
Though it is not exclusive to any particular operating system, the BSOD, or Blue Screen of Death, is a term that has become synonymous with the Windows OS. It usually signifies that your PC has suffered from a critical system error and was forced to shut itself down to prevent damage. Yet, as advanced as technology has grown over the years, engineers have yet to discover a way to present error messages to us in a clear, easily understandable language. Thus, as we begin to be bombarded by these cryptic messages, we often think the situation is hopeless, and we are stuck with a very expensive paper weight. However, this is not the case, and the BSOD can be decrypted. The following instructions will help you understand what is causing your Windows XP system to crash, and from that information, you can determine how to alleviate the problem.
BSOD's are usually caused by bad device drivers or incompatible ".dll" files. One important thing to know about the all elusive Blue Screen of Death, is that when such a system crash occurs, a small file is created. This file is called a minidump or crash dump, and includes information pertaining to why the crash occurred. Not surprisingly, these minidumps are all but illegible. However, there are tools out there that help you analyze the contents and determine the culprit of your crashes. To verify that your PC is set up to save crash dumps, hit up the Control Panel>System>Advanced Tab>Start Up and Recovery>Settings, and refer to the lower third of the window. Take note of the directory location.
A good tool for performing such an analysis, without typing away at the command line, is WinDbg. You can find it as part of the Debugging Tools for Windows. When you first launch WinDbg, you will see a blank window. The first thing to do, is tell it where it can find the symbols needed to decipher the minidump. Go to File>Symbol File Path; copy and paste this path into the text box...
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Select Ok. After that, hit File>Save Workspace, so that you don't have to insert that code every time you fire up WinDbg. To analyze a minidump, go to File>Open Crash Dump, and navigate to the location of your dump files, usually in c:\windows\minidump. The dump files usually contain the date of the crash in the file name, which is quite helpful. Once you have one selected, you will be asked if you want to save the base workspace information, select no. WinDbg will then work its magic and run its analysis. Once complete, the only part you care about is at the end, and should look something like this...
WinDbg will tell you what probably caused the crash. You may not be familiar with what is listed, but a quick Google search should clear up any confusion. In the example above, savonaccesscontrol.sys is listed as the cause of the system crash. A simple search will reveal that this particular file is associated with Sophos Anti-Virus. A basic uninstall and reinstall of Sophos will prevent any further crashes. Another minidump analysis on a different PC revealed that nwfs.sys caused the system to crash. This particular file is related to the Novell Client for Windows, and after searching around, I was able to find and download a Patch Kit that fixed the crashes. If it turns out that a device driver is causing your crashes, you may want to rollback to an earlier version.Now that you possess the knowledge of how to debug a minidump, may you never lose another PC to the dreaded Blue Screen of Death!


