Recommended Free Tools
A Windows stop code (also called a bug check, stop error, kernel error or BSOD) is Windows deliberately halting because continuing could damage data, hardware state or system security. The code narrows the investigation; it is not, by itself, a diagnosis or a universal fix.
Record the exact stop-code name, hexadecimal value, any text after “What failed,” and the four parameters if they are shown. Then work from the least disruptive actions—remove a recent change, use Safe Mode, update or roll back drivers and firmware, and run hardware checks—before analyzing a crash dump.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Microsoft Windows 11 (USB) | $128.99 | Buy on Amazon |
| 2 |
|
Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC |... | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
What a Windows stop code means
During a serious kernel-level fault, Windows cannot safely continue normal execution. It displays a stop screen, writes diagnostic information when configured to do so, and restarts or waits for the user. Microsoft uses several names for the same family of events: bug check, stop error, kernel error, system crash and blue screen of death (BSOD).
The screen may contain three useful clues:
- Symbolic name: a readable label for the bug check.
- Hexadecimal value: the numeric identifier used in logs and debugger output.
- “What failed” module: a driver or other component that was executing when Windows detected the problem, when Windows can identify one.
The named module is a lead, not proof that the file is the root cause. A driver can be blamed because it submitted bad data that originated in firmware, memory, a device or another program. A single stop code can therefore have several possible causes.
#1 Best Overall
- Less chaos, more calm. The refreshed design of Windows 11 enables you to do what you want effortlessly.
- Biometric logins. Encrypted authentication. And, of course, advanced antivirus defenses. Everything you need, plus more, to protect you against the latest cyberthreats.
- Make the most of your screen space with snap layouts, desktops, and seamless redocking.
- Widgets makes staying up-to-date with the content you love and the news you care about, simple.
- Stay in touch with friends and family with Microsoft Teams, which can be seamlessly integrated into your taskbar. (1)
Windows 10 and Windows 11 use the same broad bug-check concepts, although the presentation changes by release. Microsoft says Windows 11 version 24H2 and later may show an unexpected-restart screen with a black background; earlier releases commonly used blue. The color does not change the diagnostic process.
Why a PC blue-screens
Microsoft’s root-cause analysis guidance gives separate estimates rather than one universal percentage: about 70% of analyzed crashes were attributed to third-party driver code, 10% to hardware, 5% to Microsoft code and 15% remained unknown because memory was too corrupted to analyze. A separate Microsoft advanced-troubleshooting section estimates that about 75% of stop errors are caused by faulty drivers. These figures come from different Microsoft guidance and contexts, so they should be read as indicators—not a prediction for your particular computer.
| Possible source | How it can lead to a stop code | Evidence to seek |
|---|---|---|
| Third-party or device driver | A kernel driver accesses invalid memory, mishandles a request or conflicts with another driver. | “What failed” text, a driver update or installation that preceded the crash, dump analysis and Driver Verifier results. |
| Hardware | Defective or overheating memory, storage, a graphics adapter, power delivery or another device returns corrupt data. | Hardware diagnostics, memory-test errors, disk-health warnings, temperature or stability changes. |
| Firmware or BIOS | Low-level firmware does not cooperate with Windows or a newly installed device. | Timing after a BIOS or firmware change, vendor release notes and firmware-update history. |
| Windows or application software | A system component, update or kernel-connected application introduces an incompatibility. | Update history, application or service changes, Event Viewer and the dump stack. |
| Corruption or unknown cause | The crash damages enough memory that the original fault cannot be reconstructed. | Repeated dumps, system-file and storage checks, and whether the pattern changes after rollback. |
What to do immediately after a stop screen
- Capture the evidence. Photograph or transcribe the exact symbolic name, hexadecimal code, “What failed” module and any parameters. A restart can make the message disappear.
- Note the trigger. Write down what was running, whether the PC was waking from sleep, and any hardware, driver, firmware, update or software change made immediately beforehand.
- Disconnect a recent addition. Shut down, unplug a newly added USB device or accessory, remove newly installed hardware where practical, and restart. Do not open a powered system unless you are qualified to do so.
- Use Safe Mode if normal startup fails. Safe Mode loads a minimal driver set, making it easier to undo a change.
- Preserve repeated evidence. If the same code returns, do not keep guessing. Save Event Viewer entries and configure a dump before performing disruptive tests.
Microsoft’s consumer guidance summarizes the likely relationship this way: “A hardware device, its driver, or related software might have caused this error.” That is why the first response tests recent changes and drivers without assuming that the named file alone is defective.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchManual fixes, in the safest order
1. Start Windows in Safe Mode
From the sign-in screen, hold Shift while selecting Power > Restart. At the recovery menu choose Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 for Safe Mode or 5 for Safe Mode with Networking. If Windows will not reach that menu, interrupt startup twice by turning the PC off when the Windows logo appears; the third start should enter Windows Recovery Environment.
In Safe Mode, uninstall a driver or program installed just before the first crash, disconnect the related device, and restart normally. If the crash stops only in Safe Mode, a nonessential driver or service is a stronger suspect. Safe Mode is a diagnostic state, not a permanent performance mode.
2. Undo the most recent change
Open Settings > Windows Update > Update history and review updates installed near the first failure. For a problematic quality update, use Settings > Windows Update > Update history > Uninstall updates when Windows offers that option. For a driver, open Device Manager, expand the relevant category, right-click the device, choose Properties > Driver, and use Roll Back Driver if it is available. Otherwise choose Uninstall device, restart, and install the vendor’s current driver after stability returns.
Do not remove a driver at random. Match the device category to the “What failed” clue and to the change log you made. If a new BIOS or device firmware preceded the crashes, consult that hardware maker’s rollback or recovery procedure rather than forcing an unrelated driver.
3. Install current Windows, driver, BIOS and firmware updates
When the computer is stable enough, select Settings > Windows Update > Check for updates, install pending updates and restart. Then obtain device drivers and BIOS or firmware only from the computer or component manufacturer’s support page, matching the exact model and Windows edition. Update one class of component at a time and restart between major changes so you can identify which change affected the stop code.
If a crash began immediately after an update, first use the rollback path above. “Latest” is not automatically appropriate when a vendor has withdrawn a release or when the model, architecture or firmware revision does not match.
4. Check memory and hardware
Run the built-in memory test by opening Start and typing Windows Memory Diagnostic, selecting Restart now and check for problems, and allowing the test to complete. The result can be reviewed in Event Viewer under Windows Logs > System by searching for the memory-diagnostic event. Any repeatable memory error warrants testing modules individually or using the computer maker’s approved diagnostic and replacement process.
Run the storage and hardware diagnostics supplied by the PC or component manufacturer. Check that the system drive has adequate free space; a nearly full drive can prevent update and dump operations even when it is not the original cause. Remove overclocking, return firmware settings to stable defaults, and verify that cooling vents and fans are unobstructed. Stop using a component that produces hardware errors, unusual heat or repeated data corruption until it has been checked.
5. Inspect Event Viewer
Right-click Start and open Event Viewer. In Windows Logs > System, filter or inspect entries around the crash time. Look for bug-check, unexpected-shutdown, storage, display, device and driver-service events. Event Viewer can expose the bug-check parameters and establish whether a driver loaded, a device disconnected or storage errors appeared immediately before the halt.
Rank #2
- STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
- GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.
Export relevant events with Save Selected Events before clearing logs. Timing matters: an event recorded after the restart may describe the consequence, not the original fault.
6. Try System Restore or recovery options when changes cannot be reversed
If restore points exist, open Windows Recovery Environment > Troubleshoot > Advanced options > System Restore and choose a point dated before the crashes. System Restore changes system files, drivers and settings but normally leaves personal files alone; still, back up important data first. If Windows cannot boot and no restore point helps, use Startup Repair from the same menu. A reset or reinstall is a last resort after copying personal data and confirming that hardware is not failing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to read the crash evidence
The four bug-check parameters
Each bug check has four parameters. They encode details specific to that stop-code family, such as an address, operation type or status value. The same parameter position means different things for different codes, so do not interpret a number with a generic online table. Preserve the values exactly, including leading zeros, and include them when asking for help.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Automatic and complete memory dumps
To retain a dump, open Control Panel > System and Security > System > Advanced system settings. On the Advanced tab select Startup and Recovery > Settings. Under Write debugging information, choose Automatic memory dump for normal troubleshooting. A complete dump contains more memory but requires disk space roughly related to installed RAM; choose it only when you have sufficient space and a reason to capture the full state. Keep Automatically restart enabled for ordinary use, or clear it temporarily if you must read the stop screen.
After the next crash, check the Windows dump location shown in Startup and Recovery, commonly %SystemRoot%Minidump for small dumps or %SystemRoot%MEMORY.DMP for a larger dump. Copy the file before cleanup utilities or storage pressure remove it.
Analyze a dump with WinDbg
Install WinDbg from Microsoft’s current debugging tools distribution, open it, and set Microsoft’s public symbol server in the symbol-path settings. Open the dump file, wait for symbols to load, and run !analyze -v. The output repeats the bug-check code and parameters, proposes a probable cause and shows the call stack. Microsoft Learn’s debugger guidance emphasizes capturing the exact text in the bug-check information section; save the complete command output, not just the first driver name.
Compare several dumps rather than treating one stack frame as conclusive. A driver that appears in every dump is more significant than one that appears once, but hardware corruption can make stacks misleading. Microsoft lists the Advanced Windows Debugging book as a reference for readers who need deeper WinDbg and kernel-debugging instruction; check the current edition and availability before buying.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsUse Driver Verifier only as a controlled advanced test
Driver Verifier can stress selected drivers and expose incorrect behavior that a normal workload misses. It adds overhead and Microsoft warns that it can cause additional crashes, so use it only for suspicious, recently changed, third-party or unsigned drivers, preferably in small groups. Create a restore point or ensure you can enter Safe Mode first.
Open an elevated Command Prompt and run verifier to use the graphical manager. Select standard settings, choose drivers by name rather than verifying everything, and restart. Reproduce the failure, capture the new dump, then return to the Verifier manager and select Delete existing settings. If Windows will not boot, enter Safe Mode and run verifier /reset from an elevated Command Prompt, then restart. Do not leave Verifier enabled after the diagnostic test.
Choosing the next troubleshooting action
| Option | Safety and reversibility | Evidence produced | Skill and disruption |
|---|---|---|---|
| Safe Mode and recent-change rollback | Generally low risk and reversible. | Shows whether a nonessential driver or service is involved. | Consumer-level; limited functionality while enabled. |
| Windows, vendor-driver and firmware updates | Usually routine, but a mismatched firmware update can be serious. | Change timing and version comparison. | Consumer-level; restart required. |
| Memory and hardware diagnostics | Non-destructive when using the manufacturer’s procedure. | Pass/fail results and device health evidence. | Consumer to intermediate; tests can take time. |
| Event Viewer | Read-only inspection if logs are not cleared. | Bug-check details and events surrounding the crash. | Consumer-level, but timing must be interpreted carefully. |
| WinDbg dump analysis | Read-only analysis of a copied dump. | Four parameters, stack, modules and verbose analysis. | Intermediate to advanced; symbols and kernel concepts required. |
| Driver Verifier | Least forgiving; may slow Windows or trigger more crashes. | More targeted driver failures and a new dump. | Advanced; use a small scope and know how to reset it. |
When a stop code needs escalation
A single restart that never repeats can be transient, especially after a one-time device or update event. Escalate your investigation when the same code recurs, several different codes appear, the crash happens during ordinary tasks, memory or storage diagnostics fail, or the machine cannot remain stable long enough to update. At that point, preserve dumps, Event Viewer exports, update history and a timeline of hardware and software changes for the computer maker or a qualified technician.
Do not infer that a stop code proves malware, a failing motherboard or a defective driver. The useful conclusion is narrower: Windows detected a condition unsafe enough to stop, and the captured code and surrounding evidence determine which branch to test next.
Quick Recap
As an optional shortcut after the manual checks, Outbyte PC Repair can look for more than 100 common Windows issues, including broken system elements, invalid redirects and shared DLL problems, while offering settings tweaks, temporary-file cleanup, privacy warnings, vulnerability checks, a real-time boost, file shredding and an app-crash log. It runs on Windows 11, 10, 8 and 7; its free trial lasts at least two days before a subscription. It complements antivirus software rather than replacing it, results vary, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
