Hardware Reviews

Loading

Wednesday, 12 May 2010

PLEASE! Don't Reinstall Windows because of Blue Screens!

The infamous blue screen of death has hit many users, leaving most people no choice but to format.

We can help you! Follow our step by step instructions and we can help you to finally get rid of the blue screen of death, for good.

You Require:
Windows Symbol Packages
Debugging Tools

Follow the prompts, and when you install, take note of your Symbols location, if you accept the default settings. I normally create a folder first and then direct the install to that folder because I use WinDBG for two Operating Systems, XP and Vista and want to keep them separate and organized.
This Microsoft Support Knowledge Base article will explain how to read the small memory dump files that Windows creates for debugging purposes


Overview
The first step will show you how to create and capture the memory dump, associated with the BSOD you are trying to troubleshoot.
The second step will be installing and configuring WinDBG and the Symbols path to the correct Symbols folder.
We will then use WinDBG to Debug and analyze the screen dump, and then get to the root cause of the problem.

Create Memory Dump
Keep in mind that if you are not experiencing a blue screen fatal system error, there will be not memory dump to capture.
1. Press the WinKey + Pause
2. Click Advanced and under Start up and Recovery select Settings.
3. Uncheck Automatically restart.
4. Click on the dropdown arrow under Write debugging information.
5. Select Small memory dump (64 KB) and make sure the output is %SystemRoot%\Minidump.
6. Restart the PC normally as this will allow the System to error and Blue Screen and then create the Minidump.
The location of the Minidump Files can be found here:
C:\WINDOWS\Minidump\Mini000000-01.dmp

Setting up and using WinDBG
1. Click Start | All Programs | Debugging Tools for Windows, and open WinDBG. Select File | Symbol file path and modify it to suit your situation, then copy and paste it into the box and click OK. I suggest:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Or if you are using different Symbols:
SRV*c:\Vistasymbols*http://msdl.microsoft.com/download/symbols
SRV*c:\XPsymbols*http://msdl.microsoft.com/download/symbols

Figure A - Symbol Path












2. Close the workspace and save the Workspace information. This should lock in the Symbol path.

Figure B - Workspace







3. Open WinDBG and select File and select Open Crash Dump then navigate to the minidump file created earlier, highlight it and select Open.

Click on:
! analyze -v
Under Bugcheck Analysis.

Figure C - ! analyze -v











Tips! If you look to the bottom of the screen you will see kd> to the right of that type in !analyze -v or .lastevent, and press the Enter key, it will show you the exception record and stack trace of the function where the exception occurred.
You can also use the .exr, .cxr and .ecxr commands to display the exception and context records.
When working with Drivers you can use kd> lm tn to get extra information.
[Ctrl]+[A] will let you copy the information and paste it into notepad.

Figure D - kd>




For example, look to the bottom of the page for information similar to what is shown in Figure E.

Figure E - Stack trace










Conclusion
The problem creating the BSOD was caused by the installed dialer software for a USB modem. It turned out that uninstalling the software didn't resolve the problem.
The answer to the problem was achieved by using the WinDBG tool to Debug and analyze the memory dump file. The fix was to rename the C:\Windows\System\fldevice.sys driver to C:\Windows\System\fldevice.sys.old. Windows was still referencing the file even though the software had been uninstalled. This tool is invaluable and will help you to resolve the problems that you may encounter when you get a BSOD.