Blue screen trap for Windows 2000/XP

Although the stability of the Windows 2000/XP system based on the NT architecture has been greatly enhanced, even Windows XP claims to “never crash”, but we will still see the blue alarm information shown in Figure 1 from time to time. It is what is commonly called "blue screen", what is going on?
First, the reason for the blue alarm of Windows 2000/XP
Windows 2000/XP adopts a layered structure, its two layers are also called mode, respectively user mode (User Mode) and kernel mode (Kernel Mode), the application is unable to directly access the hardware device, and can only be accessed directly by means of the driver.
However, even if the NT architecture is stable, it may cause some reasons, such as hardware conflicts, hardware problems, registry errors, insufficient virtual memory, loss of dynamic link library files, and exhausted resources. There is an error in the driver or application, and even in the case of a kernel layer. In this case, Windows will abort the system and start a function called KeBugCheck. After checking all the interrupted processing and comparing it with the preset stop code and parameters, the screen will turn blue and display the corresponding Error messages and fault prompts, because of this phenomenon actually means a crash, so often referred to as "Blue Screen of Death" (BSOD), also known as "STOP information" or "stop information".
Second, know the hidden information in the blue alarm
The BSOD window of Windows 2000/XP is very different from the previous BOSD window of Windows NT4. The biggest difference is that the BSOD window of NT only includes a general stop. The message code, but the BSOD of Windows 2000/XP contains two types of stop messages and hardware messages. The former is the error message generated when an unrecoverable software error is found, and the latter is the error message generated when a serious hardware error is found. .
Although the information in the window of Figure 1 looks complicated, it generally consists of the following three parts:
1. Error message
The content between “*** Stop:” to “****** wdmaud.sys” is the so-called error message, error code, custom parameter, error symbol The composition of the three parts, the meaning of each part is as follows:
Error code: hexadecimal number after STOP;
Custom parameters: the composition of the error code characters, defined by the programmer, the average user is difficult to understand; Br> Error symbol: KMODE_EXCEPTION_NOT_HANDLED
After the error symbol, a memory location and file name are also displayed here to know the memory location and source file when the error occurred. For us, the most useful thing is the previous error code information, which will be used when searching the Microsoft Knowledge Base.
2. Recommended Actions
This shows the actions and steps taken by the system recommended users, such as uninstalling the program in safe mode, rolling back the driver, updating the BIOS, installing patches, etc., but in most cases, you need to restart the system. Consider further operations.
3. Debug Port Information
This shows information about how the kernel debugger should be set up, including whether the memory dump image has been written to disk and what port is used to complete this debug.
In fact, according to the author's experience, in addition to the error code is more useful in the blue alarm, for the average user, most of the rest of the information does not have much practical significance, just for reference.
In order to debug the system, after the system has a BSOP error, KeBugCheck will automatically generate a debug file named Memory.dmp, which is located in the C:WindowsMinidump folder. By default, the size of the file is Consistent with the system's physical memory capacity, we can compress the file and send it to Microsoft's technical support department to get the corresponding solution, but the file size is so huge, how to send is a big problem, so few users Really do this.
Tip: Open the "System Properties & Rarr; Advanced & Rarr; Startup and Recovery" window, as shown in Figure 2, here you can see the "write debugging information" generated by: small memory dump , core memory dump, full memory dump, none, based on the above analysis reasons, it is recommended to select “ no & quoquo; here.
Third, deal with blue alarm trilogy
Although the blue alarm window of Windows 2000/XP may display different information, or hardware reasons, or driver and system compatibility issues, Or simply some bugs in the application. First of all, of course, the reason for eliminating the virus, and then we can follow the steps below:
Step 1: Restart the system
When the blue alarm window appears, the first thing we should consider is to restart the system, in most cases The problem can be solved by rebooting the system. However, in general, it is not possible to pass the "Ctrl+Alt+Del" hot start at this time, but only press the reset button to cold start, or simply restart after power off.
When entering the system, from the "Control Panel & Rarr; Management Tools & Rarr; Event Viewer", or in the "Start & Rarr; Run" box enter the "eventvwr.msc" option to enter the event viewer interface, As shown in Figure 3, here, depending on the date and time, check the "type" in the "System" and "Applications" flag for the event "Error", for example, Figure 4 reports a service startup failure error. .
Step 2: Revert to the last correct configuration
The blue alarm on Windows 2000/XP is not for no reason, the NT architecture operating system will not be tempered, generally due to updates. The device driver or some software is installed, sometimes even the user optimizes the system or deletes some important system files. At this time, you can restart the system and quickly press the F8 key to select “ the last time is correct. Configuration & rdquo; This will restore the valid registry information of the HKEY_LOCAL_MACHINESystemCurrentControlSet item in the registry, but it can not solve the error caused by the driver or file corruption.
Alternatively, you can also try to press the F8 key to select boot to safe mode. If you can enter safe mode normally, it may be a driver or system service problem.
Step 3: Query the error code
Make a note of the English information in the window of Figure 1, especially the error code "<0x0000001E”", then visit http://support.microsoft from another computer. Com site, in the upper left corner of the "search (knowledge base)" box type "“ stop ***”, here “ *** & rdquo; here indicates the error code, for the convenience of reading, of course, of course, choose “Chinese Knowledge Base”, but in many cases we can only find the answer in the “English Knowledge Base” or you can search on Google or Baidu.
If the above measures still can not solve the problem, maybe we should consider whether it is a hardware problem, Windows XP can visit http://support.microsoft.com/default.aspx?scid=kb;zh-cn;314062 View the Hardware Compatibility List (HCL). Windows 2000 users can view the hardware compatibility list at http://winqual.microsoft.com/download/display.asp?FileName=hcl/Win2000HCL.txt, and then consider re-plugging the memory and graphics card. , network card, or use the replacement method to try to replace one by one, the more common is the memory problem or power problem, if this trick is not enough, I am afraid you can only consider reinstalling the system or formatting the hard disk.