When dealing with the Blue Screen of Death (BSOD) you may encounter some specific stop errors. As it is impossible to discuss each one, let's take a look at some of the more common BSOD stop messages, and how you can correct the problem.

STOP: 0x000000BE ATTEMPTED_WRITE_TO_READONLY_MEMORY

This error indicates that Windows attempted to write information to an area of memory that had been designated as read only. In most cases, this error is caused by a buggy device driver. In fact, the message usually lists the driver that is at fault. If you can identify the buggy driver, then you can boot the system into safe mode and either uninstall the buggy driver, or install a new version.

Although this error is often a result of faulty device drivers, on rare occasions, bad memory or a viral infection can be the root cause.

STOP: 0x0000000A IRQL_NOT_LESS_OR_EQUAL

I have never seen any documentation from Microsoft indicating how frequently this particular error occurs, but I have seen this stop error occur more than any other type of stop error. Unfortunately though, this BSOD stop error also tends to be tricky to troubleshoot.

The error message indicates that one of two things has happened:

1. Either a kernel mode process or a driver have attempted to access an unauthorized memory location, or a kernel mode process or a driver attempted to access an interrupt request level (IRQL) that

1. was too high.
2. Every kernel mode process is assigned an IRQL value. A process is only allowed to access other processes that have an IRQL that is equal to or lower than its own IRQL value.

In the real world, this error can typically be traced to either faulty memory, a buggy device driver, defective or loose hardware or incompatible hardware.

To determine how the error occurred, the first thing you should do is look for a cause and effect relationship. For example, if the problem started occurring after a new driver was installed, then you can be reasonably sure that the driver is the source of the problem. Unfortunately, this relationship isn't always obvious. If you're working with an end-user you must consider that users often lack the skills to identify the cause of such problems.

If you cannot identify the cause, it's time to look at the actual BSOD error message. Specifically, you should look for a line of text that's similar to:

**Address 0x00000000 has base at <address> <driver name>

The last part of this line of text usually tells you which driver was running when the error occurred. The driver may or may not be the culprit, but in any case, it can often yield clues as to the cause of the problem.

Since we know the name of the driver that was running when the problem occurred, the first thing that I like to do is to boot the machine into Safe Mode and reinstall the driver. When I do this, I first replace the current driver with one from a known good source, as the driver that is currently installed might be faulty or corrupted.

More on The Blue Screen of Death error messages: Deciphering the Blue Screen of Death Interpreting the five disk-related Blue Screen of Death errors

If replacing the driver doesn't help, I then open the computer and reseat the memory, and any other devices that might be contributing to the problem. For example, if the BSOD error reports that TCPIP.SYS was running at the time that the error occurred, then that tells me that the error may be related to the machine's network adapter. Therefore, I would reseat the network adapter along with the system's memory.

And if reseating the various components doesn't work, I will start replacing components, beginning with the less expensive ones.. Using our previous example, if the error pointed to TCPIP.SYS, I would replace the network adapter. Only after I have replaced the network adapter would I try replacing the system's memory. And if I'm not 100% sure what the problem is, I usually borrow hardware from another PC until I can confirm the cause of the problem.

If the problem still occurs after replacing the system's memory and any suspect hardware, I will then disassemble and reassemble the PC, to make sure that everything is tight. If the problem persists at this point, there are only two things left to try.

1. Reformat the system and reinstall Windows from scratch.
2. Install a new system board.

If I can find a machine with identical hardware, then I like to remove the hard drive from the machine that has failed and install the drive into an identical machine.

If the surrogate machine is truly identical to the malfunctioning machine, and the BSOD stop error occurs on the surrogate machine, then the problem is related to Windows. This means that it's time to reformat the drive and reinstall Windows. If the problem is resolved after the hard drive transplant, then the problem is hardware-related, and it may be time to replace the system board.

ABOUT THE AUTHOR:

Brien M. Posey, MCSE Brien M. Posey, MCSE, has received Microsoft's Most Valuable Professional Award four times for his work with Windows Server, IIS and Exchange Server. He has served as CIO for a nationwide chain of hospitals and healthcare facilities, and was once a network administrator for Fort Knox. You can visit his personal website at www.brienposey.com.

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.