Manually Crash Windows – Blue Screen On Demand, the ultimate guide to solve blue screen errors (BSOD) on Windows – Le Crab Info
The ultimate guide to resolve blue screen mistakes (BSOD) on Windows
Totovelo10 has filed a new comment on the VirtualBox article: Install the invited additions 7 hours ago
Manually Crash Windows – Blue Screen on Demand
Windows Includes a feature that can be Enabled to Manually Crashing the System by Holding the Right Ctrl Key and Pressing the “Scroll Lock” Key Twice. This can be useful for generating a crash dump to debug applications or it can be a fun prank. Follow these steps to enable this feature:
- Open Registry Editor by Clicking on the Start button and typing in regeit and Hitting Enter. If you are on xp first select run and then type in regeit and hit enter.
- Navigate to: HKEY_LOCAL_MACHINE \ SYSTEM \ CURRENTCONTROLSET \ Services \ i8042prt \ Parameters.
- CREATE A NEW DWORD VALUE AND NAME IT Crashonctrlscroll
- Right-Click on the New Dword Value and Select Modify.
- Type 1 In The Value Data Field and Click OK.
- Close Regedit and Reboot Your System.
Now you can Blue Screen (Crash) Your System by Holding the Right Ctrl Key and Pressing “Scroll Lock” Twice.
TIP:
Your system may reboot automatically when this crash is initiated. If Your System Reboots IMMIDATELY Initiating the crash, and you want to see the blue screen, follow these steps:
1. Go to Control Panel > System
2. Click on the Advanced tab
3. Under Startup and recovery, click the Setings button.
4. Under System Failure, Uncheck the option Automatically Restart.
The ultimate guide to resolve blue screen mistakes (BSOD) on Windows
When a fatal error occurs on your system, Windows displays the famous Blue screen of death (or BSOD for Blue Screen of Death). This fatal error occurs when the operating system reaches critical condition where it can no longer function properly.
You can meet one when installing an update, a program, equipment, or suddenly, without any precise action seeming to have triggered it. Windows still acts like this : he stops suddenly to protect himself from possible data loss, displays his blue screen Then restart your computer.
According to the errors reports that were sent to Microsoft until April 2014, the reasons why Windows Crashe are thus distributed:
- Third -party peripheral pilots: 70%
- Unknown, because of a serious corruption of memory: 15%
- Material errors: 10%
- Microsoft code: 5%
Sometimes exceptional, the blue screen of death that follows a fatal error can unfortunately be repeatedly displayed on your machine. If this is the case for you currently, you will need find the pilot responsible for fatal error and bring a solution to it. A device, its pilot or a program linked to it can be the cause of a blue screen. An update of the pilot or the program solves in most cases the problems encountered.
In this tutorial, I will show you how Analyze a blue screen In order to find the Driver responsible for fatal error and thus be able to definitively solve the problem ! The goal being to allow you to use your PC again in peace, without fear that a blue screen will appear again and interrupt you in your work.
Preamble: Memory image files
When the system crashes, Windows therefore displays a blue screen, which is accompanied by a stop code. This stop code gives us first information on the Nature of fatal error.
I Info: You can find all the stop codes and their meaning on the Bug Check Reference Code of the Microsoft Hardware Dev Center site.
However, this stop code can be quite Avare with information. In the capture above, the stop code Memory_Management indicates that a serious memory management error occurred … without knowing much more (see. Bug check 0x1a: Memory_Management).
Until Windows 7, the blue screen displayed Four parameters, which were associated with stop code (It is possible to find these four parameters in the event observer). They allow you to know a little more about the fatal error.
In the example below, the first parameter of the stop code UNMOUNTABLE_BOOT_VOLUME Indicates the device that has failed to be mounted by the system (see. : Bug check 0xed: unmountable_boot_volume).
When available, the pilot name who planted is also displayed. In the example below, these are RTKVHD64.sys. The latter tells us on the other hand on the other hand much more On the cause of the fatal error. Google research tells us that this is the Realtek High DEFINITION AUDIO AUDIO driver.
However, the name of the module responsible for the crash Don’t always appear !
I have a shutdown code that gives me no information and the name of the driver responsible for the crash is not displayed … how I will do to find the origin of the fatal error ?
I did not have time to see what was marked on the blue screen ! How I will do to debug Windows ?
Do not panic ! I was going to give you The solution To find the source of your blue screens.
After planting the system and after the blue screen is displayed, Windows proceeds to a Emptying physical memory (RAM) of the computer, by unloading its content in a hard disk file: the Memory image file (or Memory Dump files). You can also follow the progress of the emptying of memory on the blue screen via the percentage of completion which is gradually incredible (up to “100% finished”)).
This memory image file therefore contains a copy of all the data present in computer memory before ranging. These data will prove to be precious in order to establish a Complete diagnosis on the crash Windows. By consulting them, we will surely find the Windows pilot pilot !
There are two types of memory image files: files for the core mode (Kernel-Mode Dump) and files for user mode (User-Mode Dump Files). [1]
[1] User mode and kernel mode ^
On a Windows PC, the processor has two different modes: a user mode and one core mode. The processor switch between the two modes Depending on the type of code he performs: applications Exist in user mode, Components of the operating system In nucleus mode. Most of pilots Exist in kernel mode, but some can operate in user mode.
To solve your blue screen problems, you must analyze the Image files Mode Mode kernel. These are the files that contain the information to debug the system; User mode files allow them to debug only the programs installed by users.
Windows can generate five types Image memory for kernel mode, the difference being around the size of the generated file:
- Complete memory image : contains all physical memory which was used by Windows at the time of the crash. This is the largest memory image file. It requires an exchange file [2] which is at least as bulky as the main memory of the system: the size of the exchange file must therefore be equal to the whole RAM + 1 MB. If you have 16 GB of RAM on your computer, the size of the exchange file must therefore be 16.001 GB to be able to accommodate physical memory data !
- Image of the nucleus : contains Only the memory used by the nucleus At the time of the crash. This file is considerably smaller than the full memory image file. Its size is roughly equal to a third of physical memory installed on the system (if you have 16 GB of RAM, the size of the file will be about 5.3 GB). This image file does not include non -allocated memory, nor the memory allocated to user mode applications. It contains only memory allocated to the Windows kernel, the hardware abstraction layer (HAL), and also the memory allocated to pilots and programs in kernel mode. This is the most useful memory image file. Smaller and faster to execute than the full memory image file, it does not contain physical memory data which is generally not involved in the crash.
- Partial memory image (256 KB) : the smallest memory image file, useful on very limited disk space systems. Insofar as it contains Limited information (Stop message, List of loaded drivers …), the analysis of this file may not allow to discover the source of the errors encountered at the time of the computer crash.
- Automatic memory emptying : contains the same information that the kernel memory image file. The difference between the two does not reside in the image file itself, but in the way Windows defines the size of the system exchange file. If the size of the system exchange file is defined on “automatic management file management for readers”, and the memory image parameter is defined on “automatic memory emptying”, Windows automatically defines a size for The exchange file, large enough to capture the nucleus memory image.
- Active memory emptying : similar to the full memory image, it does not however contain the memory assigned to hyper-v virtual machines, useless for the debugging of the host machine.
[2] Windows exchange file ^
When the RAM (RAM) is saturated, Windows creates a file (pagefile.SYS) on the system reader (C 🙂 to store additional information there: it is the exchange file. This technique allows Windows to store information on the hard disk that should normally store in RAM. It is said that Windows has a virtual memory, which corresponds to the sum between the size of the RAM (RAM) and that of the exchange file.
You can configure the memory type type that Windows creates in the event of a crash in the Advanced system settings (%Systemroot%\ System32 \ Systempertiesadvanced.EXE)> Starting and recovery.
It is recommended to leave the type of default memory image: Automatic memory emptying.
Only one and only file memory image can be created during a system crash. If a second fatal error occurs and an image memory of the kernel (or a full memory image) is created, it will replace the previous one (if the option “Replace all existing parameter files” is checked).
The memory image file is written by default in %Systemroot%\ Memory.DMP.
Whatever the type of memory image you have chosen, Windows always creates more a partial memory image file Whenever the system stops unexpectedly (when the blue screen is displayed), even if you have selected “kernel memory image” or “full memory image” in the settings.
If a second fatal error occurs, a second Partial memory image is created and the previous one will be preserved. Each new partial memory image file will have a different name, with the date of the crash encoded in the file name. For example, “050917-10843-01.DMP “is the memory image file generated on May 9, 2017.
All partial memory image files are kept in the folder %Systemroot%\ Minidump.
Now that you know how the memory image files operation, let’s consult the DEBOGING INFORMATION that they contain in order to find the pilot responsible for your blue screens of death !
Resolve a blue death screen (BSOD)
Step 1: Analyze memory image files
To start, we will analyze the Partial memory image files.
Even if the latter contain little information, it is not uncommon to find the pilot responsible for fatal error.
If partial memory image files do not allow us to find the source of the blue screen of death, we will analyze the Complete image or kernel file which contains much more information on the crash that caused the blue screen of death.
via partial memory image files
L’Memory image control utility (Dumpchk.ex) is a command line utility offered by Microsoft to check and Read memory image files.
Unlike other available debugging tools, Dumpchk.Exe does not require access to debugging symbols, which are bulky and which must be downloaded to do a debugging.
Although effective, this tool is not very ergonomic.
This is why we will use the program BluescreenView : He scans all the memory image files created on your computer following a Windows crash, and clearly displays the information they contain.
Now, download and install BlascreenView on your computer, then run it.
In the upper panel, all Memory image files found in the %Systemroot %\ minidump folder as well as the %Systemroot %\ Memory image file.DMP are displayed. In the above capture, six partial memory images are displayed. This means that this computer has encountered the blue screen six times !
For each crash, BluescreenView displays the name of the partial memory image file, the Crash date and time, THE stop code (displayed on the blue screen), the 4 stop code parameters, and the Details on the pilot Who probably caused the crash (file name, product name, file description and file version).
In the lower panel, by default, BluescreenView displays All the pilots who were loaded During the crash (which you have selected in the upper panel). The pilots whose memory address was found in the battery of the crash are highlighted in pink, which makes it easy to locate the pilots who are likely to be responsible for the crash.
Your mission is simple : Locate the pilot responsible for the blue screen in the column “Caused by Driver” !
In the capture below, we see that the crash of August 5, 2013 was caused by the NVLDDMM pilot.SYS which probably turns an NVIDIA graphics card.
If you want to have more details on the detected driver (to which component, device or program it belongs), right click on the memory image file and select Google Search – Bug Check + Driver To start a search on the internet.
Unfortunately, it often happens that partial image files do not contain enough information to be able to identify the pilot responsible for the blue screen.
This is the case if BluescreenView displays ntoskrnl.exe In the column “Caused by Driver”. It’s wrong : this is simply the latest battery file that was loaded before the blue screen appears. This is not the file fatal error.
According to what BluescreenView affects in the column “Cause by Driver”, Apply the following ::
- If BlascreenView displays a file name referring to a component, a device or a program → Apply the specific solutions to a faulty pilot.
- If BluescreenView Poster ntoskrnel.exe → We will have to analyze the complete image file (or nucleus) in order to find the pilot who really caused the blue screen. Go to the following section: Read the full memory or kernel image file.
via the full memory or kernel image file
I Info: The full memory or core image file that we will analyze corresponds to the memory image file of the Last blue screen that appeared on your computer. In other words, this is the more “complete” version of the most recent partial image file displayed in BluescreenView (You can sort partial image files by date by clicking on the “Crash Time” column header).
To analyze the full or kernel image file, we must install the Windows debugurs (Included in Windows SDK).
For this, follow these instructions:
- Download the SDK installation program (Software Development Kit) according to your Windows version.
- Launch on the Windows Dusdk installation program. On the first screen, leave the default location then click on Next.
- Among all the features proposed, install only the debugging tools. Leave Debugging Tools for Windows checked and uncheck all the other boxes, then click on Install.
After installing the debugging tools, you have five removal environments at your disposal (see. Debugging areas for more details) of which Microsoft Windows Debugger (Windbg), A debugger capable of debugging in user mode and kernel mode.
Windbg provides debugging for the Windows kernel, kernel mode drivers and system services, as well as user apps and drivers. This is the one we will use.
I Trick : in order to be able to read the memory image files more easily (.DMG), you can associate them with the Windbg program. To do this, open a command prompt as a administrator and enter the following commands (to be adapted according to your Windows version):
CD "C: \ Program Files (X86) \ Windows Kits \ 10 \ Debuggers \ X64 \" .\ Windbg.Exe -ia- Run Windbg as a administrator: Open the Start menu, enter “Windbg”, right click on Windbg (X64) (Or Windbg (X86) If you use a 32 -bit version of Windows) then select Execute as administrator.
- The Principle window of Windbg debugger opens.
- Specify the location of debugging symbols via Line >Symbol File Path. Symbol files contain a variety of data that is very useful for debugging.
- Enter the next location then click on OK ::
SRV*C: \ Symbolssrvcache*https: // msdl.microsoft.com/download/symbols
Image_name: CPUZ138_x64 Module_Name: CPUZ138_X64 FAULTING Module: FFFFF8004DC30000 CPUZ138_X64 Process_Name: Speccy64.exe
The data interpretation is then quite simple. THE File names implicated make it possible to target the device, the pilot or the program responsible for the blue screen.
If you do not know what it is referring to, you just have to launch a search on the web to get more information on said driver. In the capture above for example, it is the pilot belonging to the CPU-Z program that planted (CPUZ138_X64), a program which was launched by the Speccy software (Speccy64.EXE).
Depending on what you have found in the system image file, apply the following:
- If you have found a file name referring to a device or a program -> Apply the specific solutions to a faulty pilot.
- If you still don’t have nothing found -> Use the Windows driver auditor (to detect defective pilots) or if not, apply general solutions to blue screen errors.
Step 2: solve the blue screen problem
Specific solutions for a faulty pilot
If you followed the previous instructions, you have found the Blue screen pilot.
Now follow the following instructions to definitively correct the problem and put an end to your blue screen problem:
- If the pilot is a program pilot (ex. : CPUZ138_X64.SYS for the CPU-Z program):
- Install a more recent version of the program (go to the publisher’s website or use the integrated automatic update tool);
- Otherwise, temporarily uninstall the program.
- If the pilot is a peripheral pilot (ex. : NVLDDMKM.SYS for an NVIDIA graphics card):
- Update the device driver from the manufacturer’s website;
- Otherwise, restore the previous device pilot: Device manager> Right click on the device> Properties> Pilot tab>Restore the pilot ;
- Otherwise, uninstall the device and delete its driver: Device manager> Right click on the device> Uninstall the device>Remove the pilot for this device + Uninstall.
✓ Congratulations : You have managed to solve Windows Blue Death (BSOD) by updating or uninstalling the program pilot or peripheral implicated ! ��
General solutions
If you have failed to find the blue screen driver, you can follow these qUelques suggestions:
- If you have recently added a device On your computer, check with the manufacturer if fixes are available and install them if this is the case.
- Disconnect any superfluous external peripheral (printer, webcam…) and VéRifie if it solves the blue screen problem.
- If new peripheral pilots or system services have been installed recently, try to delete them or restore old versions of the pilots.
- Think about what has Recently changed in Windows (Installation of a program, new update …), it could be this change that causes fatal error. If you suspect a program, uninstall it.
- Open the peripheral manager to see if peripherals are marked with the exclamation point. Examine the event journal in the properties of the pilot to have more details on the error encountered. Also try to update this pilot.
- Consult the System Journal In the event observer and look if error messages could help identify the device or the pilot that causes the blue screen. You can filter the system newspaper to display only “critical” and “error” events.
- Run the tool Windows memory diagnosis To test the RAM (RAM). Once the test is carried out, use the event observer to display the results (in the system newspaper). Look for the “Memorydiagnostics-Résults” entrance to display the results.
- Check if the new equipment you have installed is Compatible with the Windows version installed.
- Install antivirus software and Launch an antivirus scan. Viruses can infect all types of discs formatted for Windows and the resulting discs can generate fatal errors. Make sure the antivirus software checks if the master boot record is infected.
- Use theDisk verification tool (CHKDSK) To check that the file system is not damaged.
- Use theSystem file verifier tool (SFC) To repair missing or damaged system files.
- Check that there is Sufficient free space on the system reader. The operating system and certain applications require enough free space to create exchange files, and for other functions also. A free space of 10% to 15% is recommended.
- Install the latest Windows updates Via Windows Update.
- Check if the manufacturer of your computer or motherboard offers a UEFI BIOS or firmware update of your system. Also load the default settings of your BIOS/UEFI firmware.
- For office PCs, make sure that all extension cards are properly installed and that all cables are completely connected.
These suggestions are valid for most of the blue screen mistakes.
Here are some examples of stop code that you can meet on Windows:
0x000000D1: Driver_irql_Not_or_Equal 0x0000000a: IRQL_NOT_LESS_EQUAL 0x00000050: page_fault_in_nunped_area 0x000000c2: Bad_pool_caller 0x00000000ed: unmoutable_boot_volume 0x0000001E: kmode_not_ Ndled 0x00000024: ntfs_file_system
Useful links
- Repair Windows Update (failure of updates and errors)
- Srtrail error.TXT during automatic repair of Windows 10
- More sound: solve sound problems in Windows 10
- Error “bootmgr is missing” at start -up: solutions
This article was published for the first time on May 17, 2017 . It was completely revised on November 29, 2021 and updated for the last time on September 4, 2023 .
- troubleshooting
- Blue screen of death
- windows
Open the Windows Device Manager
30.7K Views 1 Comment
Compress and decompress files (ZIP) with Windows
154.1K Views 5 Comments
How to install Windows XP: CD, USB key, SATA disc, Ahci.
229.3K Views 111 Comments
Despite reading the article “The ultimate guide to resolve blue screen mistakes (BSOD) on Windows”, You still have any questions that trot you in your head ? You always have them same problems that at the start ? You are blocked And you don’t know what to do ?
Call on the Crab community by asking your question on the forums !
Ask my question
Hello, I have blue screens with the “Hypervisor_error” stop code since I installed a second screen to my PC, reference: “LC32G5XT”. It happens very irregularly, it can be after 30 minutes like 2 hours after turning on my pc. I followed your instructions and I blocked because I don’t have the file “Memory.DMP “, however I found on the side of the” Minidump “file. I attach the Windbg screenings. In front of Process_Name: Factorygame is the game I used when it happened, but it also happens on other games. I can’t find the line “FAULTING_Module:”. I really don’t understand where the problem comes from. Thank you in advance for your help.
Good morning,
Subject: BSOD in the installation of Win7 RTM 7600 X64 on new HDD
Hardware config:
CM: Asrock M3A770DE
CPU: AMD Phenom II
MEM: Corsair DDR3 1600 MHz 4GB X2
HDD: WD Sata 500 GB
GPU: Asus/NVIDIA EN7300GT 512M
Issue :
Blue screen with restart after decompression of files – Installation of features – Installation of updates.
Completed actions :
Disassembly of HDD – HDD connection to a reception station on another PC – Analysis of HDD files on C: with BluescreenView
After analysis :
The crash would come from DirectX drivers and Nvidia pilots (Dxgkkrnl.SYS – NVLDDMKM.SYS – NVLDDMKM1.SYS)
Question :
How to solve the problem while the bone is not completely installed ?
– Ko safe mode because the installation is not over
– start -up repair cannot solve the problem
What to do for the installation of good drivers ?
In the meantime before I register here, I ordered a new graphics card (the only solution maybe ..?) But if you have another solution I am interested it will only complete my instruction ��
I would come back to post the results when I have tested with the new graphics card .
Sincerely.
Our delicious cookies. ��
You have chosen to refuse cookies: so we cannot display advertisements on the site.
We respect your choice. Note, however, that it is thanks to cookies and advertising that the info crab is completely free.
By accepting cookies, you would help and contribute to free info crab ! ��
If you change your mind and you want to give us a pliers, Click here: I accept cookies ��️
272 active users
Calisto06 has placed a new message in how VPN servers work ? 38 minutes ago
Carbone56 tabled a new message in Fenetre File and Bloc note and Innet Explorer opens up the demand 54 minutes ago
Idreem has created a new subject how VPN servers work ? 1 hour ago
KCSGREG tabled a new message in another loss of performance 2 hours ago
Delta has placed a new message in another loss of performance 2 hours ago
KCSGREG tabled a new message in another loss of performance 2 hours ago
A member has created a new subject of incomplete and non -functional recovery environment. 4 hours ago
Calisto06 has a new message in Windows 10 Installation 4 hours ago
Jamal filed a new comment on the article Professional Office plus 2016 5 hours ago
Marco64 created a new Windows 10 Installation Subject 5 hours ago
Meunier filed a new comment on the Plus 2021 Professional Office article 5 hours ago
Klipoute tabled a new message in Forgrie Excel file password 6 hours ago
Longaripa has placed a new message in several trojans on my pc 6 hours ago
The fishclown has placed a new message in Forgrie Excel file password 6 hours ago
Longaripa has placed a new message in Fenetre File and Bloc Note and Intenet Explorer opens up the demand 6 hours ago
Mateleot tabled a new message in several trojans on my pc 6 hours ago
Totovelo10 has filed a new comment on the VirtualBox article: Install the invited additions 7 hours ago
ED6426 tabled a new message in several trojans on my pc 7 hours ago
ED6426 created a new subject several trojans on my pc 7 hours ago
Tulburite tabled a new message in impossible update 8 hours ago
KCSGREG has placed a new message in still a loss of performance 8 hours ago
Delta tabled a new message in a loss of performance 8 hours ago
Starfox85 created a new update subject impossible 11 hours ago
Carbon56 tabled a new message in Fenetre File and Bloc Note and Innet Explorer opens up the demand 12 hours ago
Klipoute tabled a new message in Forgrie Excel file password 13 hours ago
LONGARIPA has placed a new message in Fenetre File and Bloc note and Innet Explorer opens at the claim 13 hours ago
Branryann has created a new subject problem veracrypt 15 hours ago
Michelet filed a new comment on the article Create a bootable USB key with Rufus 10 hours ago