Interpretation of Win 2000/XP blue screen solution practical skills

Although the stability of Windows 2000/XP system based on NT architecture has been greatly enhanced, even Windows XP claims to "never crash", but we will still see the picture from time to time The blue alarm message shown in 1 is what is commonly referred to as “blue screen”. What is going on? First, the reason for the blue alarm of Windows 2000/XP. Windows 2000/XP adopts a layered structure. Its two layers are also called modes, namely User Mode and Kernel Mode. The application is Direct access to hardware devices is only possible with direct access via a driver. However, even if the NT architecture is stable, it may cause drivers or for some reasons, such as hardware conflicts, hardware problems, registry errors, insufficient virtual memory, loss of dynamic link library files, and exhausted resources. The application has an error and even spreads to the kernel layer in severe cases. In this case, Windows will abort the system and start a function called KeBugCheck. After checking all the interrupted processing and comparing it with the preset stop code and parameters, the screen will turn blue and display the corresponding Error messages and fault prompts, because of this phenomenon actually means a crash, so often referred to as "Blue Screen of Death" (BSOD), also known as "STOP information" or "stop information". Second, know the hidden information in the blue alarm Windows 2000/XP BSOD window and Windows NT4 previous BOSD window is very different, the biggest difference is that NT's BSOD window only includes a generic stop message code, but Windows 2000 /XP's BSOD contains two types of stop messages and hardware messages. The former is the error message generated when an unrecoverable software error is found, and the latter is the error message generated when a serious hardware error is found. Although the information in the window of Figure 1 seems complicated, it generally consists of the following three parts: Error message The content between “*** Stop:” to “****** wdmaud.sys” is the so-called error message, consisting of error code, custom parameters, error symbols, etc. Composition, the meaning of each part is as follows: Error code: hexadecimal number after STOP; Custom parameter: the composition of the error code character, defined by the programmer, the general user is difficult to understand; Error symbol: KMODE_EXCEPTION_NOT_HANDLED Behind the error symbol, here It also shows a memory location and file name to understand the memory location and source files when the error occurred. For us, the most useful thing is the previous error code information, which will be used when searching the Microsoft Knowledge Base.

2. Recommended Actions This shows the actions and steps taken by the system recommended users, such as uninstalling the program in safe mode, rolling back the driver, updating the BIOS, installing the patch, etc., but in most cases, you need to restart the system before considering further operating. 3. Debug Port Information This shows how the kernel debugger should be set up, including whether the memory dump image has been written to disk and what port is used to complete this debug. In fact, according to the author's experience, in addition to the error code is more useful in the blue alarm, for the average user, most of the rest of the information does not have much practical significance, just for reference. In order to debug the system, after the BSOP error occurs in the Windows system, KeBugCheck will automatically generate a debug file named Memory.dmp, which is located in the C:WindowsMinidump folder. By default, the file size and system physical memory. The capacity is the same, we can compress the file and send it to Microsoft's technical support department to get the corresponding solution, but the capacity of the file is so huge, how to send is a big problem, so few users really do it. Tip: Open the "System Properties & Rarr; Advanced & Rarr; Startup and Recovery" window, where you can see the "write debugging information" generation method: small memory dump, core memory dump, full memory transfer Storage, no, based on the above analysis, it is recommended to choose here "no".

Third, deal with the blue alarm trilogy Although the blue alarm window of Windows 2000/XP may display different information, or hardware reasons, or driver and system compatibility issues, Or simply some bugs in the application. First of all, of course, the reason for eliminating the virus, and then we can follow the steps below: Step 1: Restart the system When the blue alarm window appears, we should first consider restarting the system, in most cases, the system can be solved after restarting the system. problem. However, in general, it is not possible to pass the "Ctrl+Alt+Del" hot start at this time, but only press the reset button to cold start, or simply restart after power off. When entering the system, from the "Control Panel & Rarr; Management Tools & Rarr; Event Viewer", or in the "Start → Run" box type " eventvwr.msc"" command into the event viewer interface, here according to The date and time focus on the "System" and "Applications" type flags are "Errors" events, such as Figure 4 reports a service startup failure error. Step 2: Revert to the last correct configuration Windows 2000/XP blue alarm is not for no reason, NT architecture operating system will not be tempered, usually due to updated device drivers or installed Some software causes, sometimes even the user optimizes the system or deletes some important system files. At this time, you can restart the system and quickly press the F8 key to select “ the last time correctly configured ” Restores valid registry information for the HKEY_LOCAL_MACHINESystemCurrentControlSet entry in the registry, but does not resolve errors caused by driver or file corruption. Alternatively, you can also try to press the F8 key to select boot to safe mode. If you can enter safe mode normally, it may be a problem with the driver or system service. Step 3: Query the error code Write down the English information, especially the error code of “0x0000001E”, and then access the site from another computer. In the “Search (Knowledge)” box in the upper left corner, type “&ldquo ;stop ***”, here “***” indicates the error code, for the convenience of reading, of course, is to choose "Chinese knowledge base", but many times we may only be in the "English knowledge" The library” can find the answer, or you can search on Google or Baidu. If the above measures still can't solve the problem, maybe we should consider whether it is a hardware problem. Windows XP can access the View Hardware Compatibility List (HCL). Windows 2000 users can access FileName=hcl/Win2000HCL.txt to view the hardware compatibility list, and then You can consider re-plugging the memory, graphics card, network card, or try to replace them one by one. The more common ones are memory problems or power problems. If this is not enough, I am afraid I can only consider reinstalling the system or formatting the hard disk. .