Solve the blue screen trap of Windows 2000/XP

Although the stability of Windows 2000/XP system based on NT architecture has been greatly enhanced, even Windows XP claims to "never crash", but we will still see it as shown in Figure 1. The blue warning message, this is what is commonly called the "blue screen". What is going on?
First, Windows 2000/XP outbreak blue alarm reason

Windows 2000/XP uses a layered structure, its two layers, also known as mode, respectively User mode (User Mode) and kernel Kernel Mode, the application is unable to directly access the hardware device, and can only be accessed directly by means of the driver.

However, even if the NT architecture is stable again, due to some reasons, such as hardware conflicts, hardware problems, registry errors, insufficient virtual memory, dynamic link library file loss, resource exhaustion, etc. This can lead to errors in the driver or application, and even to the kernel layer in severe cases. In this case, Windows will abort the system and start a function called KeBugCheck. After checking all the interrupted processing and comparing it with the preset stop code and parameters, the screen will turn blue and display the corresponding Error messages and fault prompts, because of this phenomenon actually means a crash, so often referred to as "Blue Screen of Death" (BSOD), also known as "STOP message" or "stop message."

Second, know the hidden information in the blue alarm

The Windows 2000/XP BSOD window is very different from the Windows NT4 previous BOSD window, the biggest difference is the NT BSOD window Only one generic stop message code is included, but the BSOD of Windows 2000/XP contains two types of stop messages and hardware messages. The former is an error message that is generated when an unrecoverable software error is found. The latter is a serious hardware found. Error message generated when an error occurs.

Although the information in the window of Figure 1 seems complicated, it generally consists of the following three parts:

1. Error message

The content between "*** Stop:" to "****** wdmaud.sys" is a so-called error message, error code, custom parameter, error symbol The composition of the three parts, the meaning of each part is as follows:

Error code: hexadecimal number after STOP;

Custom parameter: the composition of the error code character, defined by the programmer, generally It is difficult for users to understand;

Error symbol: KMODE_EXCEPTION_NOT_HANDLED

After the error symbol, a memory location and file name are also displayed here to know the memory location and source file when the error occurred. For us, the most useful thing is the previous error code information, which will be used when searching the Microsoft Knowledge Base.

2. Recommended Actions

This shows the actions and steps taken by the system recommended users, such as uninstalling the program in safe mode, rolling back the driver, updating the BIOS, installing the patch, etc., but in most cases it needs to be restarted. The system can only be considered for further operations.

3. Debug Port Information

This will show you how to set up the kernel debugger, including whether the memory dump image has been written to disk and what port is used to complete this debug.

In fact, according to the author's experience, in addition to the error code is more useful in the blue alarm, for the average user, most of the rest of the information does not have much practical significance, just for reference.

In order to debug the system, after the system has a BSOP error, KeBugCheck will automatically generate a debug file named Memory.dmp, which is located in the C:WindowsMinidump folder. By default, this The size of the file is the same as the physical memory capacity of the system. We can compress the file and send it to Microsoft's technical support department to get the corresponding solution, but the file size is so huge. How to send it is a big problem, so it is very Few users really do this.

Tip: Open the "System Properties → Advanced → Startup and Recovery" window, as shown in Figure 2, here you can see the "write debugging information" generation method: small memory dump, core memory Dump, full memory dump, none, based on the above analysis, it is recommended to select "None" here.

Third, the blue alarm processing trilogy

Information Although Windows 2000 /XP blue alert window displayed may vary, or a hardware problem, or a driver with the system Compatibility issues, or simply bugs in the application. First of all, of course, the reason for eliminating the virus, and then we can follow the steps below:

Step 1: Restart the system

When the blue alarm window appears, we should first consider restarting The system, in most cases, can solve the problem after restarting the system. However, in general, it is not possible to use the "Ctrl+Alt+Del" hot start at this time, but only press the reset button to cold start, or simply restart after powering off. When

into the system, from the "Control Panel → Administrative Tools → Event Viewer", or "Start → Run" box type "eventvwr.msc," Event Viewer command to enter the interface shown in Figure 3 Here, depending on the date and time, check the events in the "System" and "Application" whose type flag is "Error". For example, Figure 4 reports that a service failed to start.

Step 2: Restore to the last known good configuration

Windows 2000 /XP is not a reason from a blue alert, NT operating system architecture will not temper tantrums, Usually caused by updating the device driver or installing some software, sometimes even the user optimizes the system or deletes some important system files. At this time, you can restart the system and quickly press the F8 key. Select "Last Known Good Configuration", this will restore the valid registry information of the HKEY_LOCAL_MACHINESystemCurrentControlSet item in the registry, but it will not solve the error caused by the driver or file corruption.

Alternatively, you can also try to press the F8 key to select boot to safe mode. If you can enter safe mode normally, it may be a driver or system service problem.

Step 3: Query the error code

Write down the English information in the window of Figure 1, especially the error code "0x0000001E", and then visit http://from another computer. At the support.microsoft.com site, type "stop ***" in the "Search (Knowledge Base)" box in the upper left corner. Here, "***" indicates the error code. For the convenience of reading, of course, select "Chinese". Knowledge base, but many times we are afraid that we can only find the answer in the English Knowledge Base, or we can search on Google or Baidu.

If the above measures still can not solve the problem, maybe we should consider whether it is a hardware problem, Windows XP can visit http://support.microsoft.com/default.aspx?scid=kb; Cn;314062 View Hardware Compatibility List (HCL), Windows 2000 users can visit http://winqual.microsoft.com/download/display.asp?FileName=hcl/Win2000HCL.txt to view the hardware compatibility list, then consider re-plugging Memory, graphics card, network card, or try to replace one by one, the more common is the memory problem or power problem, if this trick is not enough, I am afraid that you can only consider reinstalling the system or formatting the hard disk.