Common Stop Messages CHAPTER 32 1603 the recommendations given, request assistance from your hardware manufacturer or a Microsoft support engineer. Stop 0xA or IRQL_NOT_LESS_OR_EQUAL The Stop 0xA message indicates that a kernel-mode process or driver attempted to access a memory location to which it did not have permission or at a kernel IRQL that was too high. A kernel-mode process can access only other processes that have an IRQL lower than or equal to its own. This Stop message is typically the result of faulty or incompatible hardware or software. Interpreting the Message This Stop message has four parameters: 1. Memory address that was improperly referenced 2. IRQL that was required to access the memory 3. Type of access (0x00 = read operation, 0x01 = write operation) 4. Address of the instruction that attempted to reference memory specified in parameter 1 If the last parameter is within the address range of a device driver used on your system, you can determine which device driver was running when the memory access occurred. You can typically determine the driver name by reading the line that begins with **Address 0xZZZZZZZZ has base at <address>- <driver name> If the third parameter is the same as the first parameter, a special condition exists in which a system worker routine—carried out by a worker thread to handle background tasks known as work items—returned at a higher IRQL. In that case, some of the four parameters take on new meanings: 1. Address of the worker routine 2. Kernel IRQL 3. Address of the worker routine 4. Address of the work item Resolving the Problem The following suggestions are specific to Stop 0xA errors. For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later in this chapter. n To resolve an error caused by a faulty device driver, system service, or basic input/output system (BIOS), follow these steps: 1. Restart your computer. 2. Press F8 at the character-based menu that displays the operating system choices. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 32 Troubleshooting Stop Messages 1604 3. Select the Last Known Good Configuration option from the Windows Advanced Options menu. This option is most effective when only one driver or service is added at a time. n To resolve an error caused by an incompatible device driver, system service, virus scanner, or backup tool, follow these steps: 1. Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error. 2. Try disabling memory caching of the BIOS. 3. Run the hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner’s manual for your computer. 4. Make sure the latest Service Pack is installed. 5. If your system has small computer system interface (SCSI) adapters, contact the adapter manufacturer to obtain updated Windows drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination. 6. For integrated device electronics (IDE) devices, define the onboard IDE port as Primary only. Also, check each IDE device for the proper master/subordinate/ stand-alone setting. Try removing all IDE devices except for hard disks. n If you encounter a Stop 0xA message while upgrading to Windows 7, the problem might be due to an incompatible driver, system service, virus scanner, or backup. To avoid problems while upgrading, simplify your hardware configuration and remove all third-party device drivers and system services (including virus scanners) prior to running setup. After you have successfully installed Windows, contact the hardware manufacturer to obtain compatible updates. For more information about simplifying your system for troubleshooting purposes, see Chapter 30. n If the Stop error occurs when resuming from hibernation or suspend, read Knowledge Base articles 941492 at http://support.microsoft.com/kb/941492 and 945577 at http://support.microsoft.com/kb/945577. n If the Stop error occurs when starting a mobile computer that has the lid closed, refer to Knowledge Base article 941507 at http://support.microsoft.com/kb/941507. MoRe inFo For more information about Stop 0xA messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keywords 0x0000000A and 0xA. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Common Stop Messages CHAPTER 32 1605 Stop 0x1E or KMODE_EXCEPTION_NOT_HANDLED The Stop 0x1E message indicates that the Windows kernel detected an illegal or unknown processor instruction. The problems that cause Stop 0x1E messages share similarities with those that generate Stop 0xA errors in that they can be due to invalid memory and access violations. This default Windows error handler typically intercepts these problems if error- handling routines are not present in the code itself. Interpreting the Message This Stop message has four parameters: 1. Exception code that was not handled 2. Address at which the exception occurred 3. Parameter 0 of the exception 4. Parameter 1 of the exception The first parameter identifies the exception generated. Common exception codes include: n 0x80000002: STATUS_DATATYPE_MISALIGNMENT An unaligned data reference was encountered. The trap frame supplies additional information. n 0x80000003: STATUS_BREAKPOINT A breakpoint or ASSERT was encountered when no kernel debugger was attached to the system. n 0xC0000005: STATUS_ACCESS_VIOLATION A memory access violation occurred. Parameter 4 of the Stop error (which is Parameter 1 of the exception) is the address that the driver attempted to access. n 0xC0000044: STATUS_QUOTA_EXCEEDED The text Insufficient Quota Exists To Complete The Operation indicates a pool memory leak. A quota allocation attempt necessary for the system to continue operating normally was unsuccessful because of a program or driver memory leak. The second parameter identifies the address of the module in which the error occurred. Frequently, the address points to an individual driver or faulty hardware named on the third parameter of the Stop message. Make a note of this address and the link date of the driver or image that contains it. The last two Stop message parameters vary, depending on the exception that has occurred. If the error code has no parameters, the last two parameters of the Stop message are listed as 0x00. Resolving the Problem The following suggestions are specific to Stop 0x1E errors. For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later in this chapter. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 32 Troubleshooting Stop Messages 1606 n Stop 0x1E messages typically occur after you install faulty drivers or system services, or they can indicate hardware problems, such as memory and interrupt request (IRQ) conflicts. If a Stop message lists a driver by name, disable, remove, or roll back that driver to correct the problem. If disabling or removing applications and drivers resolves the issue, contact the hardware manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, and CD mastering tools. n If the Stop message mentions the file Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, you might be able to disable it by starting the system in safe mode. If not, use Startup Repair to manually delete the system service file that is causing the problem. For more information about safe mode and Startup Repair, see Chapter 29. n Problems can result from system firmware incompatibilities. You can resolve many Advanced Configuration and Power Interface (ACPI) issues by updating to the latest firmware. n Other possible causes include insufficient disk space while installing applications or performing certain functions that require more memory. You can free up space by deleting unneeded files. Use Disk Cleanup to increase available disk space. For more information about Disk Cleanup, see Chapter 30. n The problem might be due to a memory leak caused by an application or service that is not releasing memory correctly. Poolmon (Poolmon.exe) helps you to isolate the features that are causing kernel memory leaks. For more information about trouble- shooting memory leaks, see Knowledge Base articles 177415, “How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel Mode Memory Leaks,” at http://support.microsoft.com/kb/177415 and 298102, “How to Find Pool Tags That Are Used by Third-Party Drivers,” at http://support.microsoft.com/kb/298102. MoRe inFo To find additional articles, search using the keywords poolmon, pool tag, pooltag, and memory leak. For more information about Stop 0x1E messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keyword 0x1E. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Common Stop Messages CHAPTER 32 1607 diReCt FRoM tHe SoURCe Understanding Kernel Stack Overflows Omer Amin, Escalation Engineer Microsoft Global Escalation Services Team K ernel stack overflows are a common error in many cases reported to us by customers. These are caused by drivers taking up too much space on the kernel stack. This results in a kernel stack overflow, which will then crash the system with one of the following bugchecks: n STOP 0x7F: UNEXPECTED_KERNEL_MODE_TRAP with Parameter 1 set to EXCEPTION_DOUBLE_FAULT, which is caused by running off the end of a kernel stack. n STOP 0x1E: KMODE_EXCEPTION_NOT_HANDLED, 0x7E: SYSTEM_THREAD_ EXCEPTION_NOT_HANDLED, or 0x8E: KERNEL_MODE_EXCEPTION_NOT_ HANDLED, with an exception code of STATUS_ACCESS_VIOLATION, which indicates a memory access violation. n STOP 0x2B: PANIC_STACK_SWITCH, which usually occurs when a kernel-mode driver uses too much stack space. Each thread in the system is allocated with a kernel mode stack. Code running on any kernel-mode thread (whether it is a system thread or a thread created by a driver) uses that thread’s kernel-mode stack unless the code is a deferred procedure call (DPC), in which case it uses the processor’s DPC stack on certain platforms. The stack grows negatively. This means that the beginning (bottom) of the stack has a higher address than the end (top) of the stack. For example, let’s say the beginning of your stack is 0x80f1000, and this is where your stack pointer (ESP) is pointing. If you push a DWORD value onto the stack, its address would be 0x80f0ffc. The next DWORD value would be stored at 0x80f0ff8 and so on up to the limit (top) of the allocated stack. The top of the stack is bordered by a guard page to detect overruns. The size of the kernel-mode stack varies among different hardware platforms. For example, on 32-bit platforms, the kernel-mode stack is 12 KB, and on 64-bit platforms, the kernel-mode stack is 24 KB. The stack sizes are hard limits that are imposed by the system, and all drivers need to use space conservatively so that they can coexist. When we reach the top of the stack, one more push instruction is going to cause an exception, which in turn can lead to a Stop error. This could be either a simple push instruction or something along the lines of a call instruction that also pushes the return address onto the stack. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 32 Troubleshooting Stop Messages 1608 Stop 0x24 or NTFS_FILE_SYSTEM The Stop 0x24 message indicates that a problem occurred within Ntfs.sys, the driver file that allows the system to read and write to NTFS File System (NTFS) drives. A similar Stop message, 0x23, exists for the file allocation table (FAT16 or FAT32) file system. Interpreting the Message This Stop message has four parameters: 1. Source file and line number 2. A non-zero value that contains the address of the exception record (optional) 3. A non-zero value that contains the address of the context record (optional) 4. A non-zero value that contains the address where the original exception occurred (optional) Parameters for this Stop message are useful only to Microsoft technical support with access to Windows source code. Stop messages resulting from file system issues have the source file and the line number within the source file that generated the error encoded in their first parameter. The first four hexadecimal digits (also known as the high 16 bits) after the 0x identify the source file number, and the last four hexadecimal digits (the low 16 bits) identify the source line in the file where the stop occurred. Resolving the Problem The following suggestions are specific to Stop 0x24 errors. For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later in this chapter. n Malfunctioning SCSI and Advanced Technology Attachment (ATA) hardware or drivers can also adversely affect the system’s ability to read and write to disk, causing errors. If using SCSI hard disks, check for cabling and termination problems between the SCSI controller and the disks. Periodically check Event Viewer for error messages related to SCSI or FASTFAT in the System Log or any messages in the Applications And Services Logs\Microsoft\Windows\DiskDiagnostic\Operational log. For more information about troubleshooting SCSI adapters and disks, see Chapter 30. n Verify that the tools you use to continually monitor your system—such as virus scan- ners, backup programs, or disk defragmenters—are compatible with Windows. Some disks and adapters come packaged with diagnostic software that you can use to run hardware tests. For more information, see the documentation for your computer, hard disk, or controller. n Check your hard disk for problems. For more information, see Chapter 30. n Nonpaged pool memory might be depleted, which can cause the system to stop. You can resolve this situation by adding more RAM, which increases the quantity of nonpaged pool memory available to the kernel. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Common Stop Messages CHAPTER 32 1609 MoRe inFo For more information about Stop 0x24 messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keywords 0x00000024 and 0x24. Stop 0x2E or DATA_BUS_ERROR The Stop 0x2E message indicates a system memory parity error. The cause is typically failed or defective RAM (including motherboard, Level 2 (L2) cache, or video memory), incompat- ible or mismatched memory hardware, or a device driver attempting to access an address in the 0x8xxxxxxx range that does not exist (meaning that it does not map to a physical address). A Stop 0x2E message can also indicate hard disk damage caused by viruses or other problems. Interpreting the Message This Stop message has four parameters: 1. Virtual address that caused the fault 2. Physical address that caused the fault 3. Processor status register 4. Faulting instruction register Resolving the Problem The following suggestions are specific to Stop 0x2E errors. For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later in this chapter. n Stop 0x2E is typically the result of defective, malfunctioning, or failed memory hard- ware, such as memory modules, L2 SRAM cache, or video adapter RAM. If you added new hardware recently, remove the hardware and replace it to determine whether it is causing or contributing to the problem. Run Windows Memory Diagnostics as described in Chapter 30 to determine whether the feature has failed. n Stop 0x2E messages can also occur after you install faulty drivers or system services. If a driver file name is given, you need to disable, remove, or roll back that driver. Disable the service or application and confirm that this resolves the error. If so, contact the hardware manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools. n Hard disk corruption can also cause this Stop message. For more information about checking hard disk integrity, see Chapter 30. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 32 Troubleshooting Stop Messages 1610 n The problem might also be due to cracks, scratched traces, or defective features on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing. MoRe inFo For more information about Stop 0x2E messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keywords 0x0000002E and 0x2E. Stop 0x3B or SYSTEM_SERVICE_EXCEPTION The Stop 0x3B message indicates that an exception happened while executing a routine that transitions from nonprivileged code to privileged code. Interpreting the Message This Stop message has three parameters: 1. The exception that caused the bugcheck 2. The address of the exception record for the exception that caused the bugcheck 3. The address of the context record for the exception that caused the bugcheck Resolving the Problem This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code. To resolve the problem, update to the latest driver for your video card. If you currently have the latest version installed, try rolling back to an earlier version. MoRe inFo For more information about Stop 0x3B messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keywords 0x0000003B and 0x3B. Stop 0x3F or NO_MORE_SYSTEM_PTES The Stop 0x3F message indicates one or more of the following problems: n The system Page Table Entries (PTEs) are depleted or fragmented because the system is performing a large number of input/output (I/O) actions. n A faulty device driver is not managing memory properly. n An application, such as a backup program, is improperly allocating large amounts of kernel memory. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Common Stop Messages CHAPTER 32 1611 Interpreting the Message Depending on the configuration of your system, the value of the first parameter might vary. The following are possible values for the first parameter and the information returned: n 0x0A PTE type: 0x00 = system expansion, 0x01 = nonpaged pool expansion n 0x0B Requested size n 0x0C Total free system PTEs n 0x0D Total system PTEs Resolving the Problem The following suggestions are specific to Stop 0x3F errors. For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later in this chapter. n Stop 0x3F messages can occur after you install faulty drivers or system services. If a driver file name is given, you need to disable, remove, or roll back that driver. Disable the service or application and confirm that this resolves the error. If so, contact the hardware manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools. n The system might not actually be out of PTEs, but a contiguous memory block of suf- ficient size may not be available to satisfy a driver or application request. Check for the availability of updated driver or application files and consult the hardware or program documentation for minimum system requirements. A related Stop message, 0xD8: DRIVER_USED_EXCESSIVE_PTES, is described in the section titled “Stop 0xD8 or DRIVER_USED_EXCESSIVE_PTES” later in this chapter. MoRe inFo For more information about Stop 0x3F messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keywords 0x0000003F and 0x3F. Stop 0x50 or PAGE_FAULT_IN_NONPAGED_AREA The Stop 0x50 message indicates that requested data was not in memory. The system generates an exception error when using a reference to an invalid system memory address. Defective memory (including main memory, L2 RAM cache, and video RAM) or incompatible software (including remote control and antivirus software) might cause Stop 0x50 messages. Interpreting the Message This Stop message has four parameters: Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 32 Troubleshooting Stop Messages 1612 1. Memory address that caused the fault 2. Type of access (0x00 = read operation, 0x01 = write operation) 3. If not zero, the instruction address that referenced the address in parameter 0x01 4. This parameter is reserved (set aside for future use) Resolving the Problem The following suggestions are specific to Stop 0x50 errors. For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later in this chapter. n If you added new hardware recently, remove and replace the hardware to determine whether it is causing or contributing to the problem. Run Windows Memory Diagnostics as described in Chapter 30 to determine whether the feature has failed. n Stop 0x50 messages can also occur after you install faulty drivers or system services. If the driver file name is listed, you need to disable, remove, or roll back that driver. If not, disable the recently installed service or application to determine whether this resolves the error. If this does not resolve the problem, contact the hardware manu- facturer for updates. Using updated drivers and software is especially important for network interface cards, video adapters, backup programs, multimedia applications, antivirus scanners, and CD mastering tools. If an updated driver is not available, attempt to use a driver from a similar device in the same family. For example, if printing to a Model 1100C printer causes Stop 0x50 errors, using a printer driver meant for a Model 1100A or Model 1000 might temporarily resolve the problem. n Check your hard disk for problems. For more information, see Chapter 30. MoRe inFo For more information about Stop 0x50 messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keywords 0x00000050 and 0x50. Specifically, refer to Knowledge Base article 938239. Stop 0x77 or KERNEL_STACK_INPAGE_ERROR The Stop 0x77 message indicates that a page of kernel data requested from the paging (virtual memory) file could not be found or read into memory. This Stop message can also indicate disk hardware failure, disk data corruption, or possible virus infection. Interpreting the Message This Stop message has four parameters. The following set of definitions applies only if the first and third parameters are both zero: 1. This value is 0x00 (zero). Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. [...]... Stop 0x 77 messages can also cause Stop 0x7A messages For more information about Stop 0x7A messages, see the following section, “Stop 0x7A or KERNEL_DATA_INPAGE_ERROR.” More Info  For more information about Stop 0x 77 messages, see the Knowledge Base at http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x00000 077 and 0x 77 Stop 0x7A or KERNEL_DATA_INPAGE_ERROR The Stop 0x7A message... Problems that cause Stop 0x7A messages can also cause Stop 0x 77 messages For more information about Stop 0x 77 messages, see the section titled “Stop 0x 77 or KERNEL_STACK_INPAGE_ERROR” earlier in this chapter More Info  For more information about Stop 0x7A messages, see the Knowledge Base at http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x0000007A and 0x7A Common Stop Messages ... to remove this watermark Appendix Accessibility in Windows 7 n Ease of Access Center  16 37 n Windows Speech Recognition  1646 n Assistive Technology Products  1648 n Microsoft Accessibility Resource Centers  1648 n Additional Resources  1649 The Windows 7 operating system improves the accessibility features and programs that were included in the Windows Vista operating system, making it easier than... system resources Resolving the Problem The following suggestions are specific to Stop 0x 77 errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later in this chapter n Stop 0x 77 messages can be caused by bad sectors in the virtual memory paging file or a disk controller error In extremely rare cases, depleted nonpaged pool resources... on www.verypdf.com to remove this watermark 1615 Stop 0x7B or INACCESSIBLE_BOOT_DEVICE The Stop 0x7B message indicates that Windows has lost access to the system partition or boot volume during the startup process Installing incorrect device drivers when installing or upgrading storage adapter hardware typically causes Stop 0x7B errors Stop 0x7B errors could also indicate a possible virus infection... between three modes: docked (existed in Windows XP), full screen, and lens mode (new in Windows 7) n Start On-Screen Keyboard  Opens a visual, on-screen keyboard with all the standard keys that you can use instead of a physical keyboard On-Screen Keyboard lets you type using an alternative input device On-Screen Keyboard also features text prediction (only on the Windows 7 Home Premium Edition operating system... 0x9F messages, see the Knowledge Base at http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x0000009F and 0x9F Specifically, refer to Knowledge Base articles 9 373 22, 941858, 9 373 22, 9 375 00, and 931 671 Stop 0xBE or ATTEMPTED_WRITE_TO_READONLY_MEMORY The Stop 0xBE message indicates that a driver attempted to write to read-only memory Interpreting the Message This Stop message has... chapter n Problems that cause 0x7B errors might also cause Stop 0xED errors For more information about Stop 0xED messages, see the section titled “Stop 0xED or UNMOUNTABLE_ BOOT_VOLUME” later in this chapter More Info  For more information about Stop 0x7B messages, see the Knowledge Base at http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x0000007B, 0x7B, and Txtsetup.oem Specifically,... diagnostic testing n Stop 0x7F messages can occur after you install incompatible applications, drivers, or system services Contact the software manufacturer about possible Windows 7 specific updates Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools More Info  For more information about Stop 0x7F messages, see the Knowledge... controller hardware, defective disk cabling, or two devices attempting to use the same resources Resolving the Problem The following suggestions are specific to Stop 0x7A errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later in this chapter n Stop 0x7A can be caused by bad sectors in the virtual memory paging file, disk controller . Stop 0x 77 messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keywords 0x00000 077 and 0x 77. Stop 0x7A or. cause Stop 0x7A messages can also cause Stop 0x 77 messages. For more information about Stop 0x 77 messages, see the section titled “Stop 0x 77 or KERNEL_STACK_INPAGE_ERROR”