Blue Screen of Death

A blue Stop Error in Windows 7

A Blue Screen in Windows 10

The Blue Screen of Death (BSoD), Blue screen error, Blue Screen, fatal error, or bugcheck, and officially known as a Stop error, is a critical error screen displayed by the Microsoft Windows operating system in the event of a fatal system error. It indicates a system crash, in which the operating system has reached a critical condition where it can no longer operate safely. Possible issues include hardware failure, an issue with or without a device driver, or unexpected termination of a crucial process or thread.

Appearance and name

Crashing Windows 3.1 to Windows 11!

Most stop errors, which are blue screens with white text, are known by their affectionate nickname blue screens or Blue Screen of Death (BSOD). The original stop errors were black, and red stop errors were visible in early builds of Windows Vista after a bootloader error. Stop errors are also referred to as "bug checks" in the Windows Software development kit and Driver development kit documentation.

The color blue was chosen because there was a version of Windows NT for the DEC Alpha platform and there the console colors could not be changed in an easy way. For consistency reasons blue became the color for Stop errors on all platforms (alpha/i386/mips/ppc).

By default, the display is white lettering on a blue (0x01, #0000AA) background, with information about current memory values and register values. For visually impaired users, Microsoft has added a utility that allows the user to change a setting in SYSTEM.INI that controls the colors that the BSOD code uses to any of the 16 EGA colors.

Windows 95, 98 and Me use 80x25 text mode. The Windows NT BSOD uses 80x50 text mode. The screen resolution is 720x400. The XP BSOD uses the Lucida Console font while the Vista BSOD uses the Consolas font.

Occurrences and actions

In Windows NT, Windows 2000, Windows XP, Windows Server 2003 and Windows Vista, a stop error occurs when the kernel or a driver running in kernel mode encounters an error from which it cannot recover. This is usually caused by an illegal operation being performed. The only safe action the operating system can take in this situation is to restart the computer. As a result, data may be lost, as users are not given an opportunity to save data that has not yet been saved to the hard drive.

A BSOD can also be caused by a critical boot loader error, where the operating system is unable to access the boot partition due to incorrect storage drivers or similar problems. The error code in this situation is STOP 0x0000007B (INACCESSIBLE_BOOT_DEVICE). In such cases, there is no memory dump saved. Since the system is unable to boot from the hard drive in this situation, correction of the problem often requires booting from the Microsoft Windows CD. After booting to the CD, it may be possible to correct the problem by performing a repair install or by using the Recovery Console (with CHKDSK).

Embedded systems running Microsoft Windows NT Embedded and Windows XP Embedded have also been known to Bluescreen. These can include are Internet payphones, ATMs and information displays.

On an unpatched Windows 95 or Windows NT 4.0 systems, it is possible for a BSOD to occur as a result of various internet attacks, like WinNuke. An easy way to make BSOD to Occur is to terminate Csrss.exe.

A BSOD can also be caused when you replace files in Resource Hacker with Windows 8, Windows 8.1 and Windows 10 during the startup. This only applies to Windows Vista and Windows 7.

Debugging

Each BSOD usually displays a message such as FILE_SYSTEM as well as a number like 0x00000022. The usual parameters displayed for the BSOD are the following:

number of error (parameter, parameter, parameter, parameter) name of error

By default, Windows will create a memory dump file when a blue screen error occurs. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64 KB "mini dump" to a "complete dump" which is effectively a copy of the entire contents of physical RAM. The resulting memory dump file may be debugged later, using a kernel debugger. A debugger is necessary to obtain a stack trace, and may be required to ascertain the true cause of the problem; as the information onscreen is limited and thus possibly misleading, it may hide the true source of the error.

Microsoft Windows can also be configured to send live debugging information to a kernel debugger running on a separate computer. (Windows XP also allows for kernel debugging from the machine that is running the OS.) If a blue screen error is encountered while a live kernel debugger is attached to the system, Windows will halt execution and cause the debugger to "break in", rather than displaying the BSOD. The debugger can then be used to examine the contents of memory and determine the source of the problem.

The Windows debugger is available as a free download from Microsoft.

Windows includes a feature that can be used to cause a blue screen manually. To enable it, the user must add a value to the Windows registry. After that, a BSOD will appear when the user presses the SCROLL LOCK key twice while holding the right CTRL key. This feature is primarily useful for obtaining a memory dump of the computer while it is in a given state. As such, it is generally used to aid in troubleshooting system hangs.

In Windows XP, a stop error is configured by default to reboot immediately after performing the 64kb minidump. For this reason, the blue stop error screen is only flashed up briefly before the automatic reboot, and this can easily be missed by a user.

History

A blue screen in Windows 1.0/Windows 2.03 filled with random characters due to an incorrect DOS version.

Blue screen errors first appeared in Windows 1.0, where it seemed to be random nonsense. This was because Windows had bugged programming for showing an error for incorrect DOS versions. This resulted in garbage being printed out to the screen.

In 1992, the first true blue screen error appeared in Windows 3.1, which gave out full screen modal messages when attempting to open task manager to take care of an unresponsive program.

In 1993, Windows NT 3.1 released with the first proper blue screen of death, which represented an unrecoverable error in the system that forced it to stop. This blue screen was internally called a "bug check" or "stop error" - but the BSOD title was not used at the time of its release due to it not being a popular OS for home users.

A blue screen in Windows 98.

In 1995, Windows 95 extended the Windows 3.1 style blue screen errors to show when severe system or program errors occurred in Windows. Unlike the Windows NT BSOD, users could continue to run the OS if they wanted without needing to reboot, though there was no guarantee of stability or functionality after one occurred. Confusingly, the error message states to press CTRL+ALT+DEL again regardless if it was actually triggered by pressing the key combo usually used to reboot the PC, likely an artifact of the old task manager mode. The BSOD name started appearing due to the usual occurrence of an unstable or unusable OS when attempting to continue from the blue screen error. Windows 98 and Windows Me used similar error messages, but as the lineage died with Windows Me in 2000, the error message style would not be used again.

Starting in 1999 with Windows 2000, BSODs would become simplified in text and more user oriented text started appearing. Windows 2000 showed general steps to try and correct the issue that caused the BSOD and removed the wall of debugger specific text, while Windows Me changed the 9x style error to mainly state than an error has occurred. In 2001, the BSOD in Windows XP began to put the following sentence first:

A problem has been detected and Windows has been 
shut down to prevent damage to your computer.

In the case of error 0xc000021A, it will display as follows:

STOP: c000021a {Fatal System Error}
The Windows SubSystem system process terminated unexpectedly with a status of 0xc0000005.
The system has been shut down.

With the release of 2012's Windows 8 and Windows Server 2012, the blue screen error changed drastically. It now showed a frowny face emoticon on a cyan screen, and instead of stating steps to repair the issue, it would direct users to visit a website with a minor mention of an error code. In case of error 0xc000021A, the screen will also display the same but with hexadecimal error code instead of error code name.

A black screen in Windows 11 with a troubleshooting QR code.

In 2021, Windows 11 switched the color of the error screen from blue to black. It also provides a QR code referred to as a stopcode to assist in troubleshooting. However, the color of the screen was soon switched back to a darker shade of blue in the update to build 22000.348 and later.

External links

• Troubleshoot blue screen errors at Microsoft Support
  • Resolving stop (blue screen) errors in Windows 7
  • Fix: BSOD (Bluescreen of Death) Errors Windows 10 by Lester at Microsoft Community (2018-09-04)
  • Advanced troubleshooting for Stop error or blue screen error issue at Microsoft Docs (2021-04-13)
• Blue screen of death at Wikipedia