In The Trenches - Troubleshooting a Blue Screen of Death
Technibble
Shares

In The Trenches – Troubleshooting a Blue Screen of Death

Shares

Today while I was onsite, I came across a laptop that was getting a Blue Screen of Death (BSOD) every single time it started Windows. In this article, I’ll show you how I troubleshooted and solved this particular problem using two past “Repair Tools of the Week”.


When booted, this computer would show the Windows XP logo , show the cursor for a second and then suddenly produced a Blue Screen of Death with the following message:

IRQL_NOT_LESS_OR_EQUAL
STOP: 0x1000000a (0x49df8170, 0x00000002, 0x00000000, 0x804d9afa)

BSOD IRQL_NOT_LESS_OR_EQUAL

In most cases, “IRQL_NOT_LESS_OR_EQUAL” either means an incompatible or corrupt driver or bad RAM. I know this from past experience but don’t be afraid to Google it because you cant remember everything.
I was obviously unable to do anything further now that the computer had BSOD’d so I rebooted it and tried to see whether I could get into safe mode and luckily for me, I could. This strengthened the argument that this blue screen is probably due to a corrupt or incompatible driver since Windows doesn’t load many drivers in Safe Mode and bad RAM would probably continue to cause problems even in Safe Mode.

This job was made a little tougher because due to the maximum resolution of the screen I was working on, the information that tells me what driver caused the blue screen was either cut off or simply not there.

So, I loaded the tool BlueScreenView which we have featured as a Repair Tool of the Week in the past and it showed me all of the previous Windows crash dumps this computer has generated and the information they contain.

BSOD Driver

I chose the most recent crash dump and in the lower pane the application had highlighted the two files that caused the crash. One was “ntoskrnl.exe” which is a key system file. The other one was “w22n51.sys” which is an Intel wireless network driver and is most likely the cause of our problem.

Armed with this new knowledge, I closed BlueScreenView and opened up another tool we have featured here called Autoruns. Autoruns will show the operator all of the files that will start with Windows such as services, applications and of course – drivers.
I went to the “Drivers” tab and scrolled down until found the offending wireless driver and deselected it. This way, it will no longer load when Windows starts and hopefully not cause a blue screen of death.

BSOD Driver

I actually tried to uninstall these Intel wireless drivers from within safe mode using the “Add/Remove Programs” section. However, the uninstaller makes use of the “Windows Installer” service which doesn’t run in safe mode and while you can do a little registry tweak to get it running (which I tried), it still wouldn’t uninstall.

I rebooted into normal Windows and it powered up to the desktop without any problems now that the offending driver no longer loads up. I went back into “Add/Remove Programs” and removed the old drivers in the proper manner (now that I could) and rebooted the computer.

I then visited the laptop manufacturers site using its wired connection and downloaded the latest wireless drivers for the computer which were about 3 years newer than the previous drivers. My guess was that either the driver had become corrupted or a new Windows update was incompatible with it. In either case, reinstalling the drivers should fix the corruption or perhaps the manufacturer has fixed the compatibly problem in the last 3 years..

Once I installed the new drivers, I connected the laptop to the clients wireless network and browsed around a few websites. Everything seemed to work and I rebooted again for good measure (should the current drivers also cause a BSOD) and everything seems to be working fine. I rebooted the computer once more and ran Memtest86 (which is on UBCD) for about 5 minutes to be certain it wasn’t caused by bad RAM. Memtest86+ will read and write to the RAM to find problems and while a proper test should be run for hours, I have found that most RAM that is bad enough to stop Windows from booting will fail the test within the first 5 minutes.

After 5 minutes, I was confident that the issue was definitely the wireless driver and not the RAM.
I was happy, the client was happy, so I got paid and went back to the office. The End.

  • Mitch Jensen says:

    Great story. :D
    It is always nice to see how another tech looks at a problem and resolves it, and what tools were used. It helps to streamline my trouble shooting procedures. Thankx.

  • Jimmy James says:

    Nice tutorial. I do the same thing, except as opposed to safe mode, I use either ERD Commander or msDart

  • Bill Gray says:

    I absolutely love case studies you publish. Wish you would do more (one a week!). They are the most useful tools you create! Thanks. How about doing one where it BSODs in all boot modes (normal, safe, command…). I just had one that was caused by TDSS rootkit. Could not get into the machine AT ALL. Had to pop the HDD out and scan / repair it from another machine and then repair the MBR before it would boot again “at home”. What do you do in those instances?? What tools do you use. I love this site!

  • ralph says:

    i’ve been looking for a tool that reads those errors

  • Mike says:

    Thanks very much for the tut. I know what I”m doing with these, but it can be daunting at times.

  • Angel Galindez says:

    Great read, another blog to grow on. Happy Thanksgiving Bruce!

  • Rodel says:

    thank you again for another input….God bless…

  • Rain says:

    Nice tips, i occasionally check this site for good tips but i propably missed these two programs.
    My question is, what happens when Your computer automatically reboots every time the blue screen is displayed. As far as I remember, that can be disabled in Windows, but, when You cannot access Windows, what then?

    Regards

  • Rain says:

    Adding to previous comment – The computer restarts at blue screen so fast that You cannot read the text neither can You boot into safe mode. Is there a way to still read the error msg?

  • Bryce W says:

    Rain, you can press F8 when the computer first starts up as if you are getting into safe mode. There is an option saying “Disable automatic restart on error” or something to that effect.

    Depending on how the computer is restarting, SOMETIMES this option doesn’t show up and if it doesn’t you can follow these instructions:
    https://www.technibble.com/how-to-disable-automatic-restart-for-bsod-if-you-are-unable-to-get-into-windows/

  • Rain says:

    Although I have used UBCD several times for system32 missing errors and other, I never really took the time to explore the rest of the CD and its possibilities. That registry hack in the other post is a nice tip alongside these little gems.
    Thanks

  • Mathieu Gagnon says:

    one tried to do the same reading Bootlog.txt …

    What a pain it was.

    Thankyou for reporting on this common situation.

  • 02befree says:

    Bravo! Thanks for sharing. There is always more than one way to skin a cat, as my dad says.
    Happy Thanksgiving!

  • max says:

    Brilliant!!

    I learned a lot from this.

    Thank you.

  • Kevin Haag says:

    GREAT READ! And on Thanksgiving Day. Thanks Bruce and Happy Thanksgiving to you! I absolutely love real job scenarios you publish. Wish you would do more. It is good to see how another tech looks at a problem and resolves it, and what tools were used. Showing step by step procedures is great! It sure helps me to streamline my troubleshooting procedures some. I’m always willing to learn to improve myself and to get things done quicker. Thanks!

  • Jeff says:

    Wow Thanks! I really should have checked here yesterday, it would have made my life a lot easier!!

  • Chuck Kennedy says:

    Nice article and demonstration of one of the tech tools you’ve published here before. For alot of my bluescreen problems where I can’t boot into safe mode and use BlueScreenView I check out this website. It has most blue screens with good documentation and quick links on the left and right side:

    http://www.aumha.org/a/stop.htm

  • Emily says:

    Hi there :)

    I downloaded Norton Security 2010 this morn, n once its installed, i restared my comp, n thats when i 1st saw the blue screen of death!

    I uninstalled it ( i saw a Norton which showed todays date of download so i presumed it was NS 2010 ), but now i cant find my orginal Norton software.

    Poof?

  • Jordan says:

    How did you use the USB in safe mode?If you didn’t use USB,how did you get those programs on the comp?

  • Computer Fixer says:

    Hello,

    Had a client computer that was BSOD’ing when they turned it on. I was called in to look at it and the computer was booting fine into Windows XP.

    But just to be safe I opened device manager and found 2 devices that had the Yellow Exclamation marks beside them. One was the onboard NIC and the other was the audio driver.

    I downloaded the updated drivers for these devices, installed them and fixed the issues in Device Manager.

    This apparently cured the BSOD issue, even though it didn’t BSOD for me. I powered the computer off and on (after 15 sec pauses of course) and it was working fine. It still is after a 1 week follow-up with the client.

    I sure wish I’d had Blue Screen Viewer ’cause there’s still a little nagging doubt if it was corrupt device drivers that caused the BSOD in the first place.

    I’m gonna call the client again in a few days to make sure the computer is still working okay, even though they haven’t called me back to complain about their computer.

    Here’s a question… Should I say to myself, job well done? Or is there something else I can do to make sure this computer will continue to run without BSOD? Suggestions??

  • MI Computer Repair says:

    BlueScreenView, eh? I wish I had that out on my call a few hours ago. Funny thing was–I could boot into normal mode but not safe mode. Ended up doing a format :(

  • serg says:

    great story thank you very much for sharing :)

  • Adam says:

    I have a friends computer (Acer Travelmate 4730) and it’s stuck in one of these annoying boot loops, the BIOS was so underfeatured (It’s an acer give it a break ;) ) I didn’t see a restart on hardware failure option. I think I’ll have to take another look and like your problem I’m pretty sure this is either faulty RAM not loading 7 or just corrupted drivers from all the crap on her computer.

    Cheers, Adam.

  • >