The tool you need is called windbg, which you can download as part of the Windows Debugging Tools.
The basic idea, is to take the Memory Dump file (ending in ".dmp") generated during the Blue Screen. To find out where that is, look in:
My Computer -> Properties -> "Advanced" tab -> "Startup and Recovery" Settings -> "Write debugging information" -> Dump file
Run windbg, and open the dump file using
File -> Open Crash Dump (Ctrl-D)
You might want to load symbol files, so that the functions in the call-stack get translated to function-names that you can actually read. You can either download the symbol file for windows (which is something like 300MB) or use the Microsoft symbol server, as described in Mark Russinovich's blog, using this command:
.sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
(Or paste srv*c:\symbols*http://msdl.microsoft.com/download/symbols into "File" -> "Symbol Search Path".)
You then reload the symbols using the command:
.reload
And run analysis on the dump with the command:
!analyze -v
Just look at the stack-trace to get an idea of which function called which function which called the function which crashed the computer. Very often, you'll find it's a out-of-date driver or application.
You might want to read the following articles:
Back to Tech Journal