How to get BSOD and crash debugging assistance

[Ian]

If you are experiencing BSOD's (also known as the blue screen of death), this is the forum section to post in.

To get help with your problem, please attach the crash dumps to a new thread in this section, along with any more information about the crash (such as when it occurs or any error text).

To post your crash dumps, please go to C:\Windows\Minidump and copy the files in there to any other folder on the machine. Then zip or rar the files and attach the compressed file to your post using the paperclip above where you type. If you don't have any minidump files available after a crash, you may need to enable them using this tutorial.

Windows 7 has built-in zipping abilities. All you have to do is highlight the file(s), right click them and choose "send to" and then "Compressed (zip) folder".

It would also help if you fill in your system specs page so that we known as much information about your system as possible, especially the motherboard motherboard model (you can use CPU-Z to find out, if you aren't sure).



You may be asked to run some tests on your system, these links may be useful:

• Memtest86+ Tutorial
• Prime95 Tutorial
• How to enable Small Memory Dumps

 

[TrainableMan]

Even if you are experiencing the same problems as are listed in another thread, start your OWN thread.

You can post a link to the old thread (for example "I have the same problem as LINK"), but please start your own thread. It is much easier to notice a new thread with no replies then it is a 6 month old thread that already has 10 posts.

 

[Elmer BeFuddled]

Helpful Things To Do

Filling in your Computer Specs under your UserCP is a great help to other Forum Members.
If you are unsure, you can download and run Speccy which will help you with the details.
This will help take some of the guesswork out of analysing your problems.

Download and install RamMon. Run RamMon, select the Export/Copy button. Select the Export/Copy format as HTML then Write to File. Include the saved report in a zipped file.

Download and install CPU-Z. The experts will want you to take and attach screenshots/snips of the Mainboard tab, Memory tab and all the slot #'s under the SPD tab. Attach the images directly to a post for all to see.



Memory Tab:

SPD Tab:

When you've started your new post, click on the Go Advanced button, this will take you to a new post editing window. Attach the screenshots to your post by using the paper clip you will find on the top toolbar. No need to zip them up, attach them to your post "as is".

Go to your C:\Windows\Minidump folder. Copy the *.dmp files to a new folder on your desktop, zip that up and attach it to your post using the paper clip method mentioned above.

If your Minidump folder is empty or doesn't exist, there is a very good chance that Minidumps have not yet been enabled. Follow this tutorial to enable Minidumps.

The minidumps are the basis for the analysis of your BSOD. If you find you have none, help can still be started. Download and run Driver View. With the program open and in focus, press Ctrl+A (Select All), then File > Save Selected Items. Attach the saved text file to your post as above.

Elmer

 

[TrainableMan]

For BSOD debugging it is important to attach your DMP files, however only zipped DMP files may be uploaded to the forum. This can be an issue for many users because DMP files are stored in a protected system folder where most will get an error when they try to use the Windows 7 built-in zip feature.

The solution is quite simple. Create a folder under your "My Documents" called DMP. Now in Windows Explorer paste or type %SystemRoot%\Minidump into the folder path bar. Copy the most recent DMP files (because of size limits on attachments to the forum, copy no more than the last 10) to your new DMP folder in My Documents. Now, still in Windows Explorer select either all the files or simply select the My Documents\DMP folder and right-click. From the content menu that pops up select Send To > Compressed (zipped) folder/files


Once you have the Zipped DMP files, attach then to your forum post. You will need to use the "Go Advanced" button to get more options including the "attach" option which appears as a paperclip.

 

[TrainableMan]

Few more points to mention.

First, viruses can cause BSODs. Download TDSSKiller and RKill from our Freeware DB. If you do not have an anti-virus then download, install, and allow to update Malwarebytes Anti-Malware (MBAM). Then reboot your system into safe mode without networking (Reboot and, when it says "Starting Windows," Press F8; If you get a message asking continue in safe mode or perform a system restore, choose continue in safe mode). Now run TDSSKiller and after that run RKill and after that run a full virus scan. The first two will take maybe 5 minutes each but a full virus scan can take anywhere from 30 minutes to several hours depending on your hard drive size and number of files.

Booting in safe mode makes sure only minimal services/programs are started. TDSSKiller is designed specifically to look for rootkits. RKill is designed to stop the stealthing programs that hide/protect/regenerate some nasty viruses. Running these first will help ensure your A/V has the absolute best chance of cleaning up infected files.

Please mention when you submit a request for help that you have completed this step or it is the first thing I will tell you to do.

Second, it is important that you are running the latest Service Pack and have installed Windows critical updates. At the time of this posting that would be SP1. If you are not on Service Pack 1 then upgrade to that and test out your system a few days. If the problem persists then post.

Third, the biggest cause of BSODs are third-party drivers. Check the manufacturers website (of your computer or of your MOBO) for updated drivers for video, network, sound, etc. There could even be a BIOS update that could improve stability (especially if you just upgraded to W7 from XP).

Fourth, Hardware changes? Is this a new computer (or have you had it 6 months and now suddenly it is acting up)? Factory build or custom/home-build? Have you added any new hardware: RAM, new MOBO, video card, sound card, network card, etc. Basically, fill us in on the computers history.
And ...
A. If you are overclocking CPU or GPU? Set them back to factory.
B. New build or new RAM? Verify the RAM is matched and correct for your board and in the right slots. Pull it out and reseat it to make sure it is in properly. Verify the ram timings/voltage in the BIOS are correct for your specific RAM. Try running Memtest86+, you would be surprised how often at least one brand new RAM stick is bad.

 

[TrainableMan]

I'm a novice to BSOD debugger but lately I have been trying to help and someone asked me how I give the advice I do ...
So for the do-it-yourselfers out there maybe this could help you as well.

First and foremost, always the virus scan. If nothing is new on/in your machine that you know and "it was working fine" for a month or more, then a virus is a good possibility and something you need to resolve immediately.

Second, if I read your post and see "new" or "hardware changes" then I suggest RAM testing as well as updating manufactures drivers/BIOS etc (like I mentioned in my post above).

But assuming you are past those things ...
I pull the DMP up in BlueScreenView and look for items in red. If it's the kernal in red (ntoskrnl.exe) then it isn't much help because that is basically a "catch all" but any others in red are possibilities. Note that if I see version 7600 instead of 7601 on the kernal then I know they haven't installed SP1 & that critical system patches/updates must be done to ensure it isn't the operating system at fault.

So I look up the drivers on a website like this Driver Reference Table. If it says they are Windows files, then I recommend making sure you have the latest windows updates; if they aren't system files then I suggest the links provided in the DRT for them to check for updates.

Next, I sort by driver date and even if it wasn't in red I look for anything older than W7s official release in July 2009. I've found you can Ignore the Macrovision driver secdrv.SYS from Sept 2006 as well as Window's spldr.sys & AMD's amdxata.sys from May 2009. Finally, since video drivers are a very common issue I may also sort alphabetically and look for drivers starting with AMD's "ATI" or NVidia's "NV" to see how old those are.