STOP errors

From Lunarsoft Wiki
Jump to navigation Jump to search

A STOP error (or bugcheck) is a fatal exception that has been trapped to prevent further compromise/damage to both hardware and software. STOP errors occur in Windows NT-based platforms (such as NT 4.0, Windows 2000, Windows XP, and so on) when there is an unrecoverable fault. The CPU normally handles exception generation, but they can be triggered in software as well. STOP errors always halt execution/the system.

From Microsoft's WinDbg help file:

When Windows encounters hardware problems, inconsistencies within data necessary for its operation, or other severe errors, it shuts down and displays error information on a blue character-mode screen. This shutdown is known variously as a bug check, kernel error, system crash, stop error, or, occasionally, trap. The screen display itself is referred to as a blue screen or stop screen. The most important information shown on the screen is a message code which gives information about the crash; this is known as a bug check code or stop code.

STOP errors with nothing but leading zeros can be abbreviated. Example: 0x00000050 can be written as 0x50 but 0xC0000135 cannot be abbreviated.

Generic solutions

Many STOP error codes have similar solutions or troubleshooting procedures. Wherever possible, the articles below will refer to the following suggestions. The STOP error code list will generally target Windows XP, but many of them are the same or similar to those in Windows NT 4.0, 2000, 2003, and Vista.

Memory test

Faulty memory modules (or improper configurations/timings) are the leading cause of STOP errors. It is advisable to test your memory with the most accurate memory testing utility ever made: memtest86+. Shut down your computer, remove all but one memory module (except in the case of Rambus "RDRAM", which requires module pairs and terminator sticks) and boot the memtest86+ disk/disc. You should allow all 10 tests to pass at least 5 times. If a fault is detected, shut down the computer, replace the memory module with the next one (if applicable), and continue testing. Note: the Microsoft Memory Diagnostic utility is often not extensive or accurate enough, and thus is not recommended.

System Restore

If you've recently installed a device or suspect registry damage, you should invoke the "Last Known Good Configuration" boot option to attempt to revert to your previously working system. This option causes the registry to use a previous version of the HKEY_LOCAL_MACHINE\System\CurrentControlSet registry key. Tap the F8 key before the Windows logo appears when you are first booting your computer, use the arrow keys to highlight "Last Known Good Configuration", and press Enter.

Registry roll-back

The SYSTEM hive, which is located in %systemroot%\system32\config\SYSTEM, is responsible for the entire HKEY_LOCAL_MACHINE\System tree. This is where hardware driver information is stored. If the Last Known Good option fails to solve the issue, it may be possible to revert to a previous SYSTEM hive by taking advantage of the System Volume Information folder. There are many other ways to cause this STOP error, including buggy drivers and damaged memory modules or other hardware.

Safe Mode

In some cases, it may be possible to boot into Safe Mode. To do this, tap the F8 key repeatedly just before the Windows logo appears when you first boot your computer. Highlight "Safe mode" in the list using the arrow keys, and press Enter.

If you are able to login under Safe Mode, there are a number of troubleshooting steps you can perform including using System Restore to roll back the registry to a previous state. This rolls all registry hives back, so recently installed software may no longer function if you choose to do this. It is better to have a technician roll back the SYSTEM hive (or other affected hives) manually using the techniques outlined in the System Volume Information article, to avoid losing software or user setting changes.

If you need to perform a chkdsk to validate the state of the hard drive and filing system, you can do this from Safe Mode via Start -> Run and entering "CMD" to open a Command Prompt. You can then enter "chkdsk <boot_drive>" to check the drive.

Running chkdsk this way forces the initial testing to be done in "Read-Only" mode so that any errors or issues with the drive or filing system can be seen before you run chkdsk /F to fix them. If the errors appear to be serious, numerious or could cause loss of valuable data then you can refer to a Technican for more indepth drive testing or data recovery.

chkdsk /r

Boot your Windows installation media, begin setup, and press R at the first screen to enter Recovery Console. An alternate way to jump straight into Recovery Console is to tap F10 when you see the status message about pressing F6 for mass storage drivers. NOTE: if your mass storage controller is SATA, SCSI, or external EIDE, you may need to press F6 (depending on whether the controller is in INT13/legacy mode or not) to allow Windows Setup to load mass storage device drivers from a floppy diskette so that Recovery Console will be able to see your system drive.

Once you are logged into Recovery Console, type chkdsk /r and press Enter.

If you are unable to log-in to recovery console, try reverting one or more registry hives from a previous backup as outlined in Solution #3. SYSTEM, SAM, and SECURITY, are three hives that should be considered (in that order).

NOTE: chkdsk /r is no longer recommended by me - it can be destructive. I'm writing up a new article now about data recovery which will explain this. For now, I guess you can continue to use chkdsk /r but I don't recommend it. If your drive is failing, clone it with ddrescue (details coming soon) to a known-good drive and then use chkdsk /F on the cloned filesystem.

STOP errors

0x00000050

PAGE_FAULT_IN_NONPAGED_AREA

This bugcheck indicates that invalid memory has been referenced.

This problem is typically caused by one or more faulty memory modules, one or more faulty processors, buggy drivers or kernel-mode services, registry hive corruption, or paging file corruption. Aside from hardware, this usually means there's a hole in the registry.

Parameters

No. Description
1 Memory address referenced
2 0: Read operation
1: Write operation
3 Address that referenced memory (if known)
4 Reserved

Troubleshooting See Generic solutions.

You may also need the assistance of a technician that is able to use a debugger on the crash dump file(s) (typically stored in %Systemroot%\Minidump) in order to determine which driver, service, process, or hardware device is at fault.

0x0000007B

INACCESSIBLE_BOOT_DEVICE

This error is displayed when Windows loads the protected mode device drivers for your IDE/SATA/SCSI/etc controller and the driver is unable to find and control the device that it had just booted from. If the mass storage driver is not the correct one for the selected boot device, or it has recently changed, Windows may be unable to find the boot device.

Parameters

No. Description
1 Address of a UNICODE_STRING structure, or address of the device object that could not be mounted.
2 Reserved
3 Reserved
4 Reserved

Troubleshooting

  • Edit the BOOT.INI file on the boot drive and ensure that the partition(x) and disk(x) numbers are set properly to point to the Windows installation drive. Note that the boot drive containing the ntldr and BOOT.INI files can be different than the drive containing the Windows installation folder. All of the numbers except for partition(x) have a starting index of 0. partition(x) starts at 1. multi(0)disk(0)rdisk(0)partition(1) is the most common ARC path for an x86 architecture machine using a built-in IDE controller with only one partition, with that partition being both the boot and installation partition.
  • Ensure that the proper hard drive controller driver has been installed during Windows setup. In the case of SATA controllers, many motherboard BIOSes have up to three possible modes for the controller to run in: all legacy, non-legacy, and compatible. One or more of these modes may be automatic to your system, and you may or may not be able to select which mode the system runs in.

In all legacy mode, the SATA drive operates as if it were a standard IDE controller. No extended drivers are necessary for Windows to be able to install and properly boot. However, many extended features and capabilities may not be present in this mode. In non-legacy (or SATA) mode, Windows setup will not be able to even detect the drive unless you install the controller's drivers from a floppy disk (or slipstream them into the installation media).

If setup can detect the drive, but after installation you cannot boot to the drive due to STOP 0x7B, you must install the drivers by pressing F6 at the very first prompt when booting the Windows installation media. In compatible mode, the controller switches to whichever mode is most appropriate at the time.

In DOS, it will be in INT13 (legacy) mode. In Windows, if the driver has been installed, it will run in true SATA mode. Otherwise, it will run in INT13 mode even in Windows. If this mode has been changed in the BIOS since Windows was first installed, STOP 0x7B is quite likely to occur.

Check your BIOS settings for references to ACPI/APIC Support which may appear on PCs with multiple processors or cores such as Intel Pentium 4 based systems.

If this BIOS setting is altered post-installation of Windows 2000/XP, then your system may not boot correctly. This is due to difference in HAL (Hardware Abstracton Layer).

The solution is to change this BIOS setting back to the setting which was used when Windows was installed, or prepare to reinstall Windows completely because of the new setting.

Alternatively, if the mass storage device driver is functioning properly but ntldr is unable to read critical portions of your filesystem, this STOP error is likely. Try generic solution #5 to read about using chkdsk.

See also:

0x0000008E

KERNEL_MODE_EXCEPTION_NOT_HANDLED

A kernel-mode application (driver or kernel service) has thrown an exception that no handler was available to catch. In kernel-mode, unhandled exceptions are fatal, so the operating system must halt.

Parameters

No. Description
1 The exception code that was not handled - see next table.
2 The address where the exception occurred.
3 The trap frame.
4 Reserved

Common exception codes

No. Description
0x80000002 STATUS_DATATYPE_MISALIGNMENT indicates that an unaligned data reference was encountered.
0x80000003 STATUS_BREAKPOINT indicates that a breakpoint or ASSERT was encountered when no kernel debugger was attached to the system to handle it.
0xC0000005 STATUS_ACCESS_VIOLATION indicates that a memory access violation occurred, such as reading from or writing to non-existent or non-paged memory.

0x0000009C

MACHINE_CHECK_EXCEPTION

The Machine Check Exception and Machine Check Architecture features in modern Intel® Pentium® processors are used to detect and report advanced information in the case of a specific hardware failure event. This low level feature allows the processor to halt the system in the event that the processor detects a problem between the processor and the system's buses/pipelines.

Common causes of MCE events are faulty/underpowered power supplies, faulty processor, faulty motherboard, bugs in the CPU microcode (at which point you would want to get a BIOS update), or memory errors.

Parameters The four parameters listed in the message have different meanings, depending on the processor type.

If the processor is based on an older x86 architecture (that has the Machine Check Exception (MCE) feature but not the Machine Check Architecture (MCA) feature, for example, the Intel Pentium processor) the parameters have the following meaning:

No. Description
1 The low 32 bits of P5_MC_TYPE Machine Service Report (MSR).
2 The address of the MCA_EXCEPTION structure.
3 The high 32 bits of P5_MC_ADDR MSR.
4 The low 32 bits of P5_MC_ADDR MSR.

If the processor is based on a newer x86 architecture (that has the MCA feature in addition to the MCE feature, for example, any Intel Processor of family 6 or higher (Pentium Pro, Pentium IV, or Xeon)), or if it is an x64 processor, then the parameters have the following meaning:

No. Description
1 The bank number.
2 The address of the MCA_EXCEPTION structure.
3 The high 32 bits of MCi_STATUS MSR for the MCA bank that had the error.
4 The low 32 bits of MCi_STATUS MSR for the MCA bank that had the error.

See also:

0x000000C2

BAD_POOL_CALLER An invalid pool request has been made by the current thread.

BAD_POOL_CALLER is generally cased by a faulty hardware device (though it could be a faulty driver, just like any other STOP code). Begin by removing expansion cards (PCI, ISA, etc) one by one until the problem is resolved. This STOP code is seen quite often in the field when there is a faulty PCI dial-up modem. It is also advisable to check the integrity of your memory modules (see generic solution 1: Memory test). Finally, verify that there are no overheating components in your system, and no blown capacitors on your motherboard.

Parameters

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Description/Result
0x00 0 Pool type Pool tag The current thread requested a zero-byte pool allocation.
0x01,
0x02,
or 0x04		 Pointer to pool header First part of pool header contents 0 The pool header has been corrupted.
0x06 Reserved Pointer to pool header Pool header contents The current thread attempted to free a pool that was already freed.
0x07 Reserved Pool header contents Address of the block of pool being freed The current thread attempted to free a pool that was already freed.
0x08 Current IRQL Pool type Size of allocation, in bytes The current thread attempted to allocate the pool at an invalid IRQL.
0x09 Current IRQL Pool type Address of pool The current thread attempted to free the pool at an invalid IRQL.
0x0A Address of pool Allocator's tag Tag being used in the attempted free The current thread attempted to free pool memory by using the wrong tag.
(The memory might belong to another component.)
0x0B,
0x0C,
or 0x0D		 Address of pool Pool allocation's tag Bad quota process pointer The current thread attempted to release a quota on a corrupted pool allocation.
0x40 Starting address Start of system address space 0 The current thread attempted to free the kernel pool at a user-mode address.
0x41 Starting address Physical page frame Highest physical page frame The current thread attempted to free a non-allocated nonpaged pool address.
0x42
or 0x43		 Address being freed 0 0 The current thread attempted to free a virtual address that was never in any pool.
0x44 Starting address Reserved 0 The current thread attempted to free a non-allocated nonpaged pool address.
0x46 Starting address 0 0 The current thread attempted to free an invalid pool address.
0x47 Starting address Physical page frame Highest physical page frame The current thread attempted to free a non-allocated nonpaged pool address.
0x48 Starting address Reserved Reserved The current thread attempted to free a non-allocated paged pool address.
0x50 Starting address Start offset, in pages, from beginning of paged pool Size of paged pool, in bytes The current thread attempted to free a non-allocated paged pool address.
0x60 Starting address 0 0 The current thread attempted to free an invalid contiguous memory address.
(The caller of MmFreeContiguousMemory is passing a bad pointer.)
0x99 Address that is being freed 0 0 The current thread attempted to free pool with an invalid address.
(This code can also indicate corruption in the pool header.)
0x9A Pool type Number of bytes requested Pool tag The current thread marked an allocation request MUST_SUCCEED.
(This pool type is no longer supported.)
0x9B Pool type Number of bytes requested Caller's address The current thread attempted to allocate a pool with a tag of 0
(This would be untrackable, and possibly corrupt the existing tag tables.)
0x9C Pool type Number of bytes requested Caller's address The current thread attempted to allocate a pool with a tag of "BIG".
(This would be untrackable and could possibly corrupt the existing tag tables.)
0x9D Incorrect pool tag used Pool type Caller's address The current thread attempted to allocate a pool with a tag that does not contain any letters or digits. Using such tags makes tracking pool issues difficult.
0x41286 Reserved Reserved Start offset from the beginning of the paged pool, in pages The current thread attempted to free a paged pool address in the middle of an allocation.

The _POOL_TYPE codes are enumerated in Ntddk.h. In particular, 0 indicates nonpaged pool and 1 indicates paged pool.

0x000000D1

DRIVER_IRQL_NOT_LESS_OR_EQUAL
A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high.

This error is usually caused by a miscommunication between the operating system and a device driver or hardware. While this type of error is usually triggered by a device driver, it can also be caused by outdated firmware (software stored in read-only memory inside hardware) or a faulty device. It is possible to update the firmware on some devices, such as CD and DVD burners. You should contact the manufacturer of the device that is causing the problem to see if there is an updated version of either the software driver, or the firmware for your device.

If you are unsure about which driver or hardware is causing the errors, check Event Viewer (Start > Run > eventvwr.msc) for messages.

Parameters

No. Description
1 Memory referenced.
2 IRQL at time of reference.
3 0: Read
1: Write
4 Address that referenced memory.

Troubleshooting See also:

0x000000EA

THREAD_STUCK_IN_DEVICE_DRIVER

This error occurs when an infinite loop or other deadlock/race condition is detected in a device driver thread. Although this STOP error typically references video drivers, a stuck thread can occur in any kind of kernel mode driver or service.

As always, the source of this trap can be almost anything, including faulty hardware (expansion card, memory, motherboard, or BIOS bugs), and buggy drivers or kernel mode services. This kind of trap should be investigated on a case-by-case basis, as there is not one specific fix for this problem.

Parameters

No. Description
1 A pointer to the stuck thread object
2 A pointer to the DEFERRED_WATCHDOG object
3 A pointer to the offending driver name
4 In the kernel debugger: The number of times the "intercepted" bug check 0xEA was hit
On the blue screen: 1

0x000000ED

UNMOUNTABLE_BOOT_VOLUME
UNMOUNTABLE_BOOT_VOLUME occurs when the boot drive is unable to read a sector critical to starting Windows. If there is a bad sector in an area of the disk surface where the SYSTEM hive resides, for example, this trap will occur. It is advised to backup any important data (if possible) and at least perform a chkdsk /r.

Parameters

No. Description
1 The device object of the boot volume.
2 The status code from the file system that describes why it failed to mount the volume.
3 Reserved
4 Reserved

0x000000F4

CRITICAL_OBJECT_TERMINATION
This is almost always a pure-software problem. (Almost. I received this bugcheck when in the process of copying files from a known-bad drive that was attached to my Primary IDE channel as a slave. --DjLizard 10:47, 18 May 2006 (PDT)) As with all other bugchecks, this can also be caused by faulty memory modules.

Parameters

No. Description
1 The terminating object type:
0x3: Process
0x6: Thread
2 The terminating object
3 The process image file name
4 Pointer to an ASCII string containing an explanatory message.
Retrieved from "https://wiki.lunarsoft.net/index.php?title=STOP_errors&oldid=1485"