locked
blue screen RRS feed

  • Question

  • Problem signature:
      Problem Event Name: BlueScreen
      OS Version: 6.0.6000.2.0.0.768.3
      Locale ID: 1033

    Additional information about the problem:
      BCCode: ab
      BCP1: 00000001
      BCP2: 00000098
      BCP3: 00000000
      BCP4: 00000002
      OS Version: 6_0_6000
      Service Pack: 0_0
      Product: 768_1

    Files that help describe the problem:
      C:\Windows\Minidump\Mini041313-01.dmp
      C:\Users\nate\AppData\Local\Temp\WER-85628-0.sysdata.xml
      C:\Users\nate\AppData\Local\Temp\WER9607.tmp.version.txt

    Read our privacy statement:
      http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409
     

    nathan garman

    Saturday, April 13, 2013 10:28 AM

All replies

  • Blue screens are caused by faulty hardware or faulty hardware drivers.

     

    To See if a Fix is Available

    In Control Panel (and select Classic view in the left hand pane) choose Problem Reports and Solutions (type problem in Start's search box), go to Problem History, right click your error and choose Check For Solution. You may also right click and choose Details for more info. Post those details here.

     

    To See if a Recent System Change Caused It

    In Control Panel (and select Classic view in the left hand pane) choose Administrative Tools then choose Reliability and Performance Monitor and choose Monitoring Tools then Reliability Monitor (type Reliability in search on Start) . This list is a chart of software installs, uninstalls, Windows updates, and crashes by date (scroll left to see earlier dates). See if your crashes started happening after you installed or uninstalled something.

     
    Standard Hardware Troubleshooting
     
     
    First lets test what hardware we can. Hardware faults can appear as many software faults, therefore we need to test hardware first..
     

    Please do the following in order. Memory faults can cause disk corruption, disk faults can cause disk corruption. Disk corruption causes corrupted files (which SFC may be able to fix). If you get an hardware error stop and post back. Do not run chkdsk with faulty memory.

     
    Memory Diagnostic
    If you haven't run a memory diagnostic then please do so. Click Start - Control Panel - choose Classic View in left hand pane - choose Administrative Tools -  then Memory Diagnostics Tool.
     
    S.M.A.R.T
    Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator. Type (or copy and paste by right clicking in the Command Prompt window and choosing Paste).
     
    Disk drives in Windows monitor themselves for impending failure. The feature is called S.M.A.R.T. It will detect impending failure 30% of the time. In an elevated command prompt type (it's one line)
     
    wmic /namespace:\\root\wmi PATH MSStorageDriver_FailurePredictStatus get active,predictfailure,reason /format:List
     
    If it's on Active will be true, if not on turn it on in the computer's BIOS.
     
    Predict Failure should be False if everything's ok.
     
    In Vista and later if SMART predicts failure Windows prompts the user to run Backup.
     
    Run Chkdsk
    In Computer right click all your drives and choose Properties, then Tools tab, then click Check Now. Tick BOTH checkboxes then Start. Reboot. This will take overnight.
     
    SFC
    Check for file corruption by clicking Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator. Type (or copy and paste by right clicking in the Command Prompt window and choosing Paste).
     
    sfc /scannow
     
    Heat
    Heat can cause problems like this and also sudden reboots without crashing. Ensure your fans are not clogged with dust.
     
    For Memory Diagnostic Results
    Click Start - Control Panel (and select Classic view in the left hand pane) choose Administrative Tools then Event Viewer then look at Event Viewer (Local) - Applications and Services - Microsoft - Windows - MemoryDiagnostic-Results for entries.
     
    Look for EventID is 1201 or 1101 and Source is MemoryDiagnostic-Results
     
    Double click the entry for details on that entry.

    For Chkdsk Results
    Click Start - Control Panel (and select Classic view in the left hand pane) choose Administrative Tools then Event Viewer then look at both the Application and System logs (under Windows Logs) for entries.
     
    Look for EventID is 7 and Source is Disk
    Look for EventID is 11 and Source is Disk
    Look for EventID is 50 and Source is Disk
    Look for EventID is 51 and Source is Disk
    Look for EventID is 52 and Source is Disk
    Look for EventID is 55 and Source is NTFS
    Look for EventID is 130 and Source is NTFS
    Look for EventID is 134 and Source is NTFS
    Look for EventID is 137 and Source is NTFS
    Look for EventID is 1001 and Source is Autochk
    Look for EventID is 1001 and Source is Winlogon
    Look for EventID is 1001 and Source is WinInit
    Look for EventID is 1001 and Source is Chkdsk
    Look for EventID is 26212 and Source is Chkdsk
    Look for EventID is 26213 and Source is Chkdsk
    Look for EventID is 26214 and Source is Chkdsk
    Double click the entry for details on that entry.
     
    P.S. 7 and 55 are the auto repair codes where windows repairs disk errors silently on the fly. 52 is the SMART warning.
     
    For SFC Results
    Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator. Type (or copy and paste by right clicking in the Command Prompt window and choosing Paste).
     
    findstr /c:"[SR] Cannot" %windir%\logs\cbs\cbs.log|more
     
    This will see which files are corrupted.
     
    To see if it did anything
     
    findstr /c:"[SR] Repairing" %windir%\logs\cbs\cbs.log|more
     
    There are frequent false positives for small text files Windows uses such as desktop.ini and settings.ini. Ignore these.
     

     
    Dump Files
     
    Dump files are files containing the state of the machine when it crashed. We can analyse the file to identify the driver (or program) causing the crash. See the last section on how to get them analysed by a volunteer.
     
    Analyse Dump Files
    If you want to analyse your own dump files.
     
    You need to start Explorer as Administrator to access the files in C:\windows\Minidump. Right click Explorer and choose Run As Administrator.

    Download and install Debugging Tools for Windows
    Install theWindows SDK but just choose the debugging tools.

    Create a folder called Symbols in C:\

    Start Windbg. File menu - Symbol File Path and enter

    srv*C:\symbols*http://msdl.microsoft.com/download/symbols
     
    Close and reopen WinDbg. File menu - Open Crash Dump

    This will analyse the crash dump. You need to close and reopen WinDbg for each dump file analysed. Because you are downloading symbols from the internet WinDbg will appear to be doing nothing. But it's downloading. Be patient.
     
    You are looking for a driver or system library that the crash occurred in at the end of the listing. Find the file, right click then Properties - Details tab. If it shows a driver you'll need to update the driver identified. Most drivers are in c:\windows\system32\drivers.
     
    Search the Drive for a File.
    Click Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator. Type replacing drivername.sys with the name of the file being searched (or copy and paste by right clicking in the Command Prompt window and choosing Paste).

     

    dir c:\drivername.sys /a /s

     
    If it shows a system file see if you can get a program from analyze -v.

    Type in theWinDbg command prompt
     
    !analyze -v
     
    -v stands for Verbose and if the crash was originated by a program, as opposed to hardware or a driver, it will appear in the middle of the listing.
     
    eg
     
    PROCESS_NAME:  java.exe
    IMAGE_NAME:  ntkrnlmp.exe
     
    PROCESS_NAME only appears in the analyze -v output and only if a program originated the call that faulted.

     
    Upload Them for Analysis
     
    Or upload the minidump files to your Public folder on Skydrive and copy the link from the address bar and I'll analyse them.
     
    Skydrive is Microsoft's Windows Live file upload site at https://skydrive.live.com/.  Read about it at http://explore.live.com/skydrive.

    If you have downloaded any of the Live applications or have a web based Live mail account you already have access to your Skydrive.

    Put your event list in the Public folder and copy the link from the address bar.

    --
    .
    --

    --
    .
    --
    "natonius1" wrote in message news:c2966694-c644-4a50-a807-6c3f06ff61c4...
    Problem signature:
      Problem Event Name: BlueScreen
      OS Version: 6.0.6000.2.0.0.768.3
      Locale ID: 1033

    Additional information about the problem:
      BCCode: ab
      BCP1: 00000001
      BCP2: 00000098
      BCP3: 00000000
      BCP4: 00000002
      OS Version: 6_0_6000
      Service Pack: 0_0
      Product: 768_1

    Files that help describe the problem:
      C:\Windows\Minidump\Mini041313-01.dmp
      C:\Users\nate\AppData\Local\Temp\WER-85628-0.sysdata.xml
      C:\Users\nate\AppData\Local\Temp\WER9607.tmp.version.txt

    Read our privacy statement:
      http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409
     

    nathan garman


    David Candy
    Monday, April 15, 2013 10:26 AM
  • We do need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.
    You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.
    If you are overclocking stop.  (chances are if you dont know if you are, you are not)a
    To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.  We need at least 2 DMP FILES to diagnose and confirm


    The procedure:

    * Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
    * Zip up the copy.
    * Attach the ZIP archive to your post using the "paperclip" (file attachments) button. (if available on  your site, MS doesnt have this)
     *Please upload them to a file sharing service like Skydrive or"Rapidshare" and put a link to them in your reply.
    Link for how to  upload below.
    http://www.wikihow.com/Use-SkyDrive

    To ensure minidumps are enabled:

    * Go to Start, in the Search Box type: sysdm.cpl, press Enter.
    * Under the Advanced tab, click on the Startup and Recovery Settings... button.
    * Ensure that Automatically restart is unchecked.
    * Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
    * Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
    * OK your way out.
    * Reboot if changes have been made.

    Please also run MSinfo32 and upload the output as well.
    To run MSinfo32 please go to start>run>MSinfo32
    Go to "file" "save" and upload the saved file with the DMPS
    (Instructions for XP, Vista, Win 7, Win 8)
    System specs are often useful so include whatever you know

    Wanikiya & Dyami -Team-ZigZag. www.ZigZag3143.com email Admin@zigzag3143.com

    Monday, April 15, 2013 7:04 PM
    Moderator