Blue Screen of Death Analysis

In this lab we initiate a manual BSOD and create a dump file. We also discuss ways to resolve BSOD issues in the real world environment.

To manually force a BSOD we created a new DWORD Value in regedit. The value was named "CrashOnCtrlScroll" and was placed in "HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > services > i8042prt > Parameters".  Right click the newly created DWORD Value and select Modify. Set the Value Data to "1".  Now when you hold right control and press scroll lock twice, it will cause a manual blue screen of death.



This method is great for practice as it still creates a "mini dump" file that contains information about the crash and saves it to disk. You can view the information about the crash to help identify the cause.

Files that help describe the problem can be found in the locations shown in the image above. On Windows 7 and newer versions of Windows, BSOD information is also displayed in the Action Center.  The BSOD information can also be found in the Event Viewer.

Microsoft documentation on this error: http://support.microsoft.com/kb/244139

How to diagnose and correct BSOD errors:

Many errors can be resolved by searching the Microsoft documentation database for the error code. Often a hotfix download is available to resolve the issue.

*Adapted from howtogeek.com Copyright © 2006-2013 HowToGeek.com.  All Rights Reserved.

• Use System Restore: If your system recently started blue-screening, use System Restore to roll its system software back to a previous state. If this works, you’ll know that it’s likely a software problem.
• Scan for Malware: Malware that digs deep into Windows and gets its hooks into the Windows kernel at a low level can cause system instability. Scan your computer for malware to ensure buggy malicious software isn’t causing it to crash.
• Install Updated Drivers: An incorrectly installed or buggy driver can lead to crashes. Download the latest drivers for your computer’s hardware from your computer manufacturer’s website and install them — this may fix BSODs caused by driver problems.
• Boot Into Safe Mode: If your computer is blue-screening every time you turn it on, trybooting into safe mode. In safe mode, Windows loads only the essential drivers. If a driver you’ve installed is causing Windows to blue screen, it shouldn’t do so in safe mode. You can work on fixing the problem from safe mode.
• Check for Hardware Problems: Blue screens can be caused by faulty hardware in your computer. Try testing your computer’s memory for errors and checking its temperature to ensure that it isn’t overheating.
• Reinstall Windows: Reinstalling Windows is the nuclear option. It will blow away your existing system software, replacing it with a fresh Windows system. If your computer continues to blue screen after this, you likely have a hardware problem.
• You can open Action Center and check for solutions. Windows will analyze the BSODs and other types of errors and give you any information that it can about fixing the problem.