[Captain Newbie]

Microsoft Windows32 Series STOP Error Diagnosis

Definitions, Causes, and Possible Solutions

This is a compilation of information gleaned from various sources, including Microsoft's knowledge base. It is written from a computer science point of view, but is intended to give a greater understanding of what happens and what they can do when Windows32 dies, as well as of the Windows operating system.

Introduction. A STOP error is Microsoft's Win32 version of the non-handlable error. A STOP error always halts the system and either displays an error diagnosis screen, or invokes the kernel debugger, as installed.

To Microsoft's credit, there are few STOP errors that most users will ever encounter. The occurence of the fatal error has been decreased greatly because of Microsoft's implementation of preemptive multitasking and memory protection. This said, STOP errors can and do still occur.

The STOP Error Screen. Upon encountering a condition that causes a STOP error, the Win32 kernel does a few things. Windows saves the contents of the processor's registers, terminates the execution of the current process, halts all other processes, shuts down system devices to prevent data and hardware damage, begins (at the minimum, by default) a minidump of physical memory, and displays the dreaded Blue Screen of Death. A STOP error, by definition, is so grevious that the Right Thing to do is die gracefully, and so there is no way provided to resume from the Blue Screen other than a reset, which may occur automatically depending on your system preferences.

In my opinion, Windows XP does the Right Thing most of the time when a blue screen of death is displayed. There is simply too much damage and instability to go on.

The first line that you will likely see is "A problem has occured, and Windows has been shut down to prevent further damage to your computer." This is followed by the symbolic name of the STOP error, followed by some somewhat unhelpful bamph that Microsoft added to the Blue Screen to make it somewhat less intimidating to the average user.

Sometimes a filename is given, such as nv4disp.dll. This filename is your biggest hint as to what was going on when the "die immediately" problem happened. There are also often four hexadecimal 32-bit parameters in parenthesis following the error code itself, which, unless you are a programmer, are somewhat useless to you. An example of a STOP error that I encountered the other day was:

[code]-nv4disp.dll - STOP 0x0000000A - IRQL_NOT_LESS_OR_EQUAL - (0xFC000000, ...)[/quote]
--where '...' are the other useless parameters that I don't remember. The filename can help you -- remember it!

What causes a STOP error? A STOP error is caused when something happens that the Win32 kernel can't handle. This is deliberately vague and nonspecific, since there are many things that may happen (note, that the STOP error is _by definition_ a can't happen condition that DOES happen) that may cause this. Unless there is some grevious bug that Microsoft failed to catch in testing, the problem is usually caused by a third-party program (such as your antivirus software), a device driver problem, and/or, rarely but quite possibly, a hardware problem.

Microsoft has a BUNCH of STOP error codes. This post describes the ones that are most common, and should not be considered a complete list.

What can I do about a STOP error? The first and most obvious thing that you can do is--if you changed it, change it BACK! Boot using the Last Known Good Configuration, or, failing that, boot into safe mode and use System Restore to get back from whence you came. If you have recently added hardware, try removing it, as it may be faulty.

Check your drivers for WHQL certification. Even though many non-WHQL drivers work fine, it does help to have fully-WHQL'd drivers.

Common STOP errors. The most common STOP errors that I have seen mentioned here at OCForums, as well as some that I have seen in some of my hardware that, regrettably, is no longer with us, are the following. Note that 0x0A is equivalent to 0x0000000A, and simply saves me some typing. The errors listed with "Special Case" are errors that are almost always caused by a definite problem. The rest are vague, nonspecific, and generally there's not a lot that you as a user can do about it other than what is mentioned above.

IRQL_NOT_LESS_OR_EQUAL (0x0A) (Deserves special mention.)
MEMORY_MANAGEMENT (0x1A)
PFN_LIST_CORRUPT (0x4E)
PAGE_FAULT_IN_NONPAGED_AREA (0x50)
KERNEL_STACK_INPAGE_ERROR (0x70) (Explained.)
INACCESSIBLE_BOOT_DEVICE (0x7B) (Special Case)
MACHINE_CHECK_EXCEPTION (0x9B) (Special Case)
CRITICAL_OBJECT_TERMINATION (0xF4) (Deserves some mention.)
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (0xFC) (Thanks to JigPu for the proper name. Special case.)
MANUALLY_INITIATED_CRASH (0xDEADDEAD) (Very Special Case)

0x0A - Kernel Interrupt Request Level Not Less Or Equal - This deserves a bit of mention because IRQL seems to be one of the MOST common, if not THE most common, STOP error encountered on these forums. In the kernel, kernel-mode processes have the right to create interrpt requests up to and including a certain level, which is determined by their priority level. If a kernel-mode process, however, goes *over* that priority level, Win32 executives will generate a STOP error and no interrupt will take place. This is almost always a device driver problem, since device drivers are the most unpredictable of kernel mode processes. Watch for new drivers, or, if you have just installed new drivers, roll them back.

At present, the most common reported cause of this error is a dodgy piece of Logetich mouse software that permits use of forward/back buttons on your mouse. Check for the presence of this piece of software as well.

0x1A, 0x4E, 0x50 These errors are all most likely caused by a device driver or other system program running amok. Antivirus software can actually cause these errors (NortonAV had an issue that would repeatedly generate a MEMORY_MANAGEMENT or PAGE_FAULT_IN_NONPAGED_AREA, for instance) as well, since they're somewhat priveleged on the system. If you have recently installed a new driver, roll it back. That said, if you've shifted drivers around a lot, they may be indicative of a hardware problem.

0x77 - Error paging in a kernel portion This error means that the Win32 kernel had trouble reading in data from the page file. According to Microsoft, bad blocks or other disk problems may cause this error, along with possibly faulty RAM. If you encounter this error, check for viruses, run a memory test (such as memtest86), and check your disks for bad blocks. This error is closely related to the *_FILE_SYSTEM errors. (Thanks to JigPu.)

0x7B - Inaccessible Boot Device This error happens when Windows cannot read the boot device. This error happens most frequently when you've moved a hard drive from one machine to another with a different drive controller. The solution is a simple repair install. Failing that, a serious problem exists with your hard disk drive or drive controller.

0x9B - Machine Check Exception This error is almost always indicative of a hardware problem. A 'machine check exception' is a hardware exception, which is generated by Pentium (P5) and later CPUs to indicate that a hardware problem may exist, and that the operating system should do something about it right now.

A machine check exception may indicate that, if you are overclocking, you have far overstepped the bounds of what your system is currently capable of. Slow the system down. If you aren't overclocking, or you have been 'stable' for a while, then you may have an impending hardware failure, especially if the Machine Check Exception repeatedly but somewhat-randomly presents itself. Be on the lookout for other signs of impending failure. Other STOP errors definitely qualify as signs of impending failure.

Microsoft goes on to add...

Originally Posted by Microsoft Knowledge Base Entry

• You are running the processor or mainboard beyond its specifications. For example, you are overclocking the processor or bus. We recommend that you run your hardware at the manufacturer-rated speeds.
• Noisy power, overstressed power strips, outmatched power supplies and failing power supplies can destabilize your computer. Make sure that you have a stable, reliable power supply to your computer.
• Extreme thermal conditions caused by the failure of cooling devices such as fans may damage your computer. Make sure that your cooling devices are all working.
• You have damaged memory or memory that is not the correct type for your computer. If you recently changed the memory configuration, revert to the previous configuration to determine what is wrong. Make sure that you are using the correct memory for your computer.

Thanks to Super Nade

0xF4 - Termination of system-critical process or thread If a system-critical program or object stops running, you get this blue screen of death. This is almost certainly a pure software problem. For what it's worth, the first parameter can tell you if the object that was killed was a process (0x03) or a thread (0x06). This is another "die immediately if this happens" error. Check your system file integrity (sfc /scannow), or back up the things that are really important to you and start fresh.

0xFC - Attempted execution of non-executable code This error is similar to the nonspecific errors listed above, but deserves special explanation. Windows XP Service Pack 2 implements NX (No Execute, AMD) or XD (eXecute Disable, Intel) protection at the kernel level. It is often called "Enhanced Virus Protection". This scheme works by adding a layer of address translation to the kernel, which implements a bit for a page that indicates that that specific page may not be executed (or, more technically correct, be referenced by the instruction pointer). These areas are "Do Not Execute Under Penalty of Death" areas for device drivers and other kernel-mode processes. If a kernel mode process tries to execute code that is in an NX area, this STOP error results. This is indeed the thing that Should Happen, since a kernel-mode process that attempts to execute NX areas is defective beyond recovery. Other than watching for drivers that may fix the problem, there's not a lot you can do about this one. Drivers that are designed for the AMD64/EM64T platform, if they are not already available, may alleviate this problem.

0xDEADDEAD - User Initiated STOP There is a way in Win32 to make it such that the user may generate a STOP error. This is mostly for debugging purposes, and is enabled through an entry in the registry. If you ever see this, it means that 1) you've enabled user-initiated crashing, and 2) you've initiated a crash through issuing an NMI (non-maskable interrupt) from the local console. (As an aside, the user-initiated crash is useful for debugging a kernel-mode process that hangs but does not actually crash the Win32 kernel. If you initiate the user-initiated crash while that process has control of the kernel, you get something of a picture of what is happening.) To prevent this failure, you need to tweak the Registry accordingly. This behavior is not enabled by default. But, if you're having odd hangs and crashes and you think a device driver or Windows itself may be at fault, you should enable the manually initiated crash interrupt, and, if you encounter the situation again, punch CTRL+ALT+DEL. (Note that enabling this behavior disables the Task Manager entry vector; i.e. I do not believe that you can conjure up Task Manager with the three-fingered salute while this behavior is enabled. Note also that this behavior is only really helpful if you've permitted the full dump of physical memory.)

Well, that's all the time we have today folks; hope that this has contributed to your understanding of the hows and whys of Win32 crashes. If you encounter an error that isn't listed here, try looking at the Microsoft Knowledge Base, and post your experience so that others can hopefully learn from your experiences.

[Captain Newbie]

Reserved.

[Super Nade]

More details on Machine check exception erros from the MS database.

STOP: 0x0000009C (0x00000004, 0x00000000, 0xb2000000, 0x00020151) ...

SYMPTOMS
You may receive the following Stop error message:
STOP: 0x0000009C (0x00000004, 0x00000000, 0xb2000000, 0x00020151)
"MACHINE_CHECK_EXCEPTION"
The four parameters inside the parentheses may vary.

CAUSE
This behavior occurs because your computer processor detected and reported an unrecoverable hardware error to Windows XP. To do this, the processor used the Machine Check Exception (MCE) feature of Pentium processors or the Machine Check Architecture (MCA) feature of some Pentium Pro processors. The following factors may cause this error message:
• System bus errors
• Memory errors that may include parity or Error Correction Code (ECC) problems
• Cache errors in the processor or hardware
• Translation Lookaside Buffers (TLB) errors in the processor
• Other CPU-vendor specific detected hardware problems
• Vendor-specific detected hardware problems

STATUS
This behavior is by design.

MORE INFORMATION
A machine check exception occurs when Windows XP and your hardware platform cannot recover from a hardware error so that the system can continue to run successfully and reliably. More specific diagnosis of machine check exceptions is difficult, and there is no general solution. Contact your hardware manufacturer or a computer hardware technician for help with troubleshooting this issue.

Machine check exceptions are frequently caused by one of the following conditions:
• You are running the processor or mainboard beyond its specifications. For example, you are overclocking the processor or bus. We recommend that you run your hardware at the manufacturer-rated speeds.
• Noisy power, overstressed power strips, outmatched power supplies and failing power supplies can destabilize your computer. Make sure that you have a stable, reliable power supply to your computer.
• Extreme thermal conditions caused by the failure of cooling devices such as fans may damage your computer. Make sure that your cooling devices are all working.
• You have damaged memory or memory that is not the correct type for your computer. If you recently changed the memory configuration, revert to the previous configuration to determine what is wrong. Make sure that you are using the correct memory for your computer.
Note Your hardware may support additional error logging features that capture the machine check exception and suggest a more specific solution.

The Pentium and Pentium Pro processors provide a mechanism to detect and to report hardware-related problems such as memory parity errors and cache errors. To signal a hardware error, the processor signals the detection of a machine check error by generating a machine check exception (Interrupt 18). Windows XP reports that the error occurred and displays parameters that you can use to decode the exception.

Another useful read from the AMD-Tech docs:-
http://www.amd.com/us-en/assets/cont...docs/33047.pdf

[Captain Newbie]

Edited the Machine Check Exception entry to include information direct from Microsoft.

[JigPu]

Sweetness!! Very nice work Captain Newbie!!

For 0xFC the symbolic name is ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY, and you should mention attempting to disable DEP. Drivers (as you mentioned) are the likely cause, and disabling DEP will likely cause the BSOD to disappear.

Also, one BSOD I see a lot is 0x77 KERNEL_STACK_INPAGE_ERROR. Docs can be found here (Win 2K) and here (XP). I included the 2K link because it has a lot more troubleshooting detail.

JigPu

[Captain Newbie]

*added*

Thanks, JigPu, for your contribution.

[dicecca112]

bookmarked, a little more work on this Newbie and you could have sticky on your hands.

[Captain Newbie]

Originally Posted by dicecca112

bookmarked, a little more work on this Newbie and you could have sticky on your hands.

I need to break out my can of post polish; this was written originally last night around 2330.

[William]

Thanks, stickied it for you. .

[RJARRRPCGP]

Originally Posted by Super Nade

More details on Machine check exception erros from the MS database.

STOP: 0x0000009C (0x00000004, 0x00000000, 0xb2000000, 0x00020151) ...

SYMPTOMS
You may receive the following Stop error message:
STOP: 0x0000009C (0x00000004, 0x00000000, 0xb2000000, 0x00020151)
"MACHINE_CHECK_EXCEPTION"
The four parameters inside the parentheses may vary.

CAUSE
This behavior occurs because your computer processor detected and reported an unrecoverable hardware error to Windows XP. To do this, the processor used the Machine Check Exception (MCE) feature of Pentium processors or the Machine Check Architecture (MCA) feature of some Pentium Pro processors. The following factors may cause this error message:
• System bus errors
• Memory errors that may include parity or Error Correction Code (ECC) problems
• Cache errors in the processor or hardware
• Translation Lookaside Buffers (TLB) errors in the processor
• Other CPU-vendor specific detected hardware problems
• Vendor-specific detected hardware problems

STATUS
This behavior is by design.

MORE INFORMATION
A machine check exception occurs when Windows XP and your hardware platform cannot recover from a hardware error so that the system can continue to run successfully and reliably. More specific diagnosis of machine check exceptions is difficult, and there is no general solution. Contact your hardware manufacturer or a computer hardware technician for help with troubleshooting this issue.

Machine check exceptions are frequently caused by one of the following conditions:
• You are running the processor or mainboard beyond its specifications. For example, you are overclocking the processor or bus. We recommend that you run your hardware at the manufacturer-rated speeds.
• Noisy power, overstressed power strips, outmatched power supplies and failing power supplies can destabilize your computer. Make sure that you have a stable, reliable power supply to your computer.
• Extreme thermal conditions caused by the failure of cooling devices such as fans may damage your computer. Make sure that your cooling devices are all working.
• You have damaged memory or memory that is not the correct type for your computer. If you recently changed the memory configuration, revert to the previous configuration to determine what is wrong. Make sure that you are using the correct memory for your computer.
Note Your hardware may support additional error logging features that capture the machine check exception and suggest a more specific solution.

The Pentium and Pentium Pro processors provide a mechanism to detect and to report hardware-related problems such as memory parity errors and cache errors. To signal a hardware error, the processor signals the detection of a machine check error by generating a machine check exception (Interrupt 18). Windows XP reports that the error occurred and displays parameters that you can use to decode the exception.

Another useful read from the AMD-Tech docs:-
http://www.amd.com/us-en/assets/cont...docs/33047.pdf

From RJARRRPCGP's experience:

This crash usually means that the processor core is unstable. This BSOD is common when OC'ing the processor and gaming.

If this crash occurs when gaming, you're having a warning sign of an unstable processor core OC!! (NOT the RAM or FSB!)

This is common with problematic processor steppings.
Expect this BSOD to be common with T-bred AIUCBs, because they seem to OC poorly. (even if far better than a Palomino!)

Solution:

Increase the Vcore.

If the BSOD persists, run Prime95. It shall fail within 2 hours. That allows you to confirm that the processor core OC is unstable. Then lower the processor core frequency by lowering the multiplier. If the multiplier is locked, lower the FSB frequency to lower the processor core frequency.
-------------------------------------------------------------------------

***STOP: 0x00000050 PAGE_FAULT_IN_NONPAGED_AREA

This is the BSOD you usually get if there's a RAM malfunction.

This is a usually a classic warning sign of a RAM malfunction. This is common if you OC the RAM too much. May also occur if the latencies are too low.

Incompatible RAM or a bad RAM slot can cause this BSOD.

Solution:

Increase the VDIMM.

If the symptom persists, lower the RAM frequency (This means for some OC'ers, a divider) or loosen the RAM timings (increase the RAM latencies)

(For example, changing them from 2.0-2-2-6 to 2.0-3-3-6)
-------------------------------------------------------------------------

***STOP: 0x0000004E PFN_LIST_CORRUPT

Like the BSOD just before this, probably caused by unstable RAM. I gotten this BSOD before because of my RAM OC being unstable.
-------------------------------------------------------------------------

I hope that it's OK to post this here.

[Captain Newbie]

Certainly. Thanks for your contribution; I'll edit it in after lunch.

[RotKT]

thanks

[Captain Newbie]

Glad to be of service.

[jcw122]

I'll add that I've gotten a few of those Errors before because of my memory timings being too tight, caused a great deal of the most random problems.

[Tracekill]

This may or may not have been mentioned but I felt it was necessary to add that:

IRQL_NOT_LESS_OR_EQUAL is also often caused by Logitech's Desktop Mouse support software in later versions. To solve this problem simply update to the most recent version which includes a fix to prevent such problems from arising.

[pejsaboy]

Originally Posted by Tracekill

This may or may not have been mentioned but I felt it was necessary to add that:

IRQL_NOT_LESS_OR_EQUAL is also often caused by Logitech's Desktop Mouse support software in later versions. To solve this problem simply update to the most recent version which includes a fix to prevent such problems from arising.

wow, exactly what i was looking for this morning! I've been getting a IRQL_NOT_LESS_OR_EQUAL lately, and it started happening after i installed that logitech setpoint software. unfortunately i have the newest version, so i may just uninstall the software. i don't need the forward and back buttons....

[Tracekill]

Yeah I just uninstalled it to, it turns out that if you uninstall the Logitech drivers and let windows take care of it you can still retain function of some of the special buttons.

[pejsaboy]

yep, still get the back and forward buttons, i only lost the horizontal scroll, which i wasn't all that crazy about in the first place.
on another note, i just had a 0xD3 stop. i'm still looking for what it is, and i'll post back when i figure something out. it said something about rdbss.sys as well.

[pejsaboy]

ok, the only thing i was able to find on STOP 0xD3 is this:
DRIVER_PORTION_MUST_BE_NONPAGED
i searched the knowledge base at microsoft, and that particular error gave no search results. i also searched the rdbss.sys that was on the BSOD, and that reverted to a win2k error and hotfix.
i haven't installed or uninstalled any drivers lately that i remember, and i'm assuming that's what the error leads to?
at this point i've only seen it once, so it's nothing pressing that i need to figure out. But, if anyone knows anything about it i would appreciate it.

[Route44]

You guys may have just ended my hair pulling, endless search for why I was getting DRIVER_IRQL_NOT_LESS_OR_EQUAL error Stop. I have a Logitech MX310 with those fancy buttons and is part of a brand new build. I downloaded the latest driver and I sure hope this takes care of it.

I bow to the entity known as the OC Forums and a special thanks to Captain Newbie for taking the time for a very, very helpful guide.

[hanzalo]

I haven't been to these forums in a while, but when I started getting DRIVER_IRQL_NOT... bsods I knew where to come. I have an MX310. I'll download the newwest drivers and see if it takes care of it.

[RJARRRPCGP]

Be wary of this problem!

*** STOP: 0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL

*** sbpci.sys

If you're connected to the internet at the same time you're playing MIDI!

I noticed that at least with 56k, if I was connected to the internet and playing a MIDI file at the same time, the above BSOD occurs.

Has been known to occur with a SoundBlaster Audio PCI 128 sound card.

May occur with other SoundBlasters, including SoundBlaster Live!

Has anyone else had this problem?

It occured with both Windows 2000 and Windows XP.

I first noticed the problem with Windows 2000 SP3, back in 2003.

Because Windows 2000 SP3 was the newest service pack at the time, I automatically blamed SP3. LOL.

That was before SP4 was released a while later.

I already knew about this problem for a good while, but wasn't sure about posting this.

[RollingThunder]

To reiterate the Captain's fine thread, this error is a good sign of a corrupt operating system. I witnessed this error signature personally and sure enough system32 files were corrupt or deleted > Format and reinstall.

[RJARRRPCGP]

Just gotten this BSOD, but it was silent, because Windows 2000 decided to reboot:

*** STOP: 0x0000001E KMODE_EXCEPTION_NOT_HANDLED

Apparently, because my processor and/or other components on the motherboard overheated!

My cooling duct became detached and I was running ePSXe with it detached!

The stupid duck tape didn't stay!

Thus, I now feel like a crackhead!

[SuperDave1685]

What a good guide. Thanks Captain! I think with my recent string of hardware issues, I've seen just about all of these lol...So I'm getting quite familiar with them.. Is that a good thing or bad thing?

-Dave

[g0dM@n]

uhmm.... why did i take almost 2 yrs to see this thread... this looks like very useful/informative stuff!!

thx!! i will be visiting this thread more often for info, but hopefully i won't have to.

[Repossessed]

Another one: Stop 0x000000ED Unmountable_Boot_Device

Probably the most common BSOD out there*. Means one of two things. One, a bad sector has destroyed really key data, and windows can't mount the drive. This may sometimes, be fixed by going to recovery console and running chkdsk /r /p. Frequently though, it comes as the final stage of a failing hard drive. If you get this then hopefully your hard drive vendor gives out some kind of diagnostics that doesn't need windows to work, and you can eliminate this.


*Possibility of this happening depends on the quality of your drive, but there are a lot of really shoddy drives out there that came built into systems.

[ian2000gsxr]

great guide. thank you

[RollingThunder]

KERNAL_PAGE_INPUT_ERROR

0X0000007A

Bad sector(s) hard drive, data access (in this instance). Check event viewer.

Run a HD diagnostics, check SATA cables or connections, replace SATA cable if necessary. Possible HD failing.

[smilelink]

I must admit from the outset, I am a bit overmatched here as I am not as computer support literate as many here thus, I am seeking some assistance.

Over the past month I have encountered repetitive BSOD errors of varying varieties which seem to be on the increase. I have read and tried to apply as many solutions as I could find without eradicating the problems.

I am running WIN XP Home Edition on a Dell 4600 Desktop. I have added no new hardware recently.

Through the Event viewer under Application Errors what follows is what I have found:

MCSCAN 32 Engine Installation Failed. Engine return error:3

Also this:

Faulting application sgtray.exe. Version 1.1.32.0,faulting module com ctl32.dll,version 5.82.2900.5512,fault address )x00010 bec.


and this:

Faulting application teatimer.exe,version 2.6.0.20,fault address )x0070064


Stop Error Codes look like these:

Bad-Pool-Header Stop:0x00000019 (0x00000020,0x82DE6748,0x82DE6748,
0x0A000004)

Another Stop Error Code

BAD_Pool_Caller Stop: 0x000000C2-(0x00000007,0x00000CD4,0x021F0008,0x82EBD620)

Another:

Bad_Pool_Header Stop: 0x000000019 (0x00000020,0x825401C8,0x82540478,ox0A56139E0) with the message,"Disable BIOS Memory Options such as caching or shadowing".

Then this:

WIN32K.sys Page_Fault_IN_Non Paged Area
BF801193 base at BF800000,Datestamp 48ce513a

Lastly This:

Stop: 0x0000000x50 (0xE2D9F004,0x000000000,0x80551ADC,0x00000001,8055 1ADC

What I have done so far"

Ran chkdisc ( I have seen mention of a need for it to run through,"Five" steps? When I ran mine it ran through three and closed automatically (Is this normal?)

Dumped Adobe Active X files and folders.

Run Defrag at least four times.

Ran my McAffee Security System scan as well as McAffee QuickClean.

Ran the freeware of Spybot SD

Ran Registry Easy.

I am at a loss at this point and would be grateful for guidance and direction remembering of course that I am not yet as skilled with this stuff as I one day hope to be~:-)

Regards,
Smilelink