup and Recovery Settings window.

6.2.11.1 Alphabetical List of BSoD Errors
There are a whole bunch of possible BSoD messages, probably more than 100. However, only about 20 happen frequently enough that they might imply that an actual problem exists. More than likely, you've seen at least one of the following stop messages on your own system:

Attempted Write To Readonly Memory (stop code 0X000000BE)

A faulty driver or service is typically responsible for this error, as is outdated firmware. If the name of a file or service is specified, try uninstalling the software (or rolling back the driver if it's an upgrade).

Bad Pool Caller (stop code 0X000000C2)

Causes and remedies are similar to "Attempted Write To Readonly Memory," above. Additionally, this error might also be the result of a defective hardware device.

If you encounter this message while upgrading to Windows XP (see Chapter 1), it may mean that one or more devices in your system are not compatible with XP. Try disconnecting unnecessary devices, or at least look for updated drivers and firmware. Also, disable any antivirus software you may have running.

Data Bus Error (stop code 0X0000002E)

This can be caused by defective memory (see Section 6.4 later in this chapter), including system RAM, the Level 2 cache, or even the memory on your video card. Other causes of this error include serious hard disk corruption, buggy hardware drivers, or physical damage to the motherboard.

Driver IRQL Not Less Or Equal (stop code 0X000000D1)

Drivers programmed to access improper hardware addresses typically cause this error. Causes and remedies are similar to "Attempted Write To Readonly Memory," earlier.

Driver Power State Failure (stop code 0X0000009F)

This error is caused by an incompatibility between your computer's power management and one or more installed drivers or services, typically when the computer enters the "hibernate" state (discussed at length in Chapter 5). If the name of a file or service is specified, try uninstalling the software (or rolling back the driver if it's an upgrade). Or try disabling Windows support for power management.

Driver Unloaded Without Cancelling Pending Operations (stop code 0X000000CE)

Causes and remedies are similar to "Attempted Write To Readonly Memory," earlier in this section.

Driver Used Excessive PTEs (stop code 0X000000D8)

Causes and remedies are similar to "No More System PTEs," later in this section.

Hardware Interrupt Storm (stop code 0X000000F2)

This error occurs when a hardware device (such as a USB or SCSI controller) fails to release an IRQ, a condition typically caused by a buggy driver or firmware. This error can also appear if two devices are incorrectly assigned the same IRQ (discussed later in this chapter).

Inaccessible Boot Device (stop code 0X0000007B)

You may see this error during Windows startup if Windows cannot read data from the system or boot partitions (described in Chapter 1). Faulty disk controller drivers are often to blame, but this problem can also be caused by hard disk errors, or even a corrupted boot.ini file (also described in Chapter 1).

If all is well with your drivers and your drive and you haven't been messing with the boot.ini file (such as while installing multiple operating systems), check your system BIOS settings (described in Appendix B).

If you encounter this message while upgrading to Windows XP (see Chapter 1), it may mean that one or more devices in your system are not compatible with XP. Try disconnecting unnecessary devices, or at least look for updated drivers and firmware. Also, disable any antivirus software you may have running.

Kernel Data Inpage Error (stop code 0X0000007A)

This error implies a problem with virtual memory (discussed in Chapter 5), often that Windows wasn't able to read data from — or write data to — the swapfile. Possible causes include bad sectors, a virus, improper SCSI termination, bad memory, or physical damage to the motherboard.

Kernel Stack Inpage Error (stop code 0X00000077)

Causes and remedies are similar to "Kernel Data Inpage Error," earlier in this section.

Kmode Exception Not Handled (stop code 0X0000001E)

A faulty driver or service is sometimes responsible for this error, as are memory and IRQ conflicts and faulty firmware. If the name of a file or service is specified, try uninstalling the software (or rolling back the driver if it's an upgrade).

If the Win32k.sys file is mentioned in the message, the cause may be third-party remote control software (discussed in Chapter 7).

This error can also be caused if you run out of disk space while installing an application or if you run out of memory while using a buggy application with a memory leak. Developers may wish to use the poolmon.exe utility to help isolate the problem, as described in Microsoft Knowledge Base article Q177415.

Mismatched Hal (stop code 0X00000079)

The currently installed Hardware Abstraction Layer (HAL) must match the type of computer on which Windows XP is installed, or you may see this error. For example, if you use a HAL intended for a dual-processor system on a single-processor motherboard, Windows may not start. The best way to correct problems with the HAL is to reinstall Windows XP.

This error can also be caused by out-of-date Ntoskrnl.exe or Hal.dll files, so if you've recently attempted to repair these files on your system, look for backups of the original versions.

No More System PTEs (stop code 0X0000003F)

Page Table Entries (PTEs) are used to map RAM as it is divided into page frames by the Virtual Memory Manager (VMM). This error usually means that Windows has run out of PTEs.

Aside from the usual assortment of faulty drivers and services that can cause all sorts of problems, this error can also occur if you're using multiple monitors.

If you find that you're experiencing this error often, you can increase Windows's allocation of PTEs with this procedure:

Open the Registry Editor (discussed in Chapter 3).

Expand the Registry branches to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

Double-click the PagedPoolSize value, enter 0 for its value data, and click OK.

Next, double-click the SystemPages value. If you're using multiple monitors, enter a value of 36000 here. Otherwise, enter 40000 if you have 128MB of system RAM or less, or 110000 if you have more than 128MB of RAM.

Click OK and then close the Registry Editor when you're done. The change will take effect when you restart Windows.

NTFS File System (stop code 0X00000024)

This is caused by an problem reported by Ntfs.sys, the driver responsible for reading and writing NTFS volumes (see Chapter 5). If you're using the FAT32 filesystem, you may see a similar message (with stop code 0X00000023).

Causes include a faulty IDE or SCSI controller, improper SCSI termination, an overly aggressive virus scanner, or errors on the disk (try testing it with Chkdsk). See the discussion of SCSI controllers in Section 6.4, later in this chapter.

To investigate further, open the Event Viewer (eventvwr.msc) and look for error messages related to SCSI or FASTFAT (in the System category), or Autochk (in the Application category).

Page Fault In Nonpaged Area (stop code 0X00000050)

Causes and remedies are similar to "Attempted Write To Readonly Memory," earlier in this section.

Status Image Checksum Mismatch (stop code 0Xc0000221)

Possible causes for this error include a damaged swapfile (see the discussion of virtual memory in Chapter 5) or a corrupted driver. See "Attempted Write To Readonly Memory," earlier in this section, for additional causes and remedies.

Status System Process Terminated (stop code 0Xc000021A)

This error indicates a problem with either Winlogon.exe or the Client Server Runtime Subsystem (CSRSS). It can also be caused if a user with administrator privileges has modified the permissions (see Chapter 8) of certain system files such that Windows cannot read them. In order to fix the problem, you'll have to install a second copy of Windows XP (see "Setting up a Dual-Boot System" in Chapter 1) and then repair the file permissions from there.

Thread Stuck In Device Driver (stop code 0X000000EA)

Also known as the infamous "infinite loop" problem, this nasty bug has about a hundred different causes. What's actually happening is that your video driver has essentially entered an infinite loop because your video adapter has locked up. Microsoft has posted a solution on their web site that involves disabling certain aspects of video acceleration, but I've never encountered an instance where this worked. Instead, try the following:

Try upgrading your computer's power supply. A power supply of poor quality or insufficient wattage will be unable to provide adequate power to all your computer's components and may result in a "brownout" of sorts in your system. Note that newer, more power-hungry video adapters are more susceptible to this problem. See the discussions of power supplies later in this chapter.

Make sure you have the latest driver for your video card. If you already have the latest driver, try "rolling back" to an older driver to see if that solves the problem.

Make sure you have the latest driver for your sound card, if applicable. Also, make sure your sound card is not in a slot immediately adjacent to your video card.

Make sure your video card is properly seated in its AGP or PCI slot. If it's a PCI card, try moving it to a different slot.

Inspect your video card and motherboard for physical damage.

Try messing with some of your system's BIOS settings, especially those concerning your AGP slot or video subsystem, as described in Appendix B. For example, if your AGP slot is set to 2x mode and your video adapter only supports 1x AGP mode, then you'll want to change the setting accordingly.

Make sure your computer — and your video card — are adequately cooled. Overheating can cause the chipset on your video card to lock up.

Check with the manufacturer of your motherboard for newer drivers for your motherboard chipset.

For example, the "infinite loop" problem is common among motherboards with VIA chipsets and nVidia-based video cards. Visit the VIA web site (http://www.viaarena.com/?PageID=64) for updated drivers and additional solutions.

Try replacing your system's driver for the Processor-to-AGP Controller. Open Device Manager (devmgmt.msc), expand the System devices branch, and double-click the entry corresponding to your Processor-to-AGP Controller. Choose the Driver tab, and click Update Driver to choose a new driver. Unless you can get a newer driver from the manufacturer of your motherboard chipset, try installing the generic "PCI standard PCI-to-PCI bridge" driver shown in the Hardware Update Wizard.

If your motherboard has an on-board Ethernet adapter, try disabling the "PXE Resume/Remote Wake Up" option in your system BIOS (see Appendix B).

If you're using a dual-processor motherboard, Windows XP is probably loading a HAL (Hardware Abstraction Layer) for a MPS (Multiple Processor System). Such HALs support the I/O APIC (Advanced Programmable Interrupt Controller), a method of accommodating more than 15 IRQs in a single system. Unfortunately, APIC can cause problems with AGP-based video cards. Try changing your HAL to "Standard PC" to see if that solves the problem.

Unexpected Kernel Mode Trap (stop code 0X0000007F)

Typical causes of this error include defective memory, physical damage to the motherboard, and excessive processor heat due to overclocking (running the CPU faster than its specified clock speed).

Unmountable Boot Volume (stop code 0X000000ED)

This means that Windows was unable to mount the boot volume, which, if you have more than one drive, is the drive containing Windows (see Chapter 1 for more information on the boot and system volumes). This can be caused by using the wrong cable with a high-throughput IDE controller (more than 33 MB/second); try an 80-pin cable instead of the standard 40-pin cable. See also "Inaccessible Boot Device," earlier in this section.


That's a lot of reading, but I hope it helps.  If you'd like the rest of this book and others that really help, you can check out the safaribookshelf from O'reilly.  I only pay 19.95 a month.

I seriously doubt it is the hardware.  Microsoft has well over 100,000 blue screens from bugs in software.

0x1000000a [IRQL_NOT_LESS_OR_EQUAL] is not the same as 0x000000a from a similar question at:

http://www.experts-exchange.com/Operating_Systems/WinXP/Q_21186972.html

but for LucF, it is IRQL=Interrupt Request Queue Less, not "ReQuest"

The endian notation just means it is error stop 1A [#26] or A1 [#161] depending  on how your read it, big endian or little endian.

I don't know why Microsoft didn't just translate this; you can't find anything using error codes or stop codes on their site.

The rest of the numbers are the call stack and parameters, the last is the ntoskrnl.exe relocated address of the executing code.

a STOP 0x0000000A at address 801453ea may occur in NTOSKRNL.
 CAUSE

 A routine in the kernel that handles removing items from a linked list has a problem on multiprocessor computers.

Is just one of the failures of ntoskrnl.exe to handle things properly.

The numbers tell you the error code, sometimes the calling error code, stack contents, and the address of the routine that was executing so the dump can be analyzed by an expert in troubleshooting software failures at the machine code level.

They have all the symbol files, which you do not as the are proprietary, to analyze the bug by simulating it on their machines.

Most of the reboots in the middle of a program are caused by a bad block on disk.  This happens because the medium loses hysteresis [magnetic flux density] over time, even short times. This results in either a bad checksum, error correction code, or an irrecoverable [corrupt] block.  If NT [XP] cannot read this block, it cannot fix it.  It can fix checksums and one bit errors, it cannot fix two bit and higher errors.  Therefore, the block is marked bad and not used, unless it is a protected system block in which case the error repeats itself every time that block is attempted to be loaded into RAM from disk.

Getting a good copy of ntoskrnal.exe and writing it as something like ntoskrnl.ex- , deleting ntoskrnl.exe and then renaming ntsokrnl.ex- to ntoskrnl.exe works because it moves the location on disk where the ntoskrnl.exe is stored.  Reinstalling has the same effect.  Dangerous to do this unless you have a complete backup of your OS.

Running chkdsk, scandisk, and defrag helps to cut down on these errors by reading and writing the disk regularly, thus restoring the hysteresis [the magnetic flux density at the point of storage].

The suggested procedure is to begin by shutting off the rather "stupid" reboot on error.  Then go to safe mode and run chkdsk.  Reboot and run scandisk.  It will reguire another reboot to run.  After that is done and it reboots run defrag.  You are then at the beginning of being ready to troubleshoot a memory stop code error.

Usually, by this point, the error is already gone, unless it is a known problem such as the one stated above.

I went through all this trouble because it is not easy to replace a hard drive or RAM on a laptop, and it is not advised to have it done unless both are easily changeable from the outside of the case.  Letting anyone inside the case of a laptop with its microminiature circuits and interlocks is a guaranteed broken laptop with 6 months.

It is the hardware less than one in one million times.

It may be the hardware, but you'd be better off buying a new laptop.  Repair is to expensive and often breaks it within 6 months.

It is really more than likely the software, as admitted to by Microsoft.

if i were there i would boot to my BartPE cd and run some tests on your system. since you don't have one i would run chkdsk from recovery console. also try downloading this CD

http://www.ultimatebootcd.com/

it will run memory tests and hard drive tests

It is great as a lot of people are interested in this problem. The analysis summary of the dumps:

Mini031705-01.dmp 1000000A, (fffee0c8, 00000002, 00000001, 804dc249) win32k!SetWakeBit+b2 --> nt!KiUnlinkThread+c
Mini030705-01.dmp 1000008E, (c0000005, 804df017, ed707ad0, 00000000) NDIS!ndisCheckAdapterBindings+39 --> nt!KiFastCallEntry+0xa4
Mini030705-02.dmp 1000008E, (c0000005, 8054b6ee, ec7f7844, 00000000) nt!ExAllocatePoolWithTag+38b
Mini030505-01.dmp 100000D1, (00009761, 00000002, 00000000, 00009761) atapi!IdeProcessCompletedRequest+664  
Mini031805-01.dmp is inaccessible

Three different bugcheck code 0A, 8E and D1 and the callers are Microsoft routine. The failing module is ntoskrnel.exe. I've searched google and no known hit for the above kernel routine. As Mini031805-01.dmp is inaccessible and according to experience, it is a hardware error and caused XP created a incomplete Mini031805-01.dmp. I don't think the problem is related to hardware error at hard disk. I am not sure whether the CPU or M/B is faulty.

Hi Goodallknight,
Can I have the system event 1001 on 18th March? Do you have more minidump? Does your windows reboot without blue screen? I appreciate your co-operation

 

Run the original Compaq software, it should have some kind of check to see if it's all working correctly.

You don't need to go through the reinstall process with the Compaq software, so don't hit the install option.

And if you do have to reinstall, you will need the Compaq disks.

In which case, you should first backup your data, and then reformat from the BIOS as a low level format at least three times to refresh all alignment tracks.  Failure of the alignment tracks hysteresis is the most common cause of hard disk eventual failure, not the mechanical properties.

Most people don't even know that alignment tracks exist.  Many technicians are unaware.

Maybe it was the use of all capital letters that sort of blinded people to the name of the laptop; it's considered shouting.

In any case, good luck and hope you get it working.