5. What to Do When a Program Crashes
Error
messages are passé. When a program crashes, Windows doesn't necessarily
tell you that it has crashed. Rather, the program simply t"stops
responding." This means that you can't click any of the controls in its
interface, save your open document, nor (most importantly) close and
reopen it easily. Sure, Windows usually lets you move it around the
screen, and sometimes even click the Close
button, but that's about it. But these are also symptoms of an
application that's simply busy, caught up in the last task you asked it
to perform.
Either
way, triggered by your first attempt to use a crashed or busy program,
Windows turns the whole window a pale version of itself while trying to
communicate with it. If you want to know whether a program has reached
this state without
triggering it with a click, just try moving the mouse over the edges of
the window; if the mouse cursor doesn't change to the familiar "resize"
arrows (and given that it's a resizable window), the program has
probably stopped responding.
So,
how do you tell the difference between a crashed program and a busy
one? Well, Vista can't even do that reliably, instead showing you a
window that looks like the one in Figure 5 when you try to close it. The solution is to be patient and use your best instincts.
But
patience only gets you so far. After waiting an intolerable length of
time, say, three to four seconds, one has to wonder whether the program
will ever start responding. If you're through waiting, you can go ahead
and elect to close the program, a strategy that works some of the time.
If
an application window is visible, it's easy enough to click the small ×
button on the application title bar to close it. But if it's minimized,
or if the main window isn't responding at all, right-click the
program's button on the taskbar and select Close. |
|
If
closing doesn't help, or if, after closing a window, you can't open
another one, then it's time to pay a visit to Task Manager, shown in Figure 6.
There are three ways to start Task Manager:
Taskbar
Right-click an empty area of the taskbar and select Task Manager.
Keyboard
Press the Shift-Ctrl-Esc keys together.
Three-finger salute
If the taskbar and keyboard methods don't work, then Windows itself is crashed or busy. In this case, press Ctrl-Alt-Del to blank the screen and show a special administrative menu, at which point you can click Task Manager to launch it.
Although the Applications tab is inviting and easy to understand, it's not too helpful for this purpose. Choose the Processes tab, turn on the Show processes from all users option at the bottom (if it's there), and then locate the crashed program in the list.
There's
a funky bug in Vista's Task Manager, but fortunately, it's one that's
easy to fix. If your Task Manager appears with no title bar, menu, or
tabs, just double-click the thin gray border around the main list to
bring them back. If that doesn't help, or if your mouse is unavailable,
open the Registry Editor, navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\TaskManager and delete the TaskManager key. |
|
To find the program to close, sort the list. You can sort the list alphabetically by filename (e.g., explorer.exe for Windows Explorer) by clicking the Image NameDescription header. column header. Or, sort by application title by clicking the
But for most hung applications—also known as "frozen" or "locked up"—it'll be most entertaining to sort by exactly how busy the program is. Click the CPU
column header twice (so its little arrow is pointing down) to sort by
processor usage (a percentage from 0 to 99), and the crashed program
will usually leap to the top of the list. For instance, if Windows
Explorer has crashed—unfortunately, such a common occurrence in Vista
that a new term was invented for it—its CPU usage will usually be in the high 80s!
Just highlight the program in the list and click End Process. Only after you do this will you be able to reopen the application.
Vista
comes with another tool you can use to examine the running processes:
just open Windows Defender in Control Panel, click the Tools button at the top of the window, and then click the Software Explorer link. From the Category list, choose Currently Running Programs,
and then select any task in the list to see its details on the right.
It's not as powerful as the Task Manager (it won't let you close
Microsoft applications, for instance), but it does offer more details in
the righthand pane, such as the executable file size, version, and
other details. |
|
5.1. Programs commonly running in the background
Windows
is basically just a collection of components, and at any given time,
some of those components may be loaded into memory and listed as running
processes in Task Manager. In fact, you'll probably see more programs
running than you expected, especially after you turn on Task Manager's Show processes from all users option.
If
you see a program you don't recognize, don't panic; it's not
necessarily malware, but then again, it's not necessary legitimate. See Table 1 for a list of those items commonly found on most Windows Vista systems.
Table 1. Processes you should expect to find running on your system
|
Process
|
Description
|
|---|
|
csrss.exe
|
Called the Client Server Runtime Process, csrss.exe
is an essential Windows component, as it handles the user-mode portion
of the Win32 subsystem. It is also a common target for viruses, so if
this process appears to be consuming a lot of CPU cycles on your system,
you should update and run your antivirus software.
|
|
explorer.exe
|
This is simply Windows Explorer, which is responsible for your
desktop and Start menu. If this program crashes or is closed, Windows
will usually start it again automatically. If you see more than one
instance of explorer.exe, it means that each folder window is being launched as a separate process .
|
|
lsass.exe
|
This is the Local Security Authority subsystem, responsible for authenticating users on your system.
|
|
rundll32.exe
|
This program, the purpose of which is to launch a function in a
DLL as though it were a separate program, is used for about a million
different things in Windows.
|
|
services.exe
|
This is the Windows NT Service Control Manager, and works similarly to svchost.exe, described shortly. The difference is that services.exe runs services that are processes, and svchost.exe runs services that are DLLs.
|
|
smss.exe
|
Called the Windows NT Session Manager, smss.exe is an essential Windows component. Among other things, it runs programs listed in the HKEY_ LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager key in the Registry.
|
|
spoolsv.exe
|
This handles printing and print spooling (queuing).
|
|
svchost.exe
|
This is the application responsible for launching most services (listed in services.msc). See the upcoming "What Is Svchost?" sidebar for details. See also services.exe.
|
|
System
|
This is the System process, an essential Windows component.
|
|
System Idle Process
|
The "idle" process is a 16k loop, used to occupy all CPU
cycles not consumed by other running processes. The higher the number in
the CPU column (99% being the maximum), the less your processor is
being used by the currently running programs.
|
|
winlogon.exe
|
This process manages security-related user interactions, such
as logon and logoff requests, locking or unlocking the machine, changing
the password, and the remote Registry service.
|
|
wmiprvse.exe
|
This is responsible for WMI (Windows Management Instrumentation) support in Windows Vista, also known as WBEM. Like csrss.exe, above, wmiprvse.exe
is a common target for viruses, so if this process appears to be
consuming a lot of CPU cycles on your system, you should update and run
your antivirus software.
|
Naturally,
you shouldn't interfere with the components Windows requires to operate
while you're looking for errant programs or programs you can get along
without. And just because something isn't listed here doesn't mean it
isn't required by your system, so use caution when ending a process with
which you're unfamiliar. |
|
Svchost.exe and services.exe are responsible for launching the processes associated with the behind-the-scenes programs controlled by the Services window (services.msc). A single instance of svchost.exe may be responsible for a single service or several. You should never interfere with any instances of svchost.exe or services.exe
you might see listed in Task Manager. Instead, use the Services window
to start or stop a service or choose whether or not a service is started
automatically when Windows starts. If you're using Windows Vista Professional edition, you can use the TaskList utility (tasklist.exe) to see which services are handled by any given instance of svchost.exe. Just open a Command Prompt window (cmd.exe), and type: tasklist /svc
Then, match up the numbers in the PID column of TaskList's output with those in the PID column of Task Manager's Processes tab. |
5.2. Stop notifying Microsoft
There's
something comforting about Windows inviting you to share details about
your last application crash with Microsoft engineers—people who,
presumably, can use that information to help solve the problem. But if a
warm, fuzzy feeling isn't as high of a priority as getting back to work
after a crash, you may choose to turn off the error reporting feature.
In Control Panel, open the Problem Reports and Solutions page. On the left side, click the Change settings link, and then on the next page, click the Advanced settings link. Finally, on the "Advanced settings for problem reporting" page (Figure 7), select Off, and then click OK.
But
turning off problem reporting doesn't mean you necessarily have to
sever all connections with Microsoft's automated support system, only
that you don't have to do it the instant a program crashes. There's
still a way to get some satisfaction.
Back in the Problem Reports and Solutions page, click the See problems to check link to open a history of unreported application crashes (Figure 8). Here, place a checkmark next to any crash on which you'd like to follow up (or use the Select all option), and then click Check for solutions.
