- Joined
- Jan 2, 2004
Microsoft Windows32 Series STOP Error Diagnosis
Definitions, Causes, and Possible Solutions
This is a compilation of information gleaned from various sources, including Microsoft's knowledge base. It is written from a computer science point of view, but is intended to give a greater understanding of what happens and what they can do when Windows32 dies, as well as of the Windows operating system.
Introduction. A STOP error is Microsoft's Win32 version of the non-handlable error. A STOP error always halts the system and either displays an error diagnosis screen, or invokes the kernel debugger, as installed.
To Microsoft's credit, there are few STOP errors that most users will ever encounter. The occurence of the fatal error has been decreased greatly because of Microsoft's implementation of preemptive multitasking and memory protection. This said, STOP errors can and do still occur.
The STOP Error Screen. Upon encountering a condition that causes a STOP error, the Win32 kernel does a few things. Windows saves the contents of the processor's registers, terminates the execution of the current process, halts all other processes, shuts down system devices to prevent data and hardware damage, begins (at the minimum, by default) a minidump of physical memory, and displays the dreaded Blue Screen of Death. A STOP error, by definition, is so grevious that the Right Thing to do is die gracefully, and so there is no way provided to resume from the Blue Screen other than a reset, which may occur automatically depending on your system preferences.
In my opinion, Windows XP does the Right Thing most of the time when a blue screen of death is displayed. There is simply too much damage and instability to go on.
The first line that you will likely see is "A problem has occured, and Windows has been shut down to prevent further damage to your computer." This is followed by the symbolic name of the STOP error, followed by some somewhat unhelpful bamph that Microsoft added to the Blue Screen to make it somewhat less intimidating to the average user.
Sometimes a filename is given, such as nv4disp.dll. This filename is your biggest hint as to what was going on when the "die immediately" problem happened. There are also often four hexadecimal 32-bit parameters in parenthesis following the error code itself, which, unless you are a programmer, are somewhat useless to you. An example of a STOP error that I encountered the other day was:
Code:
-nv4disp.dll - STOP 0x0000000A - IRQL_NOT_LESS_OR_EQUAL - (0xFC000000, ...)[/quote]
--where '...' are the other useless parameters that I don't remember. The filename can help you -- remember it!
[b]What causes a STOP error?[/b] A STOP error is caused when something happens that the Win32 kernel can't handle. This is deliberately vague and nonspecific, since there are many things that may happen (note, that the STOP error is _by definition_ a can't happen condition that DOES happen) that may cause this. Unless there is some grevious bug that Microsoft failed to catch in testing, the problem is usually caused by a third-party program (such as your antivirus software), a device driver problem, and/or, rarely but quite possibly, a hardware problem.
Microsoft has a BUNCH of STOP error codes. This post describes the ones that are [b]most[/b] common, and should not be considered a complete list.
[b]What can I do about a STOP error?[/b] The first and most obvious thing that you can do is--if you changed it, change it BACK! Boot using the Last Known Good Configuration, or, failing that, boot into safe mode and use System Restore to get back from whence you came. If you have recently added hardware, try removing it, as it may be faulty.
Check your drivers for WHQL certification. Even though many non-WHQL drivers work fine, it does help to have fully-WHQL'd drivers.
[b]Common STOP errors.[/b] The most common STOP errors that I have seen mentioned here at OCForums, as well as some that I have seen in some of my hardware that, regrettably, is no longer with us, are the following. Note that 0x0A is equivalent to 0x0000000A, and simply saves me some typing. The errors listed with "Special Case" are errors that are almost always caused by a definite problem. The rest are vague, nonspecific, and generally there's not a lot that you as a user can do about it other than what is mentioned above.
IRQL_NOT_LESS_OR_EQUAL (0x0A) (Deserves special mention.)
MEMORY_MANAGEMENT (0x1A)
PFN_LIST_CORRUPT (0x4E)
PAGE_FAULT_IN_NONPAGED_AREA (0x50)
KERNEL_STACK_INPAGE_ERROR (0x70) (Explained.)
INACCESSIBLE_BOOT_DEVICE (0x7B) (Special Case)
MACHINE_CHECK_EXCEPTION (0x9B) (Special Case)
CRITICAL_OBJECT_TERMINATION (0xF4) (Deserves some mention.)
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (0xFC) (Thanks to JigPu for the proper name. Special case.)
MANUALLY_INITIATED_CRASH (0xDEADDEAD) (Very Special Case)
[b]0x0A - Kernel Interrupt Request Level Not Less Or Equal[/b] - This deserves a bit of mention because IRQL seems to be one of the MOST common, if not THE most common, STOP error encountered on these forums. In the kernel, kernel-mode processes have the right to create interrpt requests up to and including a certain level, which is determined by their priority level. If a kernel-mode process, however, goes *over* that priority level, Win32 executives will generate a STOP error and no interrupt will take place. This is almost always a device driver problem, since device drivers are the most unpredictable of kernel mode processes. Watch for new drivers, or, if you have just installed new drivers, roll them back.
At present, the most common reported cause of this error is a dodgy piece of Logetich mouse software that permits use of forward/back buttons on your mouse. Check for the presence of this piece of software as well.
[b]0x1A, 0x4E, 0x50[/b] These errors are all most likely caused by a device driver or other system program running amok. Antivirus software can actually cause these errors (NortonAV had an issue that would repeatedly generate a MEMORY_MANAGEMENT or PAGE_FAULT_IN_NONPAGED_AREA, for instance) as well, since they're somewhat priveleged on the system. If you have recently installed a new driver, roll it back. That said, if you've shifted drivers around a lot, they may be indicative of a hardware problem.
[b]0x77 - Error paging in a kernel portion[/b] This error means that the Win32 kernel had trouble reading in data from the page file. According to Microsoft, bad blocks or other disk problems may cause this error, along with possibly faulty RAM. If you encounter this error, check for viruses, run a memory test (such as memtest86), and check your disks for bad blocks. This error is closely related to the *_FILE_SYSTEM errors. (Thanks to JigPu.)
[b]0x7B - Inaccessible Boot Device[/b] This error happens when Windows cannot read the boot device. This error happens most frequently when you've moved a hard drive from one machine to another with a different drive controller. The solution is a simple repair install. Failing that, a serious problem exists with your hard disk drive or drive controller.
[b]0x9B - Machine Check Exception[/b] This error is [b]almost always[/b] indicative of a hardware problem. A 'machine check exception' is a hardware exception, which is generated by Pentium (P5) and later CPUs to indicate that a hardware problem may exist, and that the operating system should do something about it right now.
A machine check exception may indicate that, if you are overclocking, you have far overstepped the bounds of what your system is currently capable of. Slow the system down. If you aren't overclocking, or you have been 'stable' for a while, then you may have an impending hardware failure, especially if the Machine Check Exception repeatedly but somewhat-randomly presents itself. Be on the lookout for other signs of impending failure. Other STOP errors definitely qualify as signs of impending failure.
Microsoft goes on to add...
[quote=Microsoft Knowledge Base Entry]• You are running the processor or mainboard beyond its specifications. For example, you are overclocking the processor or bus. We recommend that you run your hardware at the manufacturer-rated speeds.
• Noisy power, overstressed power strips, outmatched power supplies and failing power supplies can destabilize your computer. Make sure that you have a stable, reliable power supply to your computer.
• Extreme thermal conditions caused by the failure of cooling devices such as fans may damage your computer. Make sure that your cooling devices are all working.
• You have damaged memory or memory that is not the correct type for your computer. If you recently changed the memory configuration, revert to the previous configuration to determine what is wrong. Make sure that you are using the correct memory for your computer.[/quote]
[size=1]Thanks to Super Nade[/size]
[b]0xF4 - Termination of system-critical process or thread[/b] If a system-critical program or object stops running, you get this blue screen of death. This is almost certainly a pure software problem. For what it's worth, the first parameter can tell you if the object that was killed was a process (0x03) or a thread (0x06). This is another "die immediately if this happens" error. Check your system file integrity (sfc /scannow), or back up the things that are really important to you and start fresh.
[b]0xFC - Attempted execution of non-executable code[/b] This error is similar to the nonspecific errors listed above, but deserves special explanation. Windows XP Service Pack 2 implements NX (No Execute, AMD) or XD (eXecute Disable, Intel) protection at the kernel level. It is often called "Enhanced Virus Protection". This scheme works by adding a layer of address translation to the kernel, which implements a bit for a page that indicates that that specific page may not be executed (or, more technically correct, be referenced by the instruction pointer). These areas are "Do Not Execute Under Penalty of Death" areas for device drivers and other kernel-mode processes. If a kernel mode process tries to execute code that is in an NX area, this STOP error results. This is indeed the thing that Should Happen, since a kernel-mode process that attempts to execute NX areas is defective beyond recovery. Other than watching for drivers that may fix the problem, there's not a lot you can do about this one. Drivers that are designed for the AMD64/EM64T platform, if they are not already available, may alleviate this problem.
[b]0xDEADDEAD - User Initiated STOP[/b] There is a way in Win32 to make it such that the user may generate a STOP error. This is mostly for debugging purposes, and is enabled through an entry in the registry. If you ever see this, it means that 1) you've enabled user-initiated crashing, and 2) you've initiated a crash through issuing an NMI (non-maskable interrupt) from the local console. (As an aside, the user-initiated crash is useful for debugging a kernel-mode process that hangs but does not actually crash the Win32 kernel. If you initiate the user-initiated crash while that process has control of the kernel, you get something of a picture of what is happening.) To prevent this failure, you need to tweak the Registry accordingly. This behavior is not enabled by default. But, if you're having odd hangs and crashes and you think a device driver or Windows itself may be at fault, you should enable the manually initiated crash interrupt, and, if you encounter the situation again, punch CTRL+ALT+DEL. (Note that enabling this behavior disables the Task Manager entry vector; i.e. I do not believe that you can conjure up Task Manager with the three-fingered salute while this behavior is enabled. Note also that this behavior is only really helpful if you've permitted the full dump of physical memory.)
Well, that's all the time we have today folks; hope that this has contributed to your understanding of the hows and whys of Win32 crashes. If you encounter an error that isn't listed here, try looking at the Microsoft Knowledge Base, and [b]post your experience[/b] so that others can hopefully learn from your experiences. :cool:
Last edited:
