Although the stability of the Windows 2000/XP system based on the NT architecture has been greatly enhanced, even Windows XP claims to "never crash", but we will still see the blue alarm information shown in Figure 1 from time to time. This is what is commonly said. "Blue screen", what is going on?
a
a map, Windows 2000 /XP outbreak of blue alarm reason
Windows 2000 /XP uses a hierarchical structure, also known as its two layer model, respectively User Mode and Kernel Mode, the application cannot directly access the hardware device, and can only be accessed directly by means of the driver.
However, even if the NT architecture is stable, it may cause some reasons, such as hardware conflicts, hardware problems, registry errors, insufficient virtual memory, loss of dynamic link library files, and exhausted resources. There is an error in the driver or application, and even in the case of a kernel layer. In this case, Windows will abort the system and start a function called KeBugCheck. After checking all the interrupted processing and comparing it with the preset stop code and parameters, the screen will turn blue and display the corresponding Error messages and fault prompts, because of this phenomenon actually means a crash, so often referred to as "Blue Screen of Death" (BSOD), also known as "STOP message" or "stop message."
Second, to understand the hidden information in the blue alarm
Windows 2000 /XP BSOD window and Windows NT4 previous BOSD window is very different, the biggest difference is that NT's BSOD window only includes a general stop The message code, but the BSOD of Windows 2000/XP contains two types of stop messages and hardware messages. The former is the error message generated when an unrecoverable software error is found, and the latter is the error message generated when a serious hardware error is found. .
Although the information in the window of Figure 1 seems complicated, it generally consists of the following three parts:
1. Error message
The content between "*** Stop:" to "****** wdmaud.sys" is a so-called error message, consisting of three parts: error code, custom parameters, error symbols, etc. Composition, the meaning of each part is as follows:
Error code: hexadecimal number after STOP;
Custom parameter: the composition of the error code character, defined by the programmer, the general user is difficult to understand;
Error Symbol: KMODE_EXCEPTION_NOT_HANDLED
After the error symbol, a memory location and file name are also displayed here to know the memory location and source file when the error occurred. For us, the most useful thing is the previous error code information, which will be used when searching the Microsoft Knowledge Base.
Figure 2
2. Recommended Action
This shows the actions and steps taken by the system recommended users, such as uninstalling the program in safe mode, rolling back the driver, updating BiOS, installing patches, etc., but in most cases, you need to restart the system. Consider further operations.
3. Debug Port Information
This will show you how to set up the kernel debugger, including whether the memory dump image has been written to disk and what port is used to complete this debug.
In fact, according to the author's experience, in addition to the error code is more useful in the blue alarm, for the average user, most of the rest of the information does not have much practical significance, just for reference.
In order to debug the system, after the system has a BSOP error, KeBugCheck will automatically generate a debug file named Memory.dmp, which is located in the C:WindowsMinidump folder. By default, the size of the file is Consistent with the system's physical memory capacity, we can compress the file and send it to Microsoft's
Technology
support department to get the corresponding solution, but the file size is so huge, how to send it is a big problem. So few users actually do this.
Tip: Open the "System Properties → Advanced → Startup and Recovery" window, as shown in Figure 2, here you can see the "write debugging information" generation method: small memory dump, core memory dump, Full memory dump, none, based on the above analysis, it is recommended to select "None" here.
Figure III
Third, the blue alarm trilogy
information processing Although Windows 2000 /XP blue alert window displayed may vary, either hardware The reason, either the driver and system compatibility issues, or simply some bugs in the application. First of all, of course, the reason for eliminating the virus, and then we can follow the steps below:
Step 1: Restart the system
When the blue alarm window appears, we should first consider restarting the system, in most cases The problem can be solved by rebooting the system. However, in general, it is not possible to use the "Ctrl+Alt+Del" hot start at this time, but only press the reset button to cold start, or simply restart after powering off.
Figure IV
into the system, "View Control Panel → Administrative Tools → Event Viewer" from or "start → run" box, type "eventvwr.msc" in order to enter the Event Viewer The device interface, as shown in Figure 3, focuses on checking the events in the "System" and "Application" with the type flag "Error" based on the date and time. For example, Figure 4 reports an error that a service failed to start.
Step 2: Revert to the last correct configuration
Windows 2000/XP blue alarm is not for no reason, NT architecture operating system will not be tempered, generally due to updates The device driver or some software is installed, sometimes even the user optimizes the system or deletes some important system files. At this time, you can restart the system and quickly press the F8 key to select the last correct configuration. ", this will restore the valid registry information in the registry HKEY_LOCAL_MacHINESystemCurrentControlSet item, but can not solve the driver or file corruption caused by the error.
Alternatively, you can also try to press the F8 key to select boot to safe mode. If you can enter safe mode normally, it may be a problem with the driver or system service.
Step 3: Query error code
Make a note of the English information in the window of Figure 1, especially the error code "0x0000001E", and then access http from another computer: //support.microsoft.com Site, in the "Search (Knowledge Base)" box in the upper left corner, type "stop ***", where "***" indicates the error code. For the convenience of reading, of course, select "Chinese Knowledge Base", but Many times we are afraid that we can only find the answer in the "English Knowledge Base", or we can search on Google or Baidu.
If the above measures still can not solve the problem, maybe we should consider whether it is a hardware problem, Windows XP can access http://support.microsoft.com/default.ASPx?scid=kb; Cn;314062 View Hardware Compatibility List (HCL), Windows
2000 users can access http://winqual.microsoft.com/download/display.ASP?FileName=
hcl/Win2000HCL.txt to view hardware Compatibility list, then you can consider re-plugging the memory, graphics card, network card, or try to replace them one by one. The more common ones are memory problems or power problems. If this is not enough, I am afraid you can only consider reinstalling the system or Format the hard drive.