How to Find BSOD (Blue Screen) Error Messages
his guide will explain how to locate and analyze BSOD error reports. There are 4 places (by default) where Windows presents this information. If you've disabled the Error Reporting Service or the Event Viewer, then I'm afraid that you're just SOL :huh:
The Blue Screen of Death (also known as the BSOD) is a screen that Windows shows you when it shuts down your computer in order to prevent damage to it. It's also known as a STOP error or as a BugCheck Code. It is a hardware error by definition - but this doesn't mean that it's caused by faulty hardware. Viruses, corrupt drivers, and even poorly written programs can cause it.
Here's an example of the screen with some notations on what to look for:
The first place to get the information is from the Blue Screen itself. Write down all of the long numbers, the description that's in all Caps with underscores ( _ ) between the words, and any file names that may be mentioned (be sure to note if there wasn't a filename in your post). A more in depth look at this is included in the second reference ( How To Use The Event Viewer ).
In the event that the BSOD flashes by too fast to read, use the first reference to disable the Automatically Restart function ( How To Disable Automatic Restarts ).
The next place to find the information is in the Event Viewer. Use the mini-guide in the second reference to see how to do this ( How To Use The Event Viewer ).
The last place to find the information is on your hard drive. Search your hard drive for files ending in .dmp and .mdmp. You're looking for the most recent file (or the one closest to the last BSOD that you experienced). Once you find it, use the third reference ( How To Debug Memory Dumps ) to perform an analysis of the memory dump. Be sure to use the !analyze -v command in the bottom of the Debugger's window before closing out your session. Then copy and paste the results into your next post. Someone will have a look at it to see if we can figure out what's gone wrong.
Sometimes, when Error Reporting is enabled, the dump files will be stored temporarily on your system and are erased once the report is sent. To save this info, you'll have to copy the dump file before sending the report. To do this, just click on the "Details" link in the error report and you'll see some file locations listed. Choose the one that ends in .dmp or .mdmp, locate it in Windows Explorer, and copy it to your Desktop (you'll have to enable viewing of hidden files to do this). Here's an example of the Details:
ERROR REPORT CONTENTS Following files will be included in this error report
C:\DOCUME~ 1\Owner\ LOCALS~1\Temp\WER7fde.dir00\Mini112706-02.dmp
C:\DOCUME~1\Owner\LOCALS~1\Temp\WER7fde.dir00\sysdata.xml