How are things at the WoodShop?
The Event Viewer is not the best place to look for clues about a BSOD (sorry Microsoft engaged Support Engineer "experts").
There are some free tools that will give you some clues, but sometimes they are not 100% either so if they don't pan out, you can upload your crash dump files and somebody (it may not be me) can take a look at them.
Here's some ideas to get you started:
Sadly the MS Answers forums does not prompt for any system information when a new question is asked, so we know absolutely nothing about your system.
Not knowing fundamental information about a problem prolongs the frustration and agony of resolving these issues.
Thank you MS Answers, for continuing to make the resolution of simple problems as frustrating and time consuming as possible.
Please provide additional information about your system as best you can:
What is your system make and model?
What is your XP Version and Service Pack?
What is your Internet browser and version?
Does your system have IDE drives or SATA drives?
Describe your current antivirus and anti malware situation: McAfee, Symantec, Norton, Spybot, AVG, Avira!, MSE, Panda, Trend Micro, CA, Defender, ZoneAlarm, PC Tools, Comodo, etc.
Was the issue preceded by a power interruption, aborted restart, or improper shutdown? (this includes plug pulling, power buttons, removing the battery, etc.)?
Does the afflicted system have a working CD/DVD drive (internal or external)?
Do you have a genuine bootable XP installation CD that is the same Service Pack as your installed Service Pack (this is not the same as any Recovery CDs that came with your system)?
What do you see that you don't think you should be seeing and when do you see it?
What do you not see that you think you should be seeing?
If the system used to work properly, what do you think might have changed since the last time it did work properly?
Does your system seem to boot okay and then crash or does it not boot at all?
Can you make the system crash any time you want? For example, would you say that there is any particular system activity that coincides with the crashes (like watching videos, playing games, etc.).
The next time your system crashes, provide more information about what you see.
Here is a BSOD example showing information you need to provide:
http://techrepublic.com.com/i/tr/downloads/images/bsod_a.jpg
Send the information pointed to with the red arrows (3-4 lines total).
Send the entire *** STOP message line since there are clues in the 4 parameters.
If there is a file name listed under the STOP message, be sure to include that information too.
Skip the boring text unless it looks important to you. We know what a BSOD looks like, we need to know what your BSOD looks like.
Now provide more information about your system and information from the most recent crashes.
Click Start, Run and in the box enter:
msinfo32
Click OK, and when the System Summary info appears, click Edit, Select All, Copy and then paste the information back here.
For video driver information, expand the Components, click Display, click Edit, Select All, Copy and then paste the information back here.
There will be some personal information (like System Name and User Name), and whatever appears to be private information to you, just delete it from the pasted information.
This will minimize back and forth Q&A and eliminate guesswork.
Download BlueScreenView from here:
http://www.nirsoft.net/utils/blue_screen_view.html
Unzip and run it (BSV installs nothing) and let it finish scanning all your crash dump files.
If you double click on of the dumps, you will get some information about it (including the Caused By Driver field) and you may be able to spot the problem right away - especially if you see a pattern in the dumps where the Caused by Driver field is the
same (start with that driver).
BlueScreenView tries to locate the right driver or module that caused the blue screen by looking inside the crash stack. However, be aware that the driver detection mechanism is not 100% accurate, and you should also look in the lower pane, that display
all drivers/modules found in the stack.
Sometimes BlueScreenView will implicate XP files as the cause of the crash (ntoskrnl.exe, win32k.sys, hal.dll etc.) but they are probably not the real cause of the crash (BSV does the best it can) and you need to look at some other crash dumps or use the Windows
debugging tools to dig a little deeper into the crash dump to find the real cause.
You would have to either gather up some more example crashes and look through them, or find some where XP files are not the "cause" or you could upload your crash dump files to your
SkyDrive and somebody with the Windows debugging tools can help take a look at them in more detail.
Select (highlight) one or more of the most recent dump files by clicking them and holding down the Ctrl key to select multiples files. Try to select just the most recent ones that relate to your issue (maybe five or so dump files to get started).
Click File, Save Selected Items and save the information from the dumps to a text file on your desktop called BSOD.txt.
Open BSOD.txt with a text editor Notepad, WordPad, etc.), select all the text (Ctrl-A), copy all the text to the Windows clipboard (Ctrl-C) and paste the text from the clipboard (Ctrl-V) back here in your next reply.
Here is an example of the BSV report from a single BSOD that I initiated on purpose that shows the cause of the crash as the i8042prt.sys driver belonging to Microsoft Corporation:
==================================================
Dump File : Mini102911-02.dmp
Crash Time : 10/29/2011 4:54:36 AM
Bug Check String : MANUALLY_INITIATED_CRASH
Bug Check Code : 0x000000e2
Parameter 1 : 0x00000000
Parameter 2 : 0x00000000
Parameter 3 : 0x00000000
Parameter 4 : 0x00000000
Caused By Driver : i8042prt.sys
Caused By Address : i8042prt.sys+27fb
File Description : i8042 Port Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2108)
Processor : 32-bit
Crash Address : ntoskrnl.exe+22f43
Stack Address 1 : i8042prt.sys+27fb
Stack Address 2 : i8042prt.sys+2033
Stack Address 3 : ntoskrnl.exe+6e715
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini102911-02.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 94,208
==================================================
Send the BlueScreenView information from the last 5 memory dumps (if you don't have 5 memory dumps yet, send the most recent ones you have).
While you are waiting, please do this:
Perform some scans for malicious software, then fix any remaining issues:
Download, install, update and do a quick scan with these free malware detection programs (not at the same time):
Malwarebytes (MBAM): http://www.malwarebytes.org/products/malwarebytes_free
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/
SAS will probably report a bunch of tracking cookies and you can just let it delete them.
They can be uninstalled later if desired.
Sometimes it is easiest to just upload the memory dump files from your most recent crashes to your SkyDrive (everybody has a SkyDrive for sharing file). Then somebody that already has the Windows debugging tools can take a closer look at things and figure
out what is going on.
The memory dump files from the recent crashes and BSODs are usually in this folder:
c:\windows\minidump
The files will be named something like this:
Mini120311-01.dmp
You need to upload the most recent ones... maybe 5-10 of the most recent crash dump files ought to be enough if you have that many. If you do not have that many, send what you do have.
Getting started with SkyDrive:
http://explore.live.com/skydrive-get-started
After you get your files uploaded and are looking at them on your SkyDrive, you need to "share" your folders/files so others can see them.
Here is a link that tells you how to do that:
http://explore.live.com/windows-live-skydrive-change-access-permissions-faq
Then choose the "Get a link" button. When you click that, a window will open that contains the link to your SkyDrive files.
Copy the contents of the box "Copy this link to share:" by selecting the link contents (it will all become highlighted), press Ctrl-C (copy) and then come back to the forum and in your next message press Ctrl-V to paste the contents of the link back here.
What you paste back will look something like this link to my SkyDrive:
https://skydrive.live.com/redir.aspx?cid=6a7e789cab1d6f39&resid=6A7E789CAB1D6F39!311