Blue Screen of Death gets makeover for Windows 8 Windows 8 doesn't just put Microsoft's operating system on finger-friendly tablets, it also gives the notorious Blue Screen of Death (BSOD) a touchy makeover. Known officially as a bug check, the BSOD has been overhauled so it can take its place in an age of brevity and emoticons. The Windows 8 BSOD still features the …
IRQL_NOT_LESS_OR_EQUAL
Regularly ... on Windows 7 ... when playing 3D games (especially Brink) using an AMD/ATI Radeon graphics card.
I'm not sure I lay the blame entirely on MSs door though - should have gone with nVidia I fear *sighs*
When I built this PC it had been a really, really long time since I last used an ATI card and I (foolishly) thought they might have sorted out their iffy drivers by now.
They're less common than they used to be, but I still see them from time to time. Usually it's either hardware or ID10T errors. One guy had deleted every dll he could find because he felt they were taking up too much space. That was one of those times when I wished we were allowed to tell someone they aren't allowed to touch a computer ever again.
I build my own computers and install Windows without any of the usual bloatware from SONY or Dell. I also build Xeon based machines using ECC memory. On my lastest machine, running Windows 7, I haven't seen a single crash. I think there are two problems that cause some systems to crash. One is memory errors from non-ECC memory, a growing problem with gigabytes of high density memory. One cosmic ray boring its way through some 32 nm DRAM will flip a lot of bits! There was an internal study at Microsoft some years ago that found that 50% of blue screens were caused by hardware memory parity errors. THe other major cause was device driver bugs, a frustration that Microsoft has gotten some control over in Win7 by sandboxing the drivers (I think they run in in ring 1 instead of ring 0, but I could be wrong about that).
The other reason some people seem to have sick PCs is more nebulous. The typical user downloads a lot of crapware, never defrags their drive, and is careless about security, and at some point they seem to end up with a machine best treated by "Format C:" and starting over.
A monolithic kernel OS, such as Windows 98, Linux, or HP-UX, is the best definition of Legacy I can think of. So Legacy even MS abandoned the concept in '99.
Let me introduce you to my friends, the Pot and The Kettle.
I haven't seen a BSOD for ages either, although here no week passes without a Windows crash or lock-up (not always for the same machine/luser couple of course). Believe me, BSODs are a _good_ thing.
Also, don't forget to wait for the customary minute between shutdown and boot, it really is needed. If you feel it's wasted time you can use it to go get your sysadmin a coffee.
Most are home users, so originals ROFL. Re image, clients will be pissed that they don't have the same layout, they'll happily toddle off down to the shops and buy the latest bargain lappie, that's probably worse spec'd than their original. If I was cynical I'd say that's why MS is doing it. Damn Im going to have to get windows 8 and test this :-(
BSOD stop codes let you zero into the problem quickly.
Never had much luck with the Crash report log, Tend to get lead in the wrong direction, if It can actually save one....
Looking at some of the comments from "power users" on the facebook page made me grin...
"So where do I read the error code?"
"Even less informative than it used to be. Thanks for thinking of the power users Microsoft."
Last time I checked it ends up in Event Viewer, are they really power users? Don't they know that event viewer actually gives more information?
And of the times when you can't get back into windows to read said log, even when the venerable safe mode and "last known good" options result in the stop error?
Tho, usually this can be traced down to an issue with your SATA controller... but still, doesn't help when it's really fubar'd and you can't get in.
For instance, if it is a log file, a Linux live disk will let you access it. If it is something Windows specific, Hirem's boot disk can likely help. Its a Windows XP live cd, allowing you to use tools like regedit and the disk scanning tools, among others.
http://www.hiren.info/pages/bootcd
Just get some decent tools in your kit and a non-booting system won't trouble you so much. Or, you could, I dunno, get an OS that works. http://www.ubuntu.com
> "Last time I checked it ends up in Event Viewer, are they really power users? Don't they know that event viewer actually gives more information?"
Really?
Does this include an error in the file system driver that prevents anything to be written to disk (including updating event log)?
Does this include h/w errors that prevents the file system buffer cache from being flushed, resulting in no data being written to disk (including flushing the I/O buffer for the event log)?
You are making one too many assumption about the usability of the event log to diagnose a h/w crash afterwards.
If windows was still behaving itself to open a file from the filesystem, get the date and time and various other information, write an entry to the file, close the file and make sure that the buffers are flashed and that the filesystem was updated, then there would be no need for BSOD.
The reason that the BSOD is simple text is because it needs very little of the system to do that. Once the system if FKd, you can't do high-level things like fancy graphics and intensive file-system operations.
I see BSODs too often, and there is unsually very little help in logfiles including eventviewer. They are normally caused by code running close to the metal like kernal drivers, and the BSOD is often the first/only clue of where to start looking.
"I see BSODs too often, and there is unsually very little help in logfiles including eventviewer. They are normally caused by code running close to the metal like kernal drivers, and the BSOD is often the first/only clue of where to start looking."
The BSOD is the last place to start looking for clues, Seriously people, have you ever heard of the debugging tools for windows or windbg? couple that with the the necessary symbol files from the microsoft symbol server (google "using the microsoft symbol server" for clues), and it tells you exactly what caused the BSOD, down to the exact file that triggered it. Even on machines that cant boot in to windows proper, you can use windbg in safe mode, if you're clever enough, you can even install windbg in safe mode, whats more, if that dont work you can always use MS DaRT (Diagnostic and Recovery Toolset, formerly known as ERD Commander) crash analyzer. Windows XP saves either the last BSOD as a full memory dump called MEMORY.DMP in c:\windows, or a mini dump of all BSOD's in a folder called.... wait for it.... Minidump, located at c:\windows\minidump. Windows vista and 7 go a step farther and saves both, so you can go back back and examine the complete history of BSOD's
So if anyone is living with random or frequent BSOD's its due to your own ignorance.
The only BSODs I see are photos of screens taken by a scared user.
Every single one of them in the last five years happened during boot, usually due to a failed piece of hardware or a damaged Registry.
That STOP code is the *only* thing I can possibly have to go on. I don't have the computer in front of me, it's the other side of the world.
Go on, try talking your next door neighbour or grandmother through windbg over the phone.
Even if you could do that (hah!) you're still making a whole stack of unwarranted assumptions - the user has internet access to download anything, the computer has a working filesystem, Safe Mode is available, the hardware is not actually F.U.C.T. etc.
That STOP code has almost always told me whether it's corrupted Registry, duff GPU, duff RAM, duff mobo, bad USB device, bad luck etc. It's
Good luck doing *anything* useful without the STOP code and no physical or remote access to the machine.
It's useless. You need a full dump and a program to go through it and a way to get at said full dump on the borked machine.
Alternatively you take a photo of the BSOD with your mobile and hit Google on another machine.
Unless they're planning on adding 'press RETURN for more information' to lead through to the old BSOD they're making a very bad mistake.
"So if anyone is living with random or frequent BSOD's its due to your own ignorance."
I'm down voting you for that, it's not the users fault is some hardware manufacturer can't get their act together and write a decent driver, AND the tools to delete/uninstall it.
I have a lot of music editing software on one of my PCs, I installed a Beringer USB Guitar Link/virtual amp, yeah, I should have known better, the latency of the USB ADC was too high to be of real use, but it turned out that the bloody thing was impossible to uninstall, trying to use add/remove programs either hung the computer or caused a BSOD
Of course I also blame mickeysoft for the laissez faire attitude it has towards allowing 3rd party suppliers install software as part of the OS.
Yes, that will be really useful when you're getting a BSOD any time before you can get into the event viewer, say on boot or at the log-on screen. Oh you've never had that before? ... well maybe some of these "power users" actually have some experience working with windows machines that don't perform flawlessly (like in the real world).
I'm not opposed to the new BSOD but saying these "power users" have no right to be concerned about the changes is not entirely true.
So all the useful information from the BSOD has been removed - that's brilliant. So on the (hopefully) rare instance of your machine going tits and being unbootable, you've got no way to identify the cause?
All well and good hiding the useful information from end lusers, but the option to see detailed error information would be rather helpful to those of us that have to fix broken stuff.
I can't recall the last time I saw BSOD *at work*. At home, my Windows 7 PC threw a few when I installed the XP/Vista-only drivers for my birthday present - a USB recording interface for guitars. Went through uninstall-clean-reinstall cycle, and everything worked fine.
Not sure which is worse, "Blue Screen Of Death", or "Kernel Panic" .....
I take it you've never used !Fresco or !Marcel. Or never experienced a crash due to photodesk horrible virtual memory managment system thereby killing the directory map (FAT) of ADFS.
And contrary to windows (NTFS) there's NO "chkdsk /R" to fix this discmap of an ADFS volume.
There's a good reason why Discknight is/was so successfull.
But yeah, I do sometimes miss the simplicity of RISCOS.
I think the bomb is Atari's TOS, isn't it? Or were that three bombs in succession. I remember a unhappy mac-face on Apple, though.
It was a system error, most prevalent in System 6, and rather unhelpfully, you could not boot System 6 with extensions off (an extwnsion was usually the cause of the crash in the first place.) The best solution was booting from a floppy, dragging extensions out the folder, restarting and replacing one by one to find the culprit. Well, that's what i had to do once, but it was a long time ago.
Ive (only once) actually found the device that was going wrong and known to swap it out from a BSOD, more luck than judgement tho.
and i currently have BSOD screen sht as my screen saver, i love the look on our IT guys faces when it kicks in, makes me smile every time..
i initially thought that BSOD had been removed from vista/Win7 (i thought i read that somewhere), but ive just started getting it in my current windows 7 install recently.
but what it does is BSOD in the night, and in the morning, my pc is just off, and i get an error report, saying i had a BSOD. ive only actually seen it twice from about 30-40 errors.
(ive never had the error in the day, or whilst im working)
i have the purchase order for a new spanky high end laptop going out now, as they cant be arsed to find the error as its out of warrenty, but this quad core, 4gb machine is decent, seems a shame to dump it for lazyness...
signs of the times i guess...
Dont care getting a new spanky laptop - Yay..!
PAGE_FAULT_IN_NON_PAGED_AREA does not mean a problem with hardware.
In fact, very few times is this the case in my experience - it's almost always drivers misbehaving.
All it means is a page fault occurred when a request was made for memory than cannot be paged out, and the page was not resident in RAM.
Replacing the hardware won't fix driver issues.
The bugcheck screen has little of use on it - the event in the event log has the STOP code and 4 parameters which gives just as much information to start troubleshooting.
I'm still amazed at how windows can still come up with "unknown" device detected and not give you any sort of clue as to what type of device it's suddenly discovered (when you haven't installed any new hardware recently) that would give you a clue as to exactly which bit of "unknown hardware" has probably just developed corrupted drivers or gone titsup - thereby enabling you to specifically re-install those drivers or order the replacement part.
I also still don't get how linux can tell you exactly what you have just slotted in (usually including the firmware version etc.) when windows quite often doesn't seem to be able to even tell you what type of device has just been inserted!?!
Of course, I still use windows as well, as I have some rather expensive software which only runs on windows :-(
"Nvidia drivers named as lead Vista crash cause in 2007"
http://www.channelregister.co.uk/2008/03/28/nvidia_vista_drivers/
I can happily say that my current/previous laptops with the Intel crap have been BSOD free for years now. Of course they're not the powerhouses of NVidia or AMD but they do run the games of yesteryear just fine.
And Creative has disappointed me since before Windows 95 with their lack of support or working software.
I have been playing with the dev preview this morning. Initially I was having the same trouble. I was getting a DRIVER IRQL NOT LESS OR EQUAL stop message referencing storachi.sys
It appears that the preview at present doesn't play ball with the VirtualBox SATA controller. If you go into the settings of your created VM, Under storage remove the disk from the SATA controller and re-add it in as an IDE disk that 'may' fix your problem as it did mine.
My Windows 7 install has not shown BSODs yet, neither has my XP install on my decidedly aged laptop done so for years. Having said that, a smiley like that would not go far to improve my temper once it did happen. Seeing one in a demo of a product is perhaps not too odd, as it is probably still in beta. I will give MS the benefit of the doubt here. If the BSOD is not likely to pop up at all in the final product, I don't much care what it looks like.
"Your PC ran into a problem that it couldn't handle, and now it needs to restart. After the restart please click on the resulting link where you can not only fill out another exciting MS survey but you also pre-register for the update to Windows 9 which features an even larger frowny face icon and 15% faster Blue Screens for your convenience. "
"Microsoft. Inconveniencing you just enough to convince you to upgrade every 18 months."
At least with Microsoft the product support/lifetime is half-decent unlike Apple where you have to upgrade to the newest iToy to continue getting software updates which, when they release a phone every year-or-so, could get fairly inconvenient.
Probably a good job in that respect that the Apple fanboys are devoted enough to always buy the latest/greatest.
Mine is the one with anti-Apple propaganda in the jacket pocket...
My Tiger and Snow Leopard systems are still working fine, and there is no real need to upgrade till the hardware dies, which so far has surpassed the life time of the S*nY V**o which managed 2 years.
I can still do all the things I need to do, and for security, well a decent router with third party firmware behind another firewall , plus dpi on the outgoing traffic to sop Om*****e little tricks.
I love fanboize btw, they help fund the development of the closely knit hw/sw that Apple provides as part of the package, and therefore reliability , and I expect to migrate to Clouded Leopard next.
"...I can still do all the things I need to do..."
Thanks to the efforts done by third party developers like Mozilla foundation or Opera. Because the Gestapo... I mean Apple, wants you to upgrade to Snow or Lion to have the latest Safari. Contrary to the Windows version where you still can run the latest one on Windows XP?
Apple fucked up as soon as they started using inferior Intel cpu's in their supposedly superior systems.
...that the lack of information would reall hack off support staff that needed to know WHY Windows fell over in the first place, but then I sat and thought of all those time when, armed with loads of obscure numbers, I couldn't decypher them anyway ... so ... no change there, then.
You'd think I wouldn't get annoyed by idiots like this one -- after all, if I could somehow wave a magic wand and replace all my clients' various Windows installs with whatever happens to be the trendy flavor of Linux, my desktop support business would increase in value by a factor of ten.
To the point mentioned earlier - the lack of error message means less exposure on search engines regarding specific problems therefore centralizing specific knowledge about Windows problems. This is clearly a tactic by Microsoft to enrich their support services -- and by enrich I mean increase revenue.
Actually, Windows Error Reporting (WER) is in-box and through submissions of data relating to app and OS crashes, allows solutions to be provided to end users when they appear - so if you hit a bugcheck typical of, for example, a known nVidia graphics driver issue, you get a URL pointing you to the place you can download a stable version.
Next time you click on "opt out" for any "customer experience program", read what it says and think again ;)
A BSOD is accompanied by either a mini-dump or full memory dump file (user preference) . There is this little known, hard to find, underused tool out there called windbg. It can open the dump files and you can use it to analyze crashes. This does require more skill than just googling a stop code though so maybe not for the average El Reg commentard.
Most of the irql_not_less_or_equal bsod I have seen in the last 2 years have been from applications hitting the 2GB process limit in 32bit systems.
"Most of the irql_not_less_or_equal bsod I have seen in the last 2 years have been from applications hitting the 2GB process limit in 32bit systems."
That would cause a user-mode exception, and not a bugcheck - i.e the application would crash, not the OS.
A bugcheck is an unhandled exception in kernel mode - there are many possible sources of these, only a fraction are hardware and none are caused by user mode (the closest thing would be a user mode call into the kernel which caused a kernel mode driver to have an exception).
You need quite a lot of windows to be up and running to get a log.
wrong HAL
AV has just blasted a virus it found that is required to boot.
inaccessible boot device
But the biggie is in windows you have no guarantee of the order that drivers are loaded (technically they are loaded at different start levels, but that just thins the number you have to sort through). So you need to often offline edit the registry and via trial and error locate the driver that has died.
I regularly deal with PC's with blue screens, rarely do I have the luxury of a Minidump file. And often they're just plain misleading.
Which is useless since the tools necesary to investigate these files are NOT included in Windows by default. You have to squander around in MSDN to find windbg.
Then you still have to know where these dumps resides (Yes, I know they're in windows/minidumps but who else knows that?) and then you have to know what to actually look for or how to properly interpret these files.
This is way too much hassle. Just give on the error screen which goddamn .dll or .sys file generates the fucking error, djeez.
But defintily NOT that crap to search for in online. In most cases you CAN'T even get online when the errors happen. Are they so thick in Redmond? Did they smoke too much pot? Or is it really Jeff Minter who invents these error messages (then I could understand).
Oh please, Don't start! They were as useless as the shitty BSOD's we have in windows.
Djeez, why keep ppl idealising these Amiga's. They were awfull and buggy. In the end I just hated them and went back to my C64 to play games. Luckily someone pointed me towards an Acorn A5000. Now THAT was an amazing system. Fast, stable and the most userfriendly UI that I ever encountered. I just loved RISC OS 3. That was propably my happiest computer experience ever. Things got even better when that magnificent Risc PC came out. Those were the days.
Where's that goddamn Delorean when you need it!
...how *many* oldish desktop scanners simply don't have Win7 drivers (im looking at you, AVISION, AND CANON), their WinXP drivers won't work either in win7, and some fella managed to make *all* of them work in Win 7, just saying "you are installing an unverified/illegal driver continue Y/N" sign when you install his software...
...with features I didn't even know I had on the said scanner, like scanning 2 separate photos at once. Yes double and multi-cropping to me, yay. And no BSOD in miles. Too bad the scanners are not recognized outside his software.
Thank you Mr. Hamrick.
And I managed to just power-sleep my desktop machine, for 2 straight months with no ill effects. Until antivirus demanded a reboot and the flash player splashed their updates all over it. Or the eventual self-reboot with Windows Update in the quiet of night. But no BSODs, or very few, far and between.
Seeing the BSOD out and about always makes me smile, my personal favourites are cash machines and train station information screens. It always looks like an XP screen but I must admit I'm yet to seen the win 7 version and I can't believe companies would use Vista.
Incidentally, does windows phone7 have a BSOD?
Now, I know and realize all too well that Windows is targeted at end users. People who don't really care about all the technical stuff but merely want to use the OS in order to use their computer. Fine.
Yet the more examples they show us the more do I think that they're systematically decreasing functionality in order to make it all "look good" yet totally ignoring that there are also people who don't care about looks but more about functionality.
Plenty of examples so far; the BSOD being a bit extreme, but for a more common one take the new task manager for example...
The current one does it all; at first you get a mere overview of running programs (and their status) while also telling you amount of services, CPU load and memory. Very sparse but all the info you might need at a first glimpse. After that you have tabs for more details; processes, services, load (or something close enough) and so on. If you want to know even more then they added a (IMO) cool feature in Win7: on the "load" tab you have a button "resource control". Sometimes that can be really helpful to check specific loads (like, for example, listing all programs / services which access the network).
In Windows 8 all of that has been dumped together. You go to the task manager and you no longer get that simple straight forward list of programs. Nooo, you get the whole kaboodle at once with "cool" meters and dials and such. Everything separated in sections for you to collapse or fold. And of course partly customizable too!
I already know up front that this is going to s*ck big time (provided that they leave this as-is of course). Why you say? "You can customize it so quit whining; just turn it into something you want and move on!".
Yes but /that/ is just issue... I can customize it, but so can the end users. And if you have to troubleshoot other people's environment then sometimes nothing can be more annoying than having to change a lot of stuff in order to get the information you need.
I don't /want/ to spend 5 minutes tuning the event viewer before it tells me what I want!
And yes; I know we have Powershell which is an awesome admin tool. But that doesn't always weigh up against real-time monitoring, which the event viewer does.
"Real time" troubleshooting is rarely done, and the Event Viewer is not real time - it's showing you the events components elected to record AFTER a problem occurred.
Process Explorer will always be the tool of real time performance troubleshooting, not Task Manager.
Maybe for cursory information the Resource Monitor can give some pointers.
Process Monitor, Performance Monitor & XPerf are the best tools for recording data long-term for analysis - then correlating issues seen against the event logs as appropriate.
Can you still connect a serial console to a machine that has BSODed? I remember part of an MS enterprise course for NT4 we had a section on how to read the BSOD and identify what was wrong. A small part of this section of the course was hooking up a serial console to the BSODed machine, they also showed us how to hook up a machine that MS could dial in to, in order to connect to the failed machine - I'm guessing this service was a tad expensive.
Only if the OS was booted with debug enabled, and the COM port in question configured at the right baud rate - then an external debugger can be connected to review the state of the crashing machine's memory.
Also possible with firewire and USB ports these days - but still needs the target machine to be booted in debug mode first, ready to let the kernel debugger intercept the bugcheck.
This is dubbed "live debugging", as opposed to letting the bugcheck create a complete memory dump to be debugged post-mortem (after the system restarts).
AFAIK, BSODs and kernel panics are the result of hitting assert() statements in kernel code that guard important state variables in kernel space and non-recoverable errors in functions.
That means that any driver (which runs in kernel mode and therefore has full access to the kernel memory address space) with a buffer overflow can cause a panic by simply memcpying too far or doing anything else that can taint the kernel's internal structures.
Of course faulty RAM can also cause this, since it's all about corrupting the kernel memory, but I fail to see how a process could trigger this since it runs in user mode. About usefulness of debug information, if an assertion has been hit in driver code that may be helpful, but if memory has just been overwritten all over the place it won't help much to see what error code you hit, since it's mostly random.
Yes indeed! they got that from a Beatles' record. Fact. It had something to do with the "Paul is a Blue Screen of Death" hoax, where we heard John saying "Please turn me off then on again, dead man". I know some people who have never heard the original think that he says "Turn me on, dead man" but the whole quote is as I've cited it here, "Please turn me off then on again, dead man".
I wonder if they needed to get permission from Paul's estate to use it.
They mean NOTHING to the Great Unwashed who read them.
Oh, right. Before I reboot, I'm really gonna write them down, take a bit of time off work, go to my local compterter store, ask the numpty behind the counter what it means, and, while he/she has thumb in mouth, while fondling ear, looking clueless, I may as well load Vista. It'll take as long. At least as long as to find a new attractive girlfriend in England. (attractive girlfriend/england seem mutually exclusive nowadays)
"It still tells you the error code on the BSOD"
Not it doesn't. Something as generic as the "HAL_INITIALIZATION_ERROR" or "IRQL_NOT_LESS_OR_EQUAL" is absolutely worthless for checking up on on google. On the other hand, surprisingly often there is some information on something like "HAL_INITIALIZATION_ERROR 0xFF34567890". Oh, 0xFF345678*9*0. That mean either a or b is the problem.
Event Log? You know, when a system packs up it usually doesn't write the final log entries -- this is true in Linux too. This is the dark side of write caching 8-)
Other OS's have something similar and indeed its not nice.
IBM (mainframes) at least when this it happens it tells you why and where to find (which manual) is the the wait state code and usually a smallish paragraph on what to do. At least with IBM you need to take a memory dump and restart the system (most often). What is different in most cases from MS is at least 90+ percent of the time IBM will at a later time help you diagnose the problem and most of the time supply either a fix so it won't happen again or with at least enough information that you can figure out why it happened (and it great detail). MS is just Tough S**** reboot and cross your fingers it doesn't happen again. No Problem determination aids no nothing. SO much for MS having reliable systems. In other words you are on your own, go scratch.
How much would a copy of Windows cost if it came with the same kind of tech support that IBM gives its mainframes? And I am pretty sure that you can get support from Microsoft if you are willing to pay for it. Now it is the case that the IBM price is built into the mainframe's purchase price, whereas Microsoft allows you to opt of having to pay for expensive tech support by allowing you to purchase it if you want to.
I think that all in all, Microsoft chose the correct path for an OS meant for home users. (Considering that businesses can either have an IT worker on staff, or call someone who works on an hourly etc retainer.)
Notice that in neither case is does having support available mean that the system is reliable, since reliability would seem to mean that the system does not need servicing in the first place.
Actually, if you think about it, Microsoft comes out ahead, because, as you say, "90+ percent of the time IBM will at a later time help you diagnose the problem and most of the time supply either a fix so it won't happen again or with at least enough information that you can figure out why it happened (and it great detail)." Meaning that you can either wait on IBM to get around to it (and you say 10% of the time even IBM can't work out the problem), or hire someone *right now* - thereby paying a third party for support that you already bought from IBM when you bought the mainframe. With Microsoft, you can just call a tech immediately and if one can't make it over soon enough, call another. You are not paying twice for help with the same problem.
To me your criticism has no validity.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
