Windows XP Blue Screen Troubleshooting

This article is for Microsoft Windows XP.
Click below to change the operating system.

• Windows 10
• Windows 8
• Windows 7
• Windows Vista

Table of Contents:

1. What Is a Blue Screen Error?
2. Troubleshooting Common Blue Screen Error Messages
   1. 0x000000ED and 0x0000007B
   2. 0x00000024
   3. 0x0000007E and 0x0000008E
   4. 0x00000050
   5. 0x000000D1
   6. 0xC0000218
   7. 0x000000EA
3. Using the Windows Debugger
4. Restore the Operating System to Factory Settings

---

This article describes what Blue Screen errors are, why they occur, how to recognize them, and how to resolve some of the more common error messages.

---

Topic 1: What Is a Blue Screen Error?

When Windows encounters certain situations, it halts and the resulting diagnostic information is displayed in white text on a blue screen. The appearance of these errors is where the term "Blue Screen" or "Blue Screen" has come from.

Blue Screen errors occur when:

 

• Windows detects an error it cannot recover from without losing data
• Windows detects that critical OS data has become corrupted
• Windows detects that hardware has failed in a non-recoverable fashion
• The exact text displayed has changed over the years from a dense wall of information in Windows NT 4.0 to the comparatively sparse message employed by modern versions of Windows. (Figure 1)

A problem has been detected and Windows has been shut down to prevent damage
to your computer.
UNMOUNTABLE_BOOT_VOLUME
If this is the first time you've seen this error screen,
restart your computer. If this screen appears again, follow
these steps:
Check to be sure you have adequate disk space. If a driver is
identified in the Stop message, disable the driver or check
with the manufacturer for driver updates. Try changing video
adapters.
Check with your hardware vendor for any BIOS updates. Disable
BIOS memory options such as caching or shadowing.
If you need to use Safe Mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:
*** STOP: 0x000000ED(0x80F128D0, 0xC000009C, 0x00000000, 0x00000000)

Figure 1: Sample Blue Screen Error

Back to Top

---

Topic 2: Troubleshooting Common Blue Screen Error Messages

Stop 0x000000ED (UNMOUNTABLE_BOOT_VOLUME)

Stop 0x0000007B (INACCESSIBLE_BOOT_DEVICE)

These two errors have similar causes and the same troubleshooting steps apply to both of them. These stop codes always occur during the startup process. When you encounter one of these stop codes, the following has happened:

1   The system has completed the Power-On Self-Test (POST).

---

 

2   The system has loaded NTLDR and transferred control of the startup process to NTOSKRNL (the kernel).

---

 

3   NTOSKRNL is confused. Either it cannot find the rest of itself, or it cannot read the file system at the location it believes it is stored.
When troubleshooting this error, your task is to find out why the Windows kernel is confused and fix the cause of the confusion.
Things to check:

• The SATA controller configuration in the system BIOS If the SATA controller gets toggled from ATA to AHCI mode (or vice versa), then Windows will not be able to talk to the SATA controller because the different modes require different drivers. Try toggling the SATA controller mode in the BIOS.
• RAID settings You may receive this error if you've been experimenting with the RAID controller settings. Try changing the RAID settings back to Autodetect (usually accurate).
• Improperly or poorly seated cabling Try reseating the data cables that connect the drive and its controller at both ends.
• Hard drive failure Run the built-in diagnostics on the hard drive. Remember: Code 7 signifies correctable data corruption, not disk failure.
• File system corruption Launch the recovery console from the Windows installation disc and run chkdsk /f /r.
• Improperly configured BOOT.INI (Windows XP). If you have inadvertently erased or tinkered with the boot.ini file, you may receive stop code 0x7B during the startup process. Launch the recovery console from the Windows installation disc and run BOOTCFG /REBUILD

Back to Top

---

STOP 0x00000024 (NTFS_FILE_SYSTEM)

This stop code indicates the NTFS file system driver encountered a situation it could not handle, and is almost always caused by 3 things:

• Data corruption on the disk
• Data corruption in memory
• The system completely running out of memory (this typically only happens on heavily-loaded servers)

Things to check:

1   Reseat the memory and all drive data cables to eliminate data corruption issues stemming from poorly or improperly seated hardware.

---

 

2   Run a complete memory and hard drive diagnostic. The quick test will not be thorough enough here. You need to run the full system diagnostic.

---

 

3   If those diagnostics pass, run a full file system check from the Recovery Console (chkdsk /f /r) to detect and (potentially) fix any corrupted data.

---

 

4   If none of the above solves the issue, reinstall Windows.

---

 

5   If that does not fix the issue, replace the hard drive.

Back to Top

---

STOP 0x0000007E (SYSTEM_THREAD_EXEPTION_NOT_HANDLED)

STOP 0x0000008E (KERNEL_MODE_EXCEPTION_NOT_HANDLED)

These two errors indicate that a program running in the kernel encountered an unexpected condition it could not recover from. They have identical troubleshooting and resolution steps, and you will probably need to use the Windows Debugger to find out what caused the error.

Things to check:

• If the Blue Screen message mentions a driver or library file, figure out what driver or application that file is part of and update or disable it.
• Update the system BIOS to the latest available revision.
• Uninstall any recently installed programs, and roll-back any recently installed drivers.
• Run diagnostics on the computer's memory.

Back to Top

---

STOP 0x00000050 (PAGE_FAULT_IN_NON_PAGED_AREA)

This stop code means the system tried to access a nonexistent piece of memory, almost always due to:

• A driver trying to access a page of memory that is not present
• A system service (ex. virus scanner) failing in an exceptional way
• Faulty or incorrectly seated memory
• Corrupted data on the hard drive

Use the Windows Debugger to pinpoint the exact cause of these errors.

Things to check:

1   If the Blue Screen error mentions a driver or library file, figure out what driver or program the file is a part of and either upgrade to the latest version or uninstall the driver or program.

---

 

2   If the error happens during the startup process, try booting to the Last Known Good Configuration.

---

 

3   If the error started appearing after a program or driver was installed, uninstall that program or driver.

---

 

4   Try running a full hard drive and memory diagnostic after reseating the memory and hard drive data cables.

Back to Top

---

STOP 0x000000D1 (DRIVER_IRQL_NOT_LESS_THAN_OR_EQUAL_TO)

This stop code indicates a driver tried to access a certain area of memory when it should not have, meaning there is a flaw in the driver itself. The goal of your troubleshooting is to find that driver and either disable or replace it. Use the Windows Debugger to troubleshoot this error.

Without the debugger, you are limited to uninstalling/updating/rolling back the driver that contains the driver file the Blue Screen mentions.

Back to Top

---

STOP 0xC0000218 (STATUS_CANNOT_LOAD_REGISTRY_FILE)

This stop code indicates the Registry has been corrupted.

Things to check:

1   Try to boot to the Last Known Good Configuration.

---

2   If that fails, you will have to try and restore the registry files manually. The process for doing so is fairly complex and described in the Microsoft KB Article: "How to recover from a corrupted registry that prevents Windows XP from starting" Article ID: 307545 

Back to Top

---

STOP 0x000000EA (THREAD_STUCK_IN_DEVICE_DRIVER)

This Blue Screen error indicates that a device driver-almost always a video card driver-is stuck waiting for something (usually a hardware operation) to happen. Most of you have probably seen nv4_disp.sys associated with this Blue Screen.

Things to check:

1   Ensure the video drivers are updated to the latest Dell version.

---

 

2   The system BIOS is fully up-to-date.

---

 

3   If both the video driver and the system BIOS are fully up-to-date, check with the manufacturer for recent driver updates.

---

 

4   As a last resort, try exchanging the video card.

Reinstalling Windows is not likely to prevent this error from reoccurring.

Back to Top

---

Topic 3: Using the Windows Debugger

The Windows Debugger is one of the primary tools used by Microsoft software developers and support staff to analyze and resolve errors that result in memory dumps, and it's available for you.

The Windows Debugger is a powerful tool with many useful applications, but for this article, we are only interested in its ability to analyze memory dump files generated by blue screen errors to determine the cause of the error.
Before you can use the tool, keep in mind the following:

• The Windows Debugger is not a native Windows tool. You must download and install the application (15 MB) from the Microsoft web site. Administrator access is required to install the tool.
• The Debugger requires some minor customization before use.
• The Debugger can take anywhere from 30 seconds to two minutes to fully analyze a memory dump.

To use the tool, follow these steps:

1      Download and install the Windows Debugger from the Microsoft Web Site .

 

---

---

3      Configure the symbol path used by the debugger to turn addresses in the memory dump file into meaningful location names: expand the File menu, select Symbol File Path, type "SRV*c:\debug_symbols*http://msdl.microsoft.com/download/symbols" in the dialog box then click OK.

---

4      Open a minidump file: expand the File menu, select Open Crash Dump, select the desired dump file and click Open.

 

---

5      The debugger will open the dump file and give a brief description of what caused the system to crash (Figure 2).

Figure 2: Windows Debugger

 

Suggested command for the Debugger's command line

Stop code from the blue screen (1000007F is the same as 0x7F)

What Windows thinks caused the crash (atapi.sys in this example, you'll sometimes see things like memory_corruption

---

6      When it returns this preliminary analysis, the Debugger tells you how to dig deeper. Type "!analyze -v" in the command line (kd>) field at the bottom of the window and press the Enterkey to have the WinDbg perform a detailed analysis of the file.

Figure 3: Analyze the Results

A detailed explanation of the stop code (in the example, you can see that the kernel encountered an EXCEPTION_DOUBLE_FAULT (8), or an error while trying to process an error)

 

Figure 4: Further Analysis of the Results

The bug check code (notice in the example it includes the number 8, indicating the double fault)

The number of times the system has crashed with this exact error (typically 1)

The bucket in which Windows has categorized the crash

The stack trace at the time the system crashed, with the most recently called procedure on top (you can see in the example the system crashed while processing a request from the IDE controller)

 

Figure 5: Additional Analysis

The name of the module the system was in when it crashed. On an actual system, the module name is a link you can click to receive some useful information about the module, who created it, how old it is, etc

Back to Top

---

Topic 4: Restore the Operating System to Factory Settings

If clean boot troubleshooting cannot identify the issue, it may be necessary to restore your computer to factory settings. To restore your computer's operating system and software to the original factory settings, launch the link below:
Launch the Microsoft Windows Reinstallation Guide

Back to Top

---