Solved

Blue screen, what to do?

Posted on 2011-03-06
24
680 Views
Last Modified: 2012-06-27
One of our computers went blue screen and restarted.  How should I address it?  Will cloning the harddrive be a safe and sure way to sidestep this issue, or do I need to do a fresh OS install on a fresh hardrrive? Here is the error:

Stop (blue screen) error caused by a device or driver
You received this message because a hardware device, its driver, or related software has caused a stop error, also called a blue screen error. This type of error means the computer has shut down abruptly to protect itself from potential data corruption or loss. In this case, we were unable to detect the specific device or driver that caused the problem.

The following troubleshooting steps might prevent the stop error from recurring. Try them in the order given. If one step does not solve the problem, then move on to the next one.

Steps to solve this problem
Download and install the latest updates and device drivers for your computer

Use Windows Update to check for and install updates:

Click to go online to the Windows Update website


Note
If Microsoft Update is installed, you'll be taken to the Microsoft Update website.

Click Custom to check for available updates.

In the left pane, under Select by Type, click each of the following links to view all available updates:


High Priority

Software, Optional

Hardware, Optional


Select the updates you want, click Review and install updates, and then click Install Updates.

If you recently added a new hardware device to your computer, go online to the manufacturer's website to see if a driver update is available.

How do I find my computer manufacturer?

Click Start, click Run, type msinfo32, and then click OK. Your computer manufacturer is listed as the System Manufacturer in the right pane of the System Information window.

Click to go online to see contact information for most computer manufacturers
If you recently added a new program to your computer, go online to the manufacturer's website to see if an update is available.

Scan your computer for viruses

Many blue screen errors can be caused by computer viruses or other types of malicious software.

If you have an antivirus program installed on your computer, make sure it is up to date with the latest antivirus definitions and perform a complete scan of your system. Check your antivirus product's website for information on getting the latest updates.

If you do not have antivirus software installed on your computer, we recommend using a web-based scanner to check your computer for malware. Many of the top antivirus software providers offer this service free of charge on their websites.

To see a list of Microsoft and third-party providers of antispyware, anti-malware, and antivirus software, go online to the following website:

Security software: Downloads and trials
To see a list of antivirus software vendors, go online to the following Knowledge Base article:

List of antivirus software vendors
 Tip
Consider scanning your computer using more than one web-based antivirus scanner, even if you have an antivirus program installed on your computer. This will help make sure that you are using the most up-to-date antivirus definitions and allows you to benefit from the different strengths of each antivirus software manufacturer. If you do run multiple antivirus products, make sure you run only one product at a time. Running multiple antivirus products simultaneously can produce incorrect results.

Check your hard disk for errors

You can help solve some computer problems and improve the performance of your computer by making sure that your hard disk has no errors.

Click Start, and then click My Computer.

Right-click the hard disk drive that you want to check, and then click Properties.

Click the Tools tab, and then, under Error-checking, click Check Now.

To automatically repair problems with files and folders that the scan detects, select Automatically fix file system errors. Otherwise, the disk check will report problems but not fix them.

To perform a thorough disk check, select Scan for and attempt recovery of bad sectors. This scan attempts to find and repair physical errors on the hard disk itself, and it can take much longer to complete.

To check for both file errors and physical errors, select both Automatically fix file system errors and Scan for and attempt recovery of bad sectors.

Click Start.

Depending upon the size of your hard disk, this might take several minutes or longer. For best results, don't use your computer for any other tasks while it's checking for errors.

Note
If you select Automatically fix file system errors for a disk that is in use (for example, the partition that contains Windows), you'll be prompted to reschedule the disk check for the next time you restart your computer.

For more information, go online to read the following article:

How to perform disk error checking in Windows XP
Steps to work around this problem
Warning
These steps are designed to address a particular problem but might do so by temporarily disabling or removing some functionality on your computer.

Remove any new hardware or software to isolate the cause of the blue screen

If you received the blue screen error after adding a new hardware device or program, and downloading updates didn't solve the problem, try removing the device or program and restarting Windows. If removing the new device or program allows Windows to start without the error, contact the device or program's manufacturer to get product updates or to learn about any known issues with the device or program.

Restore your computer to an earlier state

If the blue screen error occurred after installing a system or program update, consider using the System Restore feature to remove the changes. System Restore uses "restore points" that have been saved on your computer to return your system to a point in time before the problem began. This won't fix the problem, but it can make your computer work again.

Do one of the following:

If Windows doesn't start:

Restart the computer and, when the screen becomes blank during startup, repeatedly press F8 until the Windows Advanced Options Menu displays.

Use your arrow keys to select Safe Mode with Command Prompt, and then press ENTER.

For more information about safe mode start up options, go online to read an article in the Microsoft Knowledge Base:

Click to read KB315222
If you are prompted to select a version of Windows, select the correct version, and then press ENTER.

Log on to the computer using the Administrator account or an account that has administrator credentials.

Type the following command at a command prompt, and then press ENTER:

[systemroot]\system32\restore\rstrui.exe

(Where [systemroot] is the drive and directory where your Windows system files are located -- for example, "C:\Windows")

Follow the instructions that appear on the screen to restore the computer to an earlier state.

Or, if Windows starts:

Log on to Windows using an administrator account.

Click Start, point to All Programs, point to Accessories, point to System Tools, and then click System Restore.

On the Welcome to System Restore page, select Restore my computer to an earlier time, and then click Next.

On the Select a Restore Point page, click the most recent system checkpoint in the On this list, click a restore point list, and then click Next. You might receive a message that lists configuration changes that System Restore will make. Review this list, and then click OK.

On the Confirm Restore Point Selection page, click Next. System Restore restores the previous Windows configuration, and then restarts the computer.

Log on to the computer as an administrator.

When the System Restore Restoration Complete page appears, click OK.



Advanced troubleshooting

The following steps can help determine what is causing a blue screen error and provide additional options for solving the problem. Try the above troubleshooting steps first before trying these advanced troubleshooting steps.

This section is intended for advanced computer users, such as software developers and network administrators. If you are not comfortable with advanced troubleshooting procedures, we recommend that you perform these steps with someone who is.

Step 1: Start Windows in safe mode

Restart the computer and, when the screen becomes blank during startup, repeatedly press F8 until the Windows Advanced Options Menu displays.

Use your arrow keys to select Safe Mode, and then press ENTER.

For more information about safe mode start up options, go online to read the following article:

A description of the Safe Mode Boot options in Windows XP
If you are prompted to select a version of Windows, select the correct version, and then press ENTER.

Step 2: Collect more information about your computer

To continue troubleshooting this problem, you will need to collect more information about your computer, and then use it to find more information online.

Use Event Viewer to find specific information about this problem

Event Viewer is an advanced tool that displays detailed information about significant events on your computer. It can be helpful when troubleshooting problems and errors with Windows and other programs.
Click Start, click Run, type EVENTVWR, and then click OK.

Click Application.

Click View, and then click Filter.

In the Event Source drop-down menu, click any one of the following: Save Dump, System Error, or Windows Error Reporting.

In the Event ID field, type 1001, and then click OK.

Review each event listed and write down the bugcheck code (for example, 0x000000D1 or 0x0000008E).

Go to the next step to search the Internet for a solution.

Perform an Internet search

Use the information you collected in the previous step to search the Internet for more help. If you find troubleshooting steps, make sure that they apply to your specific computer before you follow them.

Go online to search the Internet for specific bugcheck codes you found using Event Viewer. For example, search for "0x000000D1" or "0x0000008E."
Go online to search the Internet for the driver name. For example, search for "portcls.sys."
Go online to search the Internet using different combinations of text, such as "Blue Screen" or "Stop Error" along with the driver or device name. For example, you could search for "portcls.sys bluescreen".
Step 3: Roll back or disable the problem driver

Start Device Manager. To do this, click Start, click Run, type devmgmt.msc, and then click OK.

Based on the driver and device information you obtained in Step 2 above, double-click the device that you have determined might be causing the problem.

If you think the problem was caused by a recent update of the driver, click the Driver tab, and then click the Roll Back Driver button. If the problem did not coincide with a recent updating of the driver, then click the Disable button instead.

Step 4: Determine whether a third-party program is causing the problem

Click Start, click Run, type msconfig, and then click OK.

Click the General tab, click Selective Startup, clear the Load startup items check box, and then select the Load System Services check box.

Click OK, and then restart the computer.

If Windows starts, go to Step 5. If Windows does not start, go to Step 7.

Step 5: Identify the conflicting program

Because of the number of programs that might be listed, we recommend that you use the following process of elimination:

Click Start, click Run, type msconfig, and then click OK.

Click the Startup tab.

Select approximately half of the listed items, and then click OK.

Restart the computer.

If Windows does not start, restart Windows in safe mode.

Repeat this process until you have identified the program that is causing the problem.

Once you determine that a specific program is causing the problem, we recommend that you remove it if you are not using it.

How do I uninstall a program?

Click Start, click Control Panel, and then click Add or Remove Programs.

Click Change or Remove Programs, click the program you want to remove, and then click Change/Remove or Remove.

Note
If the program that you want to uninstall isn't listed, it might not have been created for your version of Windows. To uninstall the program, check the information that came with the program or contact the manufacturer for more information.

If you do not want to remove the program, contact the software manufacturer for a solution to the problem.

Step 6: Disable all third-party services

Disable all third-party services to find out whether the problem is being caused by one of them.

Warning
The following procedure describes how to turn off third-party services. Be careful not to disable Microsoft services, because doing so will turn off System Restore and cause you to lose all system restore points.

Click Start, click Run, type msconfig, and then click OK.

Click the Services tab, and then click the Hide all Microsoft services check box to filter the list to third-party services only.

Click Disable all to disable the listed third-party services.

Restart the computer and check to see if the problem has gone away. If it has, you know that one of the disabled third-party services is causing the problem. Go to step 7 to identify which service is causing the problem.

Step 7: Locate and disable the third-party service causing the problem

Warning
The following procedure describes how to turn off third-party services. Be careful not to disable Microsoft services, because doing so will turn off System Restore and cause you to lose all system restore points.

Because of the number of services that might be listed, we recommend that you use the following process of elimination:

Click Start, click Run, type msconfig, and then click OK.

Click the Services tab, and then click the Hide all Microsoft services check box to filter the list to third-party services only.

Disable approximately half the services on the list, and then click OK.

Restart the computer in normal mode.

If Windows starts, then the problem service is among those you disabled. Repeat the process of enabling services in msconfig and restarting Windows until you determine which one causes Windows to not start in normal mode (this is the service that is causing the problem).

If Windows does not start, then the problem service is among those you left enabled. Repeat the process of disabling services and restarting Windows until you determine which one causes Windows to start in normal mode (this is the service that is causing the problem).

If you have determined which service is causing the problem, we recommend that you disable it and contact the service's manufacturer for information on how to solve the problem. Also, make sure you re-enable any of the other services you disabled for diagnostic purposes.
0
Comment
Question by:rodynetwork
  • 9
  • 8
  • 6
  • +1
24 Comments
 
LVL 47

Accepted Solution

by:
dbrunton earned 167 total points
ID: 35047403
>>  Will cloning the harddrive be a safe and sure way to sidestep this issue, or do I need to do a fresh OS install on a fresh hardrrive?

Cloning may just copy the error across especially if it is a virus or corrupt file.

You can test the hardware before considering cloning.

Get the UBCD http://www.ultimatebootcd.com/

Download links are the icons at the top of the page above Overview.  Browse the page and see what utils are there for you.  Check the memory and hard disk utils especially.

Make the CD and boot from it.  Run the memory tester first - memtest -  and let it do two to three passes through your memory.  Memory could be the problem so get that test done first.

Then test the hard disk with the correct manufacturer's util for your hard disk.  Do the long test.  That will most likely tell you if your disk is corrupt.  Your problems could possibly be a failing hard disk as well so it won't hurt to do that.

Those two will test memory and hard disk.

Getting a Live Linux CD such as

Knoppix http://www.knoppix.org/
Ubuntu http://www.ubuntu.com/

and making the CD and booting from it will test the motherboard and general operation of the computer (If Linux runs OK and you can do stuff with it the system is probably OK (but do the memory and hard disk test first)).

Virus scan.  Around here the following are recommended.  Do this before doing any cloning as well.

MalwareBytes:
http://www.malwarebytes.org/mbam-download.php
ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
HitmanPro:
http://www.surfright.nl/en/hitmanpro
TDSSKiller:
http://support.kaspersky.com/downloads/utils/tdsskiller.zip




0
 
LVL 6

Assisted Solution

by:Tonypeswani
Tonypeswani earned 167 total points
ID: 35047482
Usually blue screen generates Minidump/Memory Dump   file that needs to be analyzed with the help of Microsoft debugger tool and in that we can identify which driver file is causing system to crash.
This dump file is located in %SystemRoot%\Minidump and after that file needs to be updated
Hence we would first suggest you to run windows update that will update those files for which update is available with the Microsoft and normally this will resolve this issue.

Please let me if it helps for this problem.

Thank you
0
 

Author Comment

by:rodynetwork
ID: 35047930
So, if the hard drive is failing, cloning is probably a good idea, vs, if it's a virus, then I need to find and remove the virus.  Had another computer blue screen a few days ago, but it is a Vista box. The one today is a XP Pro and I had removed a few viruses from it about a week ago.  Dont' think the Vista box had any viruses.  Sorry, rambling.  Not sure if the two are related, just odd that I would have two machines blue screen a few days apart.  I will try the harddirve test and the hardware test and get back to you.
0
 

Author Comment

by:rodynetwork
ID: 35048553
I am downloading the UBCD.  I thought I would share some codes, while I wait.  Do these tell you anythiing?  I was a system error, Event ID 1003:

Error code 1000000a, parameter1 00000000, parameter2 00000002, parameter3 00000000, parameter4 80500d23.

Also, this:

0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 30    1000000
0020: 61 20 20 50 61 72 61 6d   a  Param
0028: 65 74 65 72 73 20 30 30   eters 00
0030: 30 30 30 30 30 30 2c 20   000000,
0038: 30 30 30 30 30 30 30 32   00000002
0040: 2c 20 30 30 30 30 30 30   , 000000
0048: 30 30 2c 20 38 30 35 30   00, 8050
0050: 30 64 32 33               0d23    
0
 
LVL 47

Expert Comment

by:dbrunton
ID: 35050073
>>   Do these tell you anythiing?

Not really.  Still the same as before.  You need to test hardware and then proceed from there.
0
 
LVL 91

Expert Comment

by:nobus
ID: 35054235
please post the minidump, as asked !
0
 
LVL 91

Expert Comment

by:nobus
ID: 35054251
you can access it (if the system does not boot any longer,) from a live CD like Knoppix :
ftp://ftp.kernel.org/pub/dist/knoppix/KNOPPIX_V6.4.4CD-2011-01-30-EN.iso
0
 

Author Comment

by:rodynetwork
ID: 35055391
I found this time and have attached it here. Mini030611-01.dmp
0
 
LVL 91

Assisted Solution

by:nobus
nobus earned 166 total points
ID: 35057706
it crashed on : PROCESS_NAME:  iexplore.exe
with the IMAGE_NAME:  ntkrnlpa.exe
you can try reinstalling IE
does it still run ? then : http://support.microsoft.com/kb/318378
0
 

Author Comment

by:rodynetwork
ID: 35058524
Machine is fine.  Runs as if nothing ever happened.  Running IE and Outlook and several other apps. Has acted fine since the blue screen happened Saturday morning.  I just jumped on this issue as I have found in the past when  machine blue screens, it usually dies sometime not long after that.
0
 
LVL 91

Expert Comment

by:nobus
ID: 35059188
so what are you planning to do then?
0
 

Author Comment

by:rodynetwork
ID: 35059905
I don't know.  What should I do?  I have been approaching this as if the machine were going to just die at any moment.  Am now thinking maybe that is not the case?  
0
Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

 
LVL 47

Expert Comment

by:dbrunton
ID: 35060012
>>  Am now thinking maybe that is not the case?

Quite possible.

Have you tested your hard disk and memory?
0
 

Author Comment

by:rodynetwork
ID: 35062742
Not yet.  I did download the UBCD.  Need to get on that machine after she logs off and try it.
0
 

Author Comment

by:rodynetwork
ID: 35063411
dbrunton.  Thanks for the input. Need a little more instruction.  Please bear in mind I am not an IT pro. I can do what you tell me, but some things I won't know to do or think to do. Here is my problem.  I went to the UBCD site and downloaded what I think is the iso image.  I first tried burning that to a cd, didn't work to boot from. Next, I used IMGBURN to create a disc image cd.  When I was done burning it, I noticed IE opened with D:\ubcd\website\index.html.  I swear before I burned the disc image cd the file was a .iso file.   I am going to see if maybe it needed to be unzipped or something. Somethign isn't right...
0
 
LVL 47

Expert Comment

by:dbrunton
ID: 35063436
If you got an ISO file you burn it as an image to a CD.  Not as a file but an image.  In ImageBurn that is the Write Image File to disk option.

If you got a zip then unzip it and you should have an image file.


>>  When I was done burning it, I noticed IE opened with D:\ubcd\website\index.html.

I think you've hit CTRL-D to make UBCD your home page.


>>  I am not an IT pro. I can do what you tell me, but some things I won't know to do or think to do.

No problem.

0
 
LVL 91

Expert Comment

by:nobus
ID: 35066797
you can also run a system restore to a date it worked ok !
0
 

Author Comment

by:rodynetwork
ID: 35068789
is there another way to check the harddrive and memory besides using UBCD?  I can't figure out what is wrong, but I did use the first option in IMGBURN, the Write image to disc.  The cd opens like I just burned files to it. Maybe I am doing something wrong when I try to boot from it?  I was starting up and going to bios adn changing the "boot" to boot from cd. Is there a different way to boot from cd?
0
 
LVL 91

Expert Comment

by:nobus
ID: 35070266
ok post the exact filename and extension here(to be sure irt's correct)
if it is zipped, unzip it
you can use cdburnerxp to burn iso images  (as another burning tool to test) http://cdburnerxp.se/
then you BOOT from CD
0
 
LVL 91

Expert Comment

by:nobus
ID: 35070270
..you may have to set the cd as first device in boot priority..
0
 
LVL 47

Expert Comment

by:dbrunton
ID: 35073003
Or you haven't booted the computer.
0
 

Author Comment

by:rodynetwork
ID: 35073679
file name is ubcd503.iso.  Size is 106,880 kb.  I ran unzip on it and didn't do anything, so I am thinking it is not zipped.

When I burned the cd, I launched IMGBURN and selected this file and and chose write image to disc.  

When I try to boot with this cd, no matter whether I go into bios or not, it doesn't boot from the cd. This is where I go into bios and change the setting to boot from cd and save it and press Y and then let it boot, with this cd in the tray and spun up, computer boots from harddrive, not from this cd.

So, next thing is, when I take that cd and put it in an already booted up machine, the first thing that happens is IE launches and has this as an address:  D:\ubcd\website\index.html

When I open cd and look at what is on it, I see the following:
Folders-
antivir
boot
pmagic
ubcd

Files-
autorun.inf
license.txt

Have burned two cd's with the same result...

The ubcd503.iso file was downloaded from the ubcd site using the Fuji server.

Any suggestions how to make this work, or any  suggestions on some other way to check harddrive and memory?  That XP machine appears to be running with no issues since that blue screen on Saturday morning....
0
 
LVL 47

Expert Comment

by:dbrunton
ID: 35073741
You don't seem to have done anything wrong.


>>  the first thing that happens is IE launches and has this as an address:  D:\ubcd\website\index.html

I suspect that if you look inside autorun.inf you'll see a line that launches IE to that website.


Have you tried seeing if the UBCD will boot on the second computer?  This is just to see if the disk is OK.  I suspect it is but need to confirm.


>>  That XP machine appears to be running with no issues since that blue screen on Saturday morning....

Just make sure you have all important data. serial numbers backed up on that machine.


0
 
LVL 91

Expert Comment

by:nobus
ID: 35080153
>>  file name is ubcd503.iso  <<  then it is an iso, a zip file would be  ubcd503.zip
did you do this on the BAD pc ?   better try it on a known good PC -  or test if your cd is bootable on a good one!
0

Featured Post

Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

Join & Write a Comment

Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now