Blue screen of death
|
|
The blue screen of death (BSoD) is the screen displayed by Microsoft's Windows operating system when it cannot (or is in danger of being unable to) recover from a system error. There are two Windows error screens that are both referred to as the blue screen of death, with one being significantly more serious than the other.
The blue screen of death in one form or another has been present in all Windows operating systems since Windows version 3.1. It is related to the black screen of death in OS/2. It has been said that in Longhorn it will be complemented with the red screen of death, which will be used for the more serious errors.
| Contents |
Types of blue screens
Windows XP/2000/NT
In Windows NT, Windows 2000, and Windows XP, a blue screen of death (known as a "Stop error" in the Windows NT/2000/XP documentation) occurs when the kernel encounters an error from which it cannot recover. This is usually caused by a driver that throws an unhandled exception or performs an illegal operation. The only action the user can take in this situation is to restart the computer, which results in possible data loss due to Windows not properly shutting down.
The "Stop" message contains the error code and its symbolic name (ex: 0x0000001E, KMODE_EXCEPTION_NOT_HANDLED) along with four error-dependent values in parentheses. It displays the address where the problem occurred, along with the driver in question. Under Windows NT and 2000, the second and third sections of the screen contain information on all loaded drivers and a stack dump, respectively. The driver information is in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a Unix timestamp), and the third lists the name of the driver. (Microsoft et al, 1996)
Windows can be set up to send debugging information through a COM port to a separate kernel debugger. A debugger is necessary to perform a stack trace, as the information onscreen is limited and thus possibly misleading, as it may hide the true source of the error.
In 2003, the people at TweakXP.com [1] (http://www.tweakxp.com) found a "feature" that can be used to manually cause a blue screen. To enable it, the user must add a value to the Windows registry. After that, a BSoD will appear when the user presses the "Scroll Lock" key twice while holding the right Ctrl key. [2] (http://www.tweakxp.com/display.aspx?id=2066)
Windows Me/9x
The blue screen of death also occurs in Microsoft's home desktop operating systems Windows 95, 98, and Me. Here it is less serious, but more common. In these operating systems, the BSoD is the main way for VxDs to report errors to the user. It is internally referred to by the name of "_VWIN32_FaultPopup". A Windows 9x/Me BSoD gives the user the option to either restart or continue. However, VxDs do not display BSoDs frivolously—they usually indicate a problem which cannot be fixed without restarting the computer, and hence after a BSoD is displayed the system is usually unstable or unresponsive.
The most common reason for BSoD'ing is problems with incompatible versions of DLLs. This cause is sometimes referred to as DLL hell. Windows loads these DLLs into memory when they are needed by application programs; if versions are changed, the next time an application loads the DLL it may be different from what the application expects. These incompatibilities increase over time as more new software is installed, and is one of the main reasons why a freshly-installed copy of Windows is more stable than an "old" one.
In Windows 95 and 98, a BSoD occurs when the system attempts to access the file "c:\con\con". This is often inserted on websites to crash user's machines. Microsoft has released a patch for this. [3] (http://www.microsoft.com/technet/security/bulletin/ms00-017.mspx)
The BSOD can appear if a user ejects a removable medium while it is being read on 9x/ME.
This type of blue screen is no longer seen in Windows NT, 2000, and XP. In the case of these less serious software errors, the program may still crash, but it will not take down the entire operating system with it due to better memory management and decreased legacy support. In these systems, the "true" BSoD is seen only in cases where the entire operating system crashes.
Display
By default, the display is white (CGA color 0x0F; HTML color #FFFFFF) lettering on a blue (EGA color 0x01; HTML color #0000AA) background, with information about current memory values and register values. For visually impared users, Microsoft has added a utility that allows the user to change a setting in system.ini that controls the colors that the BSoD code uses to any of the 16 CGA colors.
Windows 95, 98 and Me use 80x25 text mode. The font is similar to Fixedsys. The Windows NT BSoD uses 80x50 text mode. The screen resolution is 720x400. The XP BSoD uses font Lucida Console.
Windows XP
The following is a re-creation of the Windows XP BSoD, although they vary somewhat:
A problem has been detected and Windows has been shut down to prevent damage
to your computer.
PFN_LIST_CORRUPT
If this is the first time you've seen this Stop error screen,
restart your computer. If this screen appears again, follow
these steps:
Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.
If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use Safe Mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.
Technical information:
*** STOP: 0x0000004e (0x00000099, 0x00000000, 0x00000000, 0x00000000)
Beginning dump of physical memory
Physical memory dump complete.
Contact your system administrator or technical support group for further
assistance.
|
Windows NT4/2000
The Windows NT4/2000 BSoD looks like this:
*** STOP: 0x0000000A (0x00000000, 0x00000002, 0x00000000, 8038c510) IRQL_NOT_LESS_OR_EQUAL*** Address 8038c510 has base at 8038c000 - Ntfs.sys CPUID:AuthenticAMD irq1:1f SYSVER 0xf0000565 Dll Base DateStmp - Name Dll Base DateStmp - Name 80100000 336546bf - ntoskrnl.exe 80010000 33247f88 - hal.dll 80000100 334d3a53 - atapi.sys 80007000 33248043 - SCSIPORT.SYS 802ab000 33013e6b - epst.mpd 802b5000 336016a2 - Disk.sys 802b9000 336015af - CLASS2.SYS 8038c000 3356d637 - Ntfs.sys 802bd000 33d844be - Floppy.sys 803e4000 33d84553 - viaide.sys f9328000 31ec6c8d - Siwvid.sys f95c9000 31ec6c99 - Null.SYS f9468000 31ed868b - KSecDD.sys f95cb000 335e60cf - Beep.SYS f9348000 335bc82a - i8024prt.sys f95cb000 3373c39d - ctrl2cap.SYS f947c000 31ec6c94 - kbdclass.sys f9474000 3324806f - mouclass.sys f9370000 33248011 - VIDEOPORT.SYS fe9d7000 3370e7b9 - NDIS.SYS f9480000 31ec6c6d - vga.sys f93b0000 332480dd - Msfs.SYS f90f0000 332480d0 - Npfs.sys fe957000 3356da41 - ati.sys a0000000 335157ac - win32k.sys fe914000 334ea144 - ati.dll fe0c9000 335bd30e - Fastfat.SYS fe110000 31ec6c9b - Parport.SYS fe108000 31ec6c9b - Serial.sys f93b4000 31ec7c9d - ParVdm.SYS f9050000 332480ab - Parallel.sys Address dword dump Build [1314] - Name 801afc24 80149905 80149905 ff8e6b8c 80129c2c ff8e6b94 8025c000 - Ntfs.SYS 801afd24 80129c2c 80129c2c ff8e6b94 00000000 ff8e6b94 80100000 - ntoskrnl.exe 801afd34 801240f2 80124f02 ff8e6cf4 ff8e6d60 ff8e6c58 80100000 - ntoskrnl.exe 801afd54 80124a16 80124a16 ff8e6f60 ff8e6c3c 8015ac7e 80100000 - ntoskrnl.exe 801afd64 8015ac7e 8015ac7e ff8e6cf4 ff8e6f60 ff8e6c58 80100000 - ntoskrnl.exe 801afc70 80129bda 80129bda 00000000 80088000 80106f60 80100000 - ntoskrnl.exe Restart and set the recovery options in the system control panel or the /CRASHDEBUG system start option. If this message reappears, contact your system administrator or technical support group. |
Windows 95/98/Me
The following is a re-creation of a Windows 95/98/Me BSoD:
A fatal exception 0E has occurred at 0157:BF7FF831. The
current application will be terminated.
* Press any key to terminate the current application.
* Press CTRL+ALT+DEL to restart your computer. You will
lose any unsaved information in all applications.
Press any key to continue
|
Blue screens in the IT industry
System administrators often use "to bluescreen" or "to BSoD" (with each letter pronounced individually—that is, "bee-ess-oh-dee") as a verb, as in: "The server just BSoD'd", "Oh, great, it's going to BSoD", or "Windows 2000 doesn't bluescreen as much as NT 4 did." (This usage is unrelated to color key special effects in film, also called bluescreen.)
Embedded systems running Microsoft Windows have also been known to Bluescreen. Typical examples are Internet payphones, automatic teller machines and information displays.
Some BSoDs have been caused by WinNuke, which was a very popular way for script kiddies to attack other people and disconnect computers from their Internet connections and/or cause a BSoD. The vulnerability WinNuke exploits exists only in Windows 95, and Microsoft has released a patch preventing WinNuke attacks.
Well-known references to the blue screen of death
As the BSoD is often subject to jokes and gags, it was also "introduced" to other system platforms as part of screensavers.
Microsoft has also included a reference to the BSoD as an Easter egg in the Internet Explorer browser (versions 4 through 6). Typing "about:mozilla" in the address bar will result in a blank blue page being displayed. The command is the standard way to bring up The Book of Mozilla, another Easter egg on the Netscape/Mozilla family of browsers.
Several online vendors sell blue T-shirts that re-create the BSoD.
In the Xbox video game Halo 2, the Microsoft owned Bungie Studios put in a reference to the BSoD. In the multiplayer map level known as Zanzibar, there is a console that can be used by players to open a near-by gate. Once the console is used, the screen immediately goes to a BSoD-like screen that pokes fun at the true computer error.
Reference
- Microsoft Corp. (1996). Microsoft Windows NT workstation resource kit. 1st ed. Redmond, WA: Microsoft Press.
See also
- Sad Mac — Pre-iMac (Old World ROM) Mac OS equivalent
- Spinning wait cursor or Spinning Beach Ball of Death — similarly-named icon in Mac OS X, that commonly means an application is busy, but can mean a serious error requiring restarting the application or the computer.
- Guru Meditation — Amiga OS equivalent
- Row of Bombs — Atari / Mac OS (old) equivalent
- Kernel panic — Unix variant equivalent
- Red screen of death — The red alternative, rumored to exist in Windows Longhorn
- Yellow screen of death — A screen shown when there is XML parsing error happens in Mozilla browsers.
External links
- "Windows Server 2003 Troubleshooting Stop Errors" - microsoft.com (http://www.microsoft.com/downloads/details.aspx?FamilyID=859637b4-85f1-4215-b7d0-25f32057921c&displaylang=en)
- Troubleshooting Windows STOP Messages (http://aumha.org/win5/kbestop.htm)
- MVP Mark Salloway's Windows XP Resource Center - Introduction to Stop Errors (http://www.mvps.org/marksxp/WindowsXP/bsod.php)
- How to change the color of the BSOD (http://www.everything2.com/index.pl?node_id=653343) on Everything2
- BSoD popping up in odd places (http://zem.squidly.org/bsod/)
- BSoD humor (http://www.netfunny.com/rhf/jokes/99/Oct/bsod.html)
- Screenshots of BSoDs and similar windows problems (http://www.windowscrash.com)
- Blue Screen of Death hits Prague Airport (http://www.theinquirer.net/?article=13280)
- A lot of BSoDs in many different places (http://www.dognoodle99.cjb.net/bsod/)
- BSoD of Windows 98 presented by Bill Gates (http://www.cnn.com/TECH/computing/9804/20/gates.comdex/)
- BSoD Gallery (http://daimyo.org/bsod/)
- Bloopers bedevil Gates at CES (http://zdnet.com.com/1606-2-5517693.html) - BSOD during Bill Gates' keynote address at the 2005 Consumer Electronics Show in Las Vegas (ZDNet, January 7, 2005).
- A BSoD screensaver for Windows (http://www.sysinternals.com/ntw2k/freeware/bluescreensaver.shtml)
- Errorwear, a retailer of BSoD T-Shirts (http://www.errorwear.com/).cs:BSOD
de:Blue_Screen_Of_Death es:Blue screen of death fr:écran bleu de la mort hu:Kék halál nl:Blue Screen of Death fi:BSOD pl:BSOD sv:Blåskärm zh:蓝屏死机