Microsoft Windows XP Professional Resource Kit 2003
ISBN: N/A
EAN: N/A
EAN: N/A
Year: 2005
Pages: 338
Pages: 338
The following Stop message descriptions can help you to troubleshoot problems that cause Stop messages. Also, the Stop Message Checklist at the end of this appendix, provides suggestions useful for resolving all types of Stop errors. If errors persist after you have followed the recommendations given, request assistance from a Microsoft support engineer.
The Stop 0xA message indicates that a kernel-mode process or driver attempted to access a memory location to which it did not have permission, or at a kernel interrupt request level (IRQL) that was too high. A kernel-mode process can access only other processes that have an IRQL lower than, or equal to, its own. This Stop message is typically due to faulty or incompatible hardware or software.
This Stop message has four parameters:
Memory address that was improperly referenced.
IRQL that was required to access the memory.
Type of access (0x00000000 = read operation, 0x00000001 = write operation).
Address of the instruction that attempted to reference memory specified in parameter 1.
If the last parameter is within the address range of a device driver used on your system, you can determine which device driver was running when the memory access occurred. You can typically determine the driver name by reading the line that begins with:
**Address 0xZZZZZZZZ has base at <address>- <driver name>
If the third parameter is the same as the first parameter, a special condition exists in which a system worker routine, carried out by a worker thread to handle background tasks known as work items, returned at a higher IRQL. In that case, some of the four parameters take on new meanings:
Address of the worker routine.
Kernel interrupt request level (IRQL).
Address of the worker routine.
Address of the work item.
The following suggestions are specific to Stop 0xA errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
A Stop 0xA message might occur after installing a faulty device driver, system service, or firmware. If a Stop message lists a driver by name, disable, remove, or roll back the driver to correct the problem. If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, and CD mastering tools.
A Stop 0xA message might also be due to failing or defective hardware. If a Stop message points to a category of devices (video or disk adapters, for example), try removing or replacing the hardware to determine if it is causing the problem.
If you encounter a Stop 0xA message while upgrading to Windows XP Professional, the problem might be due to an incompatible driver, system service, virus scanner, or backup. To avoid problems while upgrading, simplify your hardware configuration and remove all third-party device drivers and system services (including virus scanners) prior to running setup. After you have successfully installed Windows XP Professional, contact the hardware manufacturer to obtain compatible updates. For more information about simplifying your system for troubleshooting purposes, see Troubleshooting Concepts and Strategies and Troubleshooting Startup in this book.
For more information about Stop 0xA messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x0000000A, and 0xA.
The Stop 0x1E message indicates that the Windows XP Professional kernel detected an illegal or unknown processor instruction. The problems that cause Stop 0x1E messages share similarities with those that generate Stop 0xA errors in that they can be due to invalid memory and access violations. This default Windows XP Professional error handler typically intercepts these problems if error-handling routines are not present in the code itself.
This Stop message has four parameters:
Exception code that was not handled.
Address at which the exception occurred.
Parameter 0 of the exception.
Parameter 1 of the exception.
The first parameter identifies the exception generated. Common exception codes include:
0x80000002: STATUS_DATATYPE_MISALIGNMENT
An unaligned data reference was encountered. The trap frame supplies additional information.
0x80000003: STATUS_BREAKPOINT
A breakpoint or ASSERT was encountered when no kernel debugger was attached to the system.
0xC0000005: STATUS_ACCESS_VIOLATION
A memory access violation occurred. Parameter 4 of the Stop error (which is Parameter 1 of the exception) is the address that the driver attempted to access.
0xC0000044: STATUS_QUOTA_EXCEEDED
The text Insufficient quota exists to complete the operation indicates a pool memory leak. A quota allocation attempt necessary for the system to continue operating normally was unsuccessful due to a program or driver memory leak.
For a complete list of exception codes, see the Ntstatus.h file located in the Inc directory of the Windows XP Professional Driver Development Kit (DDK). For more information about the DDK, see the Driver Development Kits link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources
The second parameter identifies the address of the module in which the error occurred. Frequently, the address points to an individual driver or faulty hardware named on the third parameter of the Stop message. Make a note of this address and the link date of the driver or image that contains it.
The last two Stop message parameters vary, depending upon the exception that has occurred. You can typically find a description of the parameters that are included with the name of error code in Ntstatus.h. If the error code has no parameters, the last two parameters of the Stop message are listed as 0x00000000.
The following suggestions are specific to Stop 0x1E errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Stop 0x1E messages typically occur after installing faulty drivers or system services, or they can indicate hardware problems, such as memory and IRQ conflicts. If a Stop message lists a driver by name, disable, remove, or roll it back to correct the problem. If disabling or removing applications and drivers resolves the issue, contact the hardware manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, and CD mastering tools.
If the Stop message mentions the file Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, you might be able to disable it by starting the system in safe mode. If not, use Recovery Console to manually delete the system service file that is causing the problem. For more information about safe mode and Recovery Console, see Tools for Troubleshooting in this book.
Problems can result from system firmware incompatibilities. Many Advanced Configuration and Power Interface (ACPI) issues can be resolved by updating to the latest firmware.
Other possible causes include insufficient disk space while installing applications or performing certain functions that require more memory. You can free up space by deleting unneeded files. Use Disk Cleanup to increase available disk space. From Recovery Console, remove temporary files (those with .tmp file extensions), Internet cache files, application backup files, and .tmp files generated by Chkdsk.exe or Autochk.exe. You can also choose to install additional applications to another hard disk with more free space or move data files, paging files, and so on. For more information about Autochk.exe and Chkdsk.exe, see Troubleshooting Disks and File Systems in this book.
The problem might be due to a memory leak caused by an application or service that is not releasing memory correctly. Poolmon (Poolmon.exe) helps you to isolate the components that are causing kernel memory leaks. For more information about troubleshooting memory leaks, see Microsoft Knowledgebase articles Q177415, How to Use Poolmon to Troubleshoot Kernel Mode Memory Leaks, and Q298102, Finding Pool Tags Used by Third Party Files Without Using the Debugger. To find these articles, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources
To find additional articles, search using keywords winnt, poolmon, pool tag, pooltag, and memory leak.
For more information about Stop 0x1E messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x0000001E, and 0x1E.
The Stop 0x24 message indicates that a problem occurred within Ntfs.sys, the driver file that allows the system to read and write to NTFS file system drives. A similar Stop message, 0x23, exists for the file allocation table (FAT16 or FAT32) file systems.
This Stop message has four parameters:
Source file and line number.
A non-zero value that contains the address of the exception record (optional).
A non-zero value that contains the address of the context record (optional).
A non-zero value that contains the address where the original exception occurred (optional).
Parameters for this Stop message are useful only to Microsoft technical support with access to Windows XP Professional source code. Stop messages due to file system issues have the source file and the line number within the source file that generated the error encoded in their first parameter. The first four hexadecimal digits (also known as the high 16 bits) after the 0x identify the source file number, and the last four hexadecimal digits (the low 16 bits) identify the source line in the file where the stop occurred.
The following suggestions are specific to Stop 0x24 errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Malfunctioning SCSI and Advanced Technology Attachment (ATA) hardware or drivers can also adversely affect the system s ability to read and write to disk, causing errors. If using SCSI hard disks, check for cabling and termination problems between the SCSI controller and the disks. Periodically check Event Viewer for error messages related to SCSI or FASTFAT in the System log or Autochk in the Application log. For more information about troubleshooting SCSI adapters and disks, see Troubleshooting Startup, Troubleshooting Disks and File Systems, and Disk Management in this book.
Verify that the tools you use to continually monitor your system, such as virus scanners, backup programs, or disk defragmenters are compatible with Windows XP Professional. Some disks and adapters come packaged with diagnostic software that you can use to run hardware tests. For more information, see the owner s manual for your computer, hard disk, or controller. For more information about Autochk, see Troubleshooting Disks and File Systems in this book.
To test hard disk or volume integrity
Method 1:
In the Run dialog box, in the Open box type:
Cmd
Start the Chkdsk tool, which detects and attempts to resolve file system structural corruption. At the command prompt type:
chkdsk drive: /f
Method 2:
Double-click My Computer, and then select the hard disk you want to check.
On the File menu, click Properties.
Click the Tools tab.
In the Error-checking box, click Check Now.
In Check disk options, select the Scan for and attempt recovery of bad sectors check box. You can also select the Automatically fix file system errors check box.
If the volume you are checking is in use, a message asks whether you want to delay disk error checking until the next time you restart your computer. After you restart, disk error checking runs and the volume chosen is not available to run other tasks during this process. If you cannot restart the computer due to the error, use safe mode or Recovery Console.
If you are not using the NTFS file system, and the system partition is formatted with the file allocation table (FAT16 or FAT32) file system, long file name (LFN) information can be lost if hard disk tools are started from an MS DOS command prompt. A command prompt appears when using a startup floppy disk or when using the command prompt startup option on multiple boot systems that use FAT16 or FAT32 partitions with Microsoft Windows 95 OEM Service Release 2 (OSR2), Microsoft Windows 98, or Microsoft Windows Millennium Edition (Me) installed. Do not use tools meant for other operating systems on Windows XP Professional partitions.
For more information about disks and file systems, see Disk Management, File Systems, and Troubleshooting Disks and File Systems in this book.
Nonpaged pool memory might be depleted, which can cause the system to stop. You can resolve this situation by adding more RAM, which increases the quantity of nonpaged pool memory available to the kernel. You can also reduce the number of files on the Services for Macintosh volume, if applicable.
For more information about Stop 0x24 messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x00000024, and 0x24.
The Stop 0x2E message indicates a system memory parity error. The cause is typically failed or defective RAM (including motherboard, Level 2 cache, or video memory), incompatible or mismatched memory hardware, or when a device driver attempts to access an address in the 0x8xxxxxxx range that does not exist (does not map to a physical address). A Stop 0x2E message can also indicate hard disk damage caused by viruses or other problems.
This Stop message has four parameters:
Virtual address that caused the fault.
Physical address that caused the fault.
Processor status register
Faulting instruction register
The following suggestions are specific to Stop 0x2E errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Stop 0x2E is typically due to defective, malfunctioning, or failed memory hardware, such as memory modules, Level 2 (L2) SRAM cache, or video adapter RAM. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.
Stop 0x2E messages can also occur after installing faulty drivers or system services. If a file name is given, you need to disable, remove, or roll back that driver. Disable the service or application and confirm that this resolves the error. If so, contact the hardware manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools.
Hard disk corruption can also cause this Stop message. For more information about checking hard disk integrity, see the instructions provided in Stop 0x00000024 or NTFS_FILE_SYSTEM earlier in this appendix. Also see Troubleshooting Disks and File Systems in this book.
The problem might also be due to cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.
For more information about Stop 0x2E messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x0000002E, and 0x2E.
The Stop 0x3F message indicates one or more of the following problems:
The system Page Table Entries (PTEs) are depleted or fragmented due to the system performing a large number of input/output (I/O) actions.
A faulty device driver is not managing memory properly.
An application, such as a backup program, is improperly allocating large amounts of kernel memory.
Depending on the configuration of your system, the value of the first parameter might vary. Possible values for the first parameter and the information returned are as follows:
0x0000000A - Page Table Entry (PTE) type: 0x00000000 = system expansion, 0x00000001 = nonpaged pool expansion
0x0000000B - Requested size
0x0000000C - Total free system PTEs
0x0000000D - Total system PTEs
The following suggestions are specific to Stop 3F errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Stop 0x3F messages can occur after installing faulty drivers or system services. If a file name is given, you need to disable, remove, or roll back that driver. Disable the service or application and confirm that this resolves the error. If so, contact the hardware manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools.
The system might not actually be out of PTEs, but a contiguous memory block of sufficient size is not available to satisfy a driver or application request. Check for the availability of updated driver or application files and consult the hardware or program documentation for minimum system requirements.
Another cause is excessive demands for system PTE by applications. This situation is more common in server environments. Windows XP Professional provides a registry entry, SystemPages, that you can use to increase the number of PTEs allocated.
| Caution | Do not edit the registry unless you have no alternative. The registry editor bypasses standard safeguards, allowing settings that can damage your system, or even require you to reinstall Windows. If you must edit the registry, back it up first and see the Registry Reference in the Microsoft Windows 2000 Server Resource Kit at http://www.microsoft.com/reskit |
To increase the number of PTEs allocated in the registry
In the Run dialog box, and in the Open box, type: regedit
In the registry editor, navigate to the subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management.
Double-click on PagedPoolSize and SystemPages to view the value for each entry.
If PagedPoolSize is not zero, assign a value of 0.
If SystemPages is not zero, assign a value of 40000 for systems with 128 MB (or less) of memory, or 110000 for systems with 128 MB to 256 MB of memory. For systems with more memory, do not increase the SystemPages value above 110000 without contacting Microsoft technical support.
Click OK, and then close the registry editor.
Restart your computer.
A related Stop message, 0x000000D8: DRIVER_USED_EXCESSIVE_PTES, is described later in this appendix.
For more information about Stop 0x3F messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x0000003F, and 0x3F.
The Stop 0x50 message indicates that requested data was not in memory. The system generates an exception error when using a reference to an invalid system memory address. Defective memory (including main memory, L2 RAM cache, video RAM) or incompatible software (including remote control and antivirus software) might cause Stop 0x50 messages.
This Stop message has four parameters:
Memory address that caused the fault.
Type of access (0x00000000 = read operation, 0x00000001 = write operation).
If not zero, the instruction address that referenced the address in parameter 0x00000001.
This parameter is reserved (set aside for future use).
The following suggestions are specific to Stop 0x50 errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
If you added new hardware recently, remove and replace the hardware to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the hardware manufacturer to determine if the component has failed.
Stop 0x50 messages can also occur after installing faulty drivers or system services. If the file name is listed, you need to disable, remove, or roll back that driver. If not, disable the recently installed service or application to determine if this resolves the error. If this does not resolve the problem, contact the hardware manufacturer for updates. Using updated drivers and software is especially important for network interface cards, video adapters, backup programs, multimedia applications, antivirus scanners, and CD mastering tools. If an updated driver is not available, attempt to use a driver from a similar device in the same family. For example, if printing to a Model 1100C printer causes Stop 0x50 errors, using a printer driver meant for a Model 1100A or Model 1000 might temporarily resolve the problem.
For more information about Stop 0x50 messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x00000050, and 0x50.
The Stop 0x77 message indicates that a page of kernel data requested from the paging (virtual memory) file could not be found or read into memory. This Stop message can also indicate disk hardware failure, disk data corruption, or possible virus infection.
This Stop message has four parameters. The following set of definitions applies only if the first and third parameters are both zero:
This value is 0x00000000 (zero).
Value found in the stack.
This value is 0x00000000 (zero).
Address of signature on kernel stack.
Otherwise, the following definitions apply:
Status code.
I/O status code.
Page file number.
Offset into page file.
Frequently, the cause of this error can be determined from the second parameter, the I/O status code. Some common status codes are:
0xC000009A, or STATUS_INSUFFICIENT_RESOURCES, indicates a lack of nonpaged pool resources.
0xC000009C, or STATUS_DEVICE_DATA_ERROR, generally indicates bad blocks (sectors) on the hard disk.
0xC000009D, or STATUS_DEVICE_NOT_CONNECTED, indicates defective or loose data or power cables, a problem with SCSI termination, or improper controller or hard disk configuration.
0xC000016A, or STATUS_DISK_OPERATION_FAILED, also indicates bad blocks (sectors) on the hard disk.
0xC0000185, or STATUS_IO_DEVICE_ERROR, indicates improper termination, defective storage controller hardware, defective disk cabling, or two devices attempting to use the same system resources.
For information about other possible status codes that can be returned, see the file Ntstatus.h of the Windows XP Professional Driver Development Kit (DDK). For more information about the DDK, see the Driver Development Kits link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources
The following suggestions are specific to Stop 0x70 errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Stop 0x77 messages can be caused by bad sectors in the virtual memory paging file or a disk controller error. In extremely rare cases, depleted nonpaged pool resources can cause this error. If the first and third parameters are zero, the stack signature in the kernel stack is missing, which is an error typically caused by defective hardware. If the I/O status is 0xC0000185 and the paging file is on a SCSI disk, check for cabling and termination issues. An I/O status code of 0xC000009C or 0xC000016A indicates that the requested data could not be found. You can try to correct this by restarting the computer. If a problem with disk integrity exists, Autochk, a program that attempts to mark bad disk sectors as defective so that they are not used in the future, starts automatically. If Autochk fails to run, you can manually perform the integrity check yourself by following the instructions to run Chkdsk provided in Stop 0x00000024 or NTFS_FILE_SYSTEM earlier in this appendix. For more information about Autochk and Chkdsk, see Troubleshooting Disks and File Systems in this book.
Another cause of Stop 0x77 messages is defective, malfunctioning, or failed memory hardware, such as memory modules, Level 2 (L2) SRAM cache, or video adapter RAM. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.
The problem might also be due to cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.
Problems that cause Stop 0x77 messages can also cause Stop 0x7A messages. For more information about Stop 0x7A messages, see Stop 0x0000007A or KERNEL_DATA_INPAGE_ERROR later in this appendix.
For more information about Stop 0x77 messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x00000077, and 0x77.
The Stop 0x79 message indicates that the hardware abstraction layer (HAL) and the kernel type for the computer do not match. This error most often occurs when ACPI firmware settings are changed. For example, you might install Windows XP Professional on an x86-based computer with the firmware ACPI enable option enabled and later decide to disable it. This error can also result when mismatched single and multi-processor configuration files are copied to the system.
The content of the information provided by a 0x79 Stop message varies according to the value of the first parameter. Three different values for Parameter 1 are possible. The information in the next two parameters depends upon the value of Parameter 1 as shown in Table C-3.
| Parameter 1 | Parameter 2 | Parameter 3 | Description |
|---|---|---|---|
| 0x00000001 | Release level of Ntoskrnl.exe | Release level of Hal.dll | PRCB release level mismatch |
| 0x00000002 | Build type of Ntoskrnl.exe | Build type of Hal.dll | Build type mismatch |
When the value of Parameter 1 is set to 0x00000002, the following build type codes become effective:
0x00000000: Multiprocessor-enabled free build
0x00000001: Multiprocessor-enabled checked build
0x00000002: Single-processor free build
The following suggestions are specific to Stop 0x79 errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
A Stop 0x79 message occurs when the system is using out-of-date Ntoskrnl.exe or Hal.dll files. This can occur after manual repairs that involve copying incorrect files to the system. This error also occurs when using mismatched files, such as copying a multiprocessor HAL on to a system using a single-processor kernel (or vice versa). The kernel and HAL files for single-processor and multiprocessor systems are stored on the Windows XP Professional operating system CD using two different file names. For example, the single and multi-processor versions of the kernel, named Ntoskrnl.exe and Ntkrnlmp.exe respectively. Setup copies either Ntoskrnl.exe or Ntkrnlmp.exe to your system as Ntoskrnl.exe. In Recovery Console, you can use the Copy command to copy the correct HAL or kernel files from the CD to the appropriate folder on the hard disk. For more information about Recovery Console, see Windows XP Professional Help and Support Center, Tools for Troubleshooting and Troubleshooting Concepts and Strategies in this book.
If you experience Stop 0x79 messages after changing firmware settings, restore the original settings used during Windows XP Professional Setup.
Because systems that use the ACPI HAL ignore IRQ assignments stored in firmware, you can only manually change IRQ settings for non-ACPI (Standard PC HAL) systems. Some x86-based provide the option to toggle ACPI functionality. To disable or re-enable ACPI, you must change firmware settings and reinstall Windows XP Professional. Because of the numerous registry and system file changes required, you must run Setup again (an upgrade installation does not work).
For more information about Stop 0x79 messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x00000079, and 0x79.
The Stop 0x7A message indicates that a page of kernel data was not found in the paging (virtual memory) file and could not be read into memory. This might be due to incompatible disk or controller drivers, firmware, or hardware.
This Stop message has four parameters:
Lock type value (0x00000001, 0x00000002, 0x00000003, or page table entry (PTE) address).
I/O status code.
If the lock type is 0x00000001, this parameter represents the current process. If the lock type is 0x00000003, this parameter represents the virtual address.
The virtual address that could not be read into memory.
Frequently, the cause of this error can be determined from the second parameter, the I/O status code. Some common status codes are:
0xC000009A, or STATUS_INSUFFICIENT_RESOURCES, indicates a lack of nonpaged pool resources.
0xC000009C, or STATUS_DEVICE_DATA_ERROR, indicates bad blocks (sectors) on the hard disk.
0xC000009D, or STATUS_DEVICE_NOT_CONNECTED, indicates defective or loose data or power cables, a problem with SCSI termination, or improper controller or disk configuration.
0xC000016A, or STATUS_DISK_OPERATION_FAILED, indicates bad blocks (sectors) on the hard disk.
0xC0000185, or STATUS_IO_DEVICE_ERROR, indicates improper termination, defective storage controller hardware, or defective disk cabling, or two devices attempting to use the same resources.
For information about other possible status codes that might be returned, see the file Ntstatus.h of the Windows XP Professional Driver Development Kit (DDK). For more information about the DDK, see the Driver Development Kits link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources
The following suggestions are specific to Stop 0x7A errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Stop 0x7A can be caused by bad sectors in the virtual memory paging file, disk controller error, virus infection, or memory hardware problems. In extremely rare cases, depleted nonpaged pool resources can cause this error. If the first and third parameters are zero, the stack signature in the kernel stack is missing, an error typically caused by defective hardware. If the I/O status is 0xC0000185 and the paging file is on a SCSI disk, check for cabling and termination issues. An I/O status code of 0xC000009C or 0xC000016A indicates that the requested data could not be found. You can try to correct this by restarting the computer. If a problem with disk integrity exists, Autochk, a program that attempts to mark bad disk sectors as defective so that they are not used in the future, starts automatically. If Autochk fails to run, you can manually perform the integrity check yourself by following the instructions to run Chkdsk provided in Stop 0x00000024 or NTFS_FILE_SYSTEM earlier in this appendix. For more information about Autochk and Chkdsk, see Troubleshooting Disks and File Systems in this book.
Another cause of Stop 0x7A messages is defective, malfunctioning, or failed memory hardware, such as memory modules, Level 2 (L2) SRAM cache, or video adapter RAM. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.
Check the hardware manufacturer s Web site for updates to disk adapter firmware or drivers that improve compatibility. Verify that your disks and controller support the same set of advanced features, such as higher transfer rates. If necessary, select a slower transfer rate if an update is not yet available. Consult your hardware or device documentation for more information.
| Warning | You can install disk controller drivers not present on the Windows XP Professional operating system CD by responding to the following prompt shortly after starting Setup: Press F6 if you need to install a third party SCSI or RAID driver. Press F6, and when prompted, provide the appropriate storage controller driver (ATA or SCSI) supplied by the manufacturer. |
The problem might also be due to cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.
Problems that cause Stop 0x7A messages can also cause Stop 0x77 messages. For more information about Stop 0x77 messages, see Stop 0x00000077 or KERNEL_STACK_INPAGE_ERROR earlier in this appendix.
For more information about Stop 0x7A messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x0000007A, and 0x7A.
The Stop 0x7B message indicates that Windows XP Professional has lost access to the system partition or boot volume during the startup process. Installing incorrect device drivers when installing or upgrading storage adapter hardware typically causes stop 0x7B errors. Stop 0x7B errors could also indicate possible virus infection.
This Stop message has four parameters:
The address of a Unicode string data structure representing the Advanced Reduced Instruction Set Computing (RISC) Computing (ARC) specification name of the device at which you attempted startup.
Pointer to ARC name string in memory.
This value is 0x00000000 (zero).
This value is 0x00000000 (zero).
The first parameter typically contains two separate pieces of data. For example, if the parameter is 0x00800020, 0x0020 is the actual length of the Unicode string and 0x0080 is the maximum ARC name string length. The next parameter contains the address of the buffer. This address is in system space, so the high-order bit is set.
If the file system is unable to mount the boot device or simply does not recognize the data on the boot device as a file system structure, the following parameter definition applies:
The address of the device object that could not be mounted.
Error code value or 0x00000000 (zero).
This value is 0x00000000 (zero).
This value is 0x00000000 (zero).
The value of the first parameter determines whether the parameter is a pointer to an ARC name string (ARC names are a generic method of identifying devices within the ARC environment) or a device object, because a Unicode string never has an odd number of bytes, and a device object always has a Type code of 0003.
The second parameter is very important because it can indicate whether the 0x7B Stop message was caused by file system issues or problems with storage hardware and drivers. Values of 0xC000034 or 0xC000000E typically indicate:
Disks or storage controllers that are failing, defective, or improperly configured.
Storage-related drivers or programs (tape management software, for example) that are not fully compatible with Windows XP Professional.
The following suggestions are specific to Stop 0x7B errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
During I/O system initialization, the controller or driver for the startup device (typically the hard disk) might have failed to initialize the necessary hardware. File system initialization might have failed because of disk or controller failure, or because the file system did not recognize the data on the boot device.
Repartitioning disks, adding new disks, or upgrading to a new disk controller might cause the information in the Boot.ini file, or Boot Manager, to become outdated. If this Stop message occurs after installing new disks to your system, edit the Boot.ini file or adjust the Boot Manager parameters to allow the system to start. If the error occurs after upgrading the disk controller, verify that the new hardware is functioning and correctly configured. For more information about the Boot.ini file, see Troubleshooting Startup in this book.
Verify that the system firmware and disk controller BIOS settings are correct and that the storage device was properly installed. If you are unsure, consult your computer s documentation about restoring default firmware settings or configuring your system to auto-detect settings. If the error occurs during Windows XP Professional setup, the problem might be due to unsupported disk controller hardware. In some cases, drivers for new hardware are not in the Windows XP Professional Driver.cab library, and you need to provide additional drivers to complete the Windows XP Professional setup successfully. If this is the case, follow the hardware manufacturer s instructions when installing drivers. Periodically check for driver and firmware updates.
Hard disk corruption can also cause this Stop message. For more information about checking hard disk integrity, see the instructions provided in Stop 0x00000024 or NTFS_FILE_SYSTEM earlier in this appendix.
Problems that cause 0x7B errors might also cause Stop 0xED errors. For more information about 0xED Stop messages, see Stop 0x0000007B or INACCESSIBLE_BOOT_DEVICE later in this appendix.
For more information about Stop 0x7B messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits /webresources. Search using keywords winnt, 0x0000007B, 0x7B, and Txtsetup.oem.
The Stop 0x7F message indicates that one of three types of problems occurred in kernel-mode:
A condition that the kernel is not allowed to have or intercept (also known as a bound trap).
Software problems.
Hardware failures.
This Stop message has four parameters:
Processor exception code.
This value is 0x00000000 (zero).
This value is 0x00000000 (zero).
This value is 0x00000000 (zero).
The first parameter is the most important and can have several different values, indicating different causes of this error. You can find all conditions that cause a Stop 0x7F in any x86 microprocessor reference manual because they are specific to the x86 platform. Here are some of the most common exception codes:
0x00000000, or a divide by zero error, occurs when a divide (DIV) instruction is run and the divisor is 0. Memory corruption, other hardware failures, or software problems can cause this message.
0x00000004, or Overflow, occurs when the processor carries out a call to an interrupt handler when the overflow (OF) flag is set.
0x00000005, or Bounds Check Fault, indicates that the processor, while carrying out a BOUND instruction, found that the operand exceeded the specified limits. BOUND instructions are used to ensure that a signed array index is within a certain range.
0x00000006, or Invalid Opcode, is generated when the processor attempts to run an invalid instruction. This typically occurs when the instruction pointer is corrupted due to a hardware memory problem and is pointing to a wrong location.
0x00000008, or Double Fault, indicates an exception while trying to call the handler for a prior exception. Normally, two exceptions can be handled serially, but there are certain exceptions (almost always caused by hardware problems) that cause the processor to signal a double fault.
Less common codes include:
0x00000001: A system-debugger call.
0x00000003: A debugger breakpoint.
0x0000000A: A corrupted Task State Segment.
0x0000000B: An access to a memory segment that was not present.
0x0000000C: An access to memory beyond the limits of a stack.
0x0000000D: An exception not covered by some other exception; a protection fault that pertains to access violations for applications.
The following suggestions are specific to Stop 0x7F errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Stop 0x7F messages are typically due to defective, malfunctioning, or failed memory hardware. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.
Running the CPU beyond the rated specification, known as overclocking, can cause Stop 0x7F or other error messages due to heat buildup. When diagnosing problems on overclocked systems, first restore all clock and bus speed settings to the manufacturer recommended values to determine if this resolves the issues.
The problem might also be due to cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.
Stop 0x7F messages can occur after installing incompatible applications, drivers, or system services. Contact the software manufacturer about possible Windows XP Professional-specific updates. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools.
For more information about Stop 0x7F messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x0000007F, and 0x7F.
The Stop 0x9F message indicates that a driver is in an inconsistent or invalid power state.
Table C-4 describes the information provided by Stop 0x9F messages. The value of the first parameter indicates the type of violation (see the Description column) and determines the meaning of the next three parameters.
| Parameter 1 | Parameter 2 | Parameter 3 | Parameter 4 | Description |
|---|---|---|---|---|
| 0x00000001 | Pointer to the device object | Reserved | Reserved | The device object being freed still has an incomplete power request pending. |
| 0x00000002 | Pointer to the target device object | Pointer to the device object | Reserved | The device object completed the I/O request packet for the system power state request, but failed to call PoStartNextPowerIrp. |
| 0x00000003 | Pointer to the target device object | Pointer to the device object | The I/O request packet | The device driver did not properly set the I/O request packet as pending or complete the I/O request packet. |
| 0x00000100 | Pointer to the nonpaged device object | Pointer to the target device object | Pointer to the device object to notify | The device objects in the dev node were inconsistent in their use of DO_POWER_PAGAB LE. |
| 0x00000101 | Child device object | Child device object | Parent device object | A parent device object has detected that a child device has not set the DO_POWER_PAGAB LE bit. |
This Stop message typically occurs during events that involve power state transitions, such as:
Shutting down.
Suspending or resuming from standby mode.
Suspending or resuming from hibernate mode.
The following suggestions are specific to Stop 0x9F errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Stop 0x9F messages can occur after installing faulty applications or drivers or system services. If a file is listed by name and you can associate it with an application, uninstall the application. For drivers, disable, remove, or roll back that driver to determine if this resolves the error. If it does, contact the hardware manufacturer for a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools.
For information about troubleshooting standby and hibernate mode issues, see Troubleshooting Startup in this book. Also see article Q266169, How to Troubleshoot Problems with Standby Mode, Hibernate Mode, and Shutting Down Your Computer in Windows 2000. To find this article, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources
For more information about Stop 0x9F messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x0000009F, and 0x9F.
The Stop 0xBE message indicates that a driver attempted to write to read-only memory.
This Stop message has four parameters:
Virtual address of attempted write.
PTE contents.
Reserved.
Reserved.
The following suggestion is specific to Stop 0xBE errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
A Stop 0xBE message might occur after installing a faulty device driver, system service, or firmware. If a Stop message lists a driver by name, disable, remove, or roll back the driver to correct the problem. If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, DVD playback, and CD mastering tools.
For more information about Stop 0xBE messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits /webresources. Search using keywords winnt, 0x000000BE, and 0xBE.
The Stop 0xC2 message indicates that a kernel-mode process or driver incorrectly attempted to perform memory operations in the following ways:
By allocating a memory pool size of zero bytes.
By allocating a memory pool that does not exist.
By attempting to free a memory pool that is already free.
By allocating or freeing a memory pool at an IRQL that was too high.
This Stop message is typically due to a faulty driver or software.
Table C-5 describes the information provided by Stop 0xC2 messages. The value of the first parameter indicates the type of violation (see the Description column) and determines the meaning of the next three parameters.
| Parameter 1 | Parameter 2 | Parameter 3 | Parameter 4 | Description |
|---|---|---|---|---|
| 0x00000000 | This value is always 0 | The pool type being allocated | The pool tag being used | The caller is requesting a zero byte pool allocation |
| 0x00000001, 0x00000002 , or 0x00000004 | Pointer to pool header | First part of pool header contents | This value is always zero | Pool header has been corrupted |
| 0x00000006 | Reserved | Pointer to pool header | Pool header contents | Attempt to free a memory pool that was already freed |
| 0x00000007 | Reserved | Pointer to pool header | This value is always zero | Attempt to free a memory pool that was already freed |
| 0x00000008 | Current IRQL | Pool type | Size of allocation | Attempt to allocate pool at invalid IRQL |
| 0x00000009 | Current IRQL | Pool type | Address of pool | Attempt to free pool at invalid IRQL |
| 0x00000040 | Starting address | Start of system address space | This value is always zero | Attempt to free usermode address to kernel pool |
| 0x00000041 | Starting address | Physical page frame | Highest physical page frame | Attempt to free a non-allocated nonpaged pool address |
| 0x00000042 or 0x00000043 | Address being freed | This value is always zero | This value is always zero | Attempt to free a virtual address that was never in any pool |
| 0x00000050 | Starting address | Start offset in pages from beginning of paged pool | Size in bytes of paged pool | Attempt to free a non-allocated paged pool address |
| 0x00000099 | Address being freed | This value is always zero | This value is always zero | Attempt to free pool with invalid address or corruption in pool header |
| 0x0000009A | Pool type | Size of allocation in bytes | Allocation s pool tag | Attempt to allocate must-succeed |
The following suggestions are specific to Stop 0xC2 errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
A Stop 0xC2 message might occur after installing a faulty device driver, system service, or firmware. If a Stop message lists a driver by name, disable, remove, or roll back the driver to correct the problem. If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, DVD playback, and CD mastering tools.
A Stop 0xC2 message might also be due to failing or defective hardware. If a Stop message points to a category of devices (such as disk controllers, for example), try removing or replacing the hardware to determine if it is causing the problem.
If you encounter a Stop 0xC2 message while upgrading to Windows XP Professional, the problem might be due to an incompatible driver, system service, virus scanner, or backup. To avoid problems while upgrading, simplify your hardware configuration and remove all third-party device drivers and system services (including virus scanners) prior to running setup. After you have successfully installed Windows XP Professional, contact the hardware manufacturer to obtain compatible updates. For more information about simplifying your system for troubleshooting purposes, see Troubleshooting Concepts and Strategies and Troubleshooting Startup in this book.
For more information about Stop 0xC2 messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits /webresources. Search using keywords winnt, 0x000000C2, and 0xC2.
This Stop message indicates that a driver failed to cancel pending operations before exiting.
This Stop message has four parameters:
Memory address referenced.
Type of access (0x00000000 = read operation, 0x00000001 = write operation).
If non-zero, the address of the instruction that referenced the incorrect memory location.
Reserved.
For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Stop 0xCE messages can occur after installing faulty drivers or system services. If a driver is listed by name, disable, remove, or roll back that driver to confirm that this resolves the error. If so, contact the manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD mastering tools.
For more information about Stop 0xCE messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x000000CE, and 0xCE.
The Stop 0xD1 message indicates that the system attempted to access pageable memory using a kernel process IRQL that was too high. Drivers that have used improper addresses typically cause this error.
This Stop message has four parameters:
Memory referenced.
IRQL at time of reference.
Type of access (0x00000000 = read operation, 0x00000001 = write operation).
Address that referenced memory.
For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Stop 0xD1 messages can occur after installing faulty drivers or system services. If a driver is listed by name, disable, remove, or roll back that driver to confirm that this resolves the error. If so, contact the manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD mastering tools.
For more information about Stop 0xD1 messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x000000D1, and 0xD1.
The Stop 0xD8 message typically occurs if your computer runs out of page table entries (PTEs) due to a driver that requests large amounts of kernel memory.
Depending upon the configuration of your system, the number of parameters returned might vary. The four possible values are:
If this parameter has a non-null value, it contains the name of the driver that caused the Stop error.
If the first parameter has a non-null value, this parameter contains the number of PTEs used by the driver that is causing the error.
This parameter represents the total free system PTEs.
This parameter represents the total system PTEs.
For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
For suggestions about resolving problems related to inadequate PTEs, see 0x0000003F or NO_MORE_SYSTEM_PTES earlier in this appendix.
For more information about Stop 0xD8 messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x000000D8, and 0xD8.
A device driver problem is causing the system to pause indefinitely. Typically, this problem is caused by a display driver waiting for the video hardware to enter an idle state. This might indicate a hardware problem with the video adapter or a faulty video driver.
This Stop message has four parameters:
Pointer to the thread object that is caught in an infinite loop.
Pointer to a DEFERRED_WATCHDOG object, useful when using a kernel debugger to find out more information about this problem.
Pointer to graphics device interface (GDI) supplied context.
Additional debugging information.
The following suggestion is specific to Stop 0xEA errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Stop 0xD1 messages can occur after installing faulty drivers (especially video drivers) or system services. If a driver is listed by name, disable, remove, or roll back that driver to confirm that this resolves the error. If so, contact the manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD mastering tools.
For more information about Stop 0xEA messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x000000EA, and 0xEA.
The kernel mode I/O subsystem attempted to mount the boot volume and it failed. This error might also occur during an upgrade to Windows XP Professional on systems that use higher throughput ATA disks or controllers with incorrect cabling. In some cases, your system might appear to work normally after you restart.
This Stop message has two parameters:
Device object of the boot volume
Status code from the file system on why it failed to mount the volume
The following suggestions are specific to Stop 0xED errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
If using higher throughput ATA disks and controllers, those capable of data transfer rates above 33.3 megabytes per second, replace the standard 40-pin cable with an 80-pin cable. Using an 80-pin cable is optional for transfer rates up to and including 33.3 megabytes per second, but is mandatory for higher transfer rates. The additional grounded pins are required to avoid data loss.
Some firmware enables you to force higher transfer rates even when you are using the incorrect cable type. Your firmware might issue a warning but allow the startup process to proceed. Restore the default firmware setting for ATA cable detection.
Problems that cause 0xED errors might also cause Stop 0x7B errors. For more information about 0x7B Stop messages, see Stop 0x0000007B or INACCESSIBLE_BOOT_DEVICE earlier in this appendix.
For more information about Stop 0xED messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows /reskits/webresources. Search using keywords winnt, 0x000000ED, and 0xED.
The Stop 0xF2 message occurs if the kernel detects an interrupt storm. An interrupt storm occurs when a level-interrupt-triggered device fails to release an interrupt request (IRQ). This can result from the following causes:
A device fails to respond to an interrupt release signal sent from a driver.
An incorrectly written device driver fails to send an interrupt release request to a device. The driver fails to determine that the interrupt was hardware initiated.
An incorrectly written device driver claims an interrupt request meant for a different device. This occurs only for multiple devices sharing an IRQ.
The edge level control register is set incorrectly by system firmware.
Edge level and level-interrupt-triggered devices are incorrectly assigned the same IRQ (for example, a serial port and a Peripheral Component Interconnect (PCI) SCSI controller).
This Stop message has four parameters:
Address of the first or only interrupt service routine (ISR) involved in initiating the interrupt storm.
ISR context value.
Address of the interrupt object that initiated the storm.
0x00000001 if the ISR is not chained (not part of an interrupt sequence).
0x00000002 if the ISR is chained (part of an interrupt sequence).
If the fourth parameter is 0x1, the driver module to which parameters 1 and 3 point probably indicates a driver problem or malfunctioning hardware.
If the fourth parameter is 0x2, the driver module to which parameter 1 point is the first ISR in the sequence, and might not be the source of the problem.
When a Stop 0xF2 message occurs, it indicates the driver involved in the ISR on the storming IRQ. In addition to four Stop message parameters, a message similar to the following appears:
*** STOP: 0x000000F2 (0xFCA7C55C, 0x817B9B28, 0x817D2AA0, 0x00000002)
An interrupt storm has caused the system to hang.
*** Address FCA7C55C base at FCA72000, Datestamp 3A72BDEF - ACPI.sys
The following suggestions are specific to Stop 0xF2 errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
To resolve this problem, simplify your system s hardware configuration by following these procedures:
Try to identify the device linked to the driver module indicated in the Stop message. Remove the conflicting hardware to determine if this resolves the issue. If the problem persists, identify other devices using the same IRQ by using Device Manager or System Information. Then remove all devices using the same IRQ and reinstall them one at time until you can reproduce the problem. Check for updated drivers for the problem device on the manufacturer s Web site. For more information about Device Manager, see Managing Devices in this book. For more information about System Information, see Tools for Troubleshooting in this book.
If you cannot associate the device to the driver module indicated in the Stop message, create a list of devices that are sharing IRQs by using Device Manager or System Information. Remove all devices sharing IRQs and reinstall them one at a time until you can reproduce the problem. For example, you find that devices are sharing IRQs 9 and 11 on your computer. To determine the IRQ affected, remove all devices on IRQs 9 and 11. Reinstall devices assigned to IRQ 9 one at a time. If you cannot reproduce the problem, proceed with reinstalling devices assigned to IRQ 11. Check for updated drivers for the problem device on the manufacturer s Web site.
Check the computer or motherboard manufacturer s Web site for updated system firmware. For more information about updating firmware, see Troubleshooting Concepts and Strategies in this book.
Verify that all of your internal and external peripherals appear on the HCL as devices that meet Windows Logo Requirements, and use only drivers digitally signed by Microsoft. For more information about the HCL, Windows Logo Requirements, and compatible device designations, see the Hardware Compatibility List link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Also, see Troubleshooting Concepts and Strategies in this book.
| Note | Although a device might be attached to a bus, a Stop 0xD8 error might occur only when you are actively using a device. For example, you might not experience problems with IEEE 1394, SCSI, or USB host controllers until you attempt to use devices attached to them. |
For more information about simplifying your system configuration as part of diagnosing and troubleshooting problems, see Troubleshooting Startup in this book.
For more information about PCI devices and IRQ sharing, see Microsoft Knowledge Base articles Q170922, How PCI Devices Are Detected and Why They May Fail, and Q252420, General Description of IRQ Sharing in Windows 2000, in the Microsoft Knowledge Base. To find these articles, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources
For more information about Stop 0xF2 messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt, 0x000000F2, and 0xF2.
The Stop 0xC000021A message occurs when Windows XP Professional switches into kernel mode and a user-mode subsystem, such as Winlogon or the Client Server Runtime Subsystem (CSRSS), is compromised and security can no longer be guaranteed. Because Windows XP Professional cannot run without Winlogon or CSRSS, this is one of the few situations where the failure of a user-mode service can cause the system to stop responding. You cannot use the kernel debugger in this situation because the error occurred in a user-mode process.
A Stop 0xC000021A message can also occur when the computer is restarted after a system administrator has modified permissions in such a way that the SYSTEM account no longer has adequate permissions to access system files and folders.
This Stop message has three parameters:
Status code.
This value is 0x00000000 (zero).
This value is 0x00000000 (zero).
For information about all possible status codes that might be returned, see the Ntstatus.h file of the Windows XP Professional Driver Development Kit (DDK). For more information about the DDK, see the Driver Development Kits link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources
The following suggestions are specific to Stop 0x21A errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
Stop 0xC000021A messages occur in a user-mode process and the most common causes are third-party applications. If the error occurred after installing a new or updated device driver, system service, or third-party application, you need to remove, disable, or roll back the driver, or uninstall the new software. Contact the software manufacturer about a possible update.
System file mismatch caused by partially restoring the system from backup media might cause this error (some backup programs do not restore files that they determine are in use). Always use backup software that is Windows XP Professional compatible.
If SYSTEM account permissions were altered, follow the procedures below to regain access to the boot partition:
Perform a parallel Windows XP Professional installation onto a separate partition or drive. Do not use the original drive and folder names because the new Windows XP Professional installation overwrites previous settings. Complete the second installation.
In the Run dialog box, in the Open box, type: c:
Right-click the original Windows XP Professional systemroot folder, and then click Properties.
Click the Security tab, and then grant the local SECURITY account full control of the systemroot folder and its subfolders.
Restart the system, and then select the original Windows XP Professional installation from the startup menu.
For more information about Stop 0xC000021A messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt and 0xC000021A.
This Stop message indicates driver, system file, or disk corruption problems (such as a damaged paging file). Faulty memory hardware can also cause this Stop message to appear.
This Stop message typically displays the name of the damaged file as follows:
STOP: 0xC0000221 STATUS_IMAGE_CHECKSUM_MISMATCH <path>\<file name>
or
Unable to load device driver <driver_name>
The following suggestions are specific to Stop 0x221 errors. For additional troubleshooting suggestions that apply to all Stop errors, see Stop Message Checklist later in this appendix.
You can use Driver Rollback or System Restore from safe mode, to restore a previous driver. You can also use Windows XP Professional recovery features such as the Last Known Good Configuration startup option, Backup, or Automated System Recovery to restore a previous working configuration. After restoring from backup media, you might need to reapply service packs or hotfixes, depending on when the backups were made. For more information about the preceding tools, see Tools for Troubleshooting in this book.
If the Stop message names the specific file, try replacing it manually with a fresh copy from the Windows XP Professional operating system CD using safe mode or Recovery Console. For systems using the FAT16 or FAT32 file system, you have the option of using a Windows 98 or Windows Millennium Edition Emergency Boot Disk to access the hard disk.
If the original file from the operating system CD has a file name that ends with an underscore (_) character, you cannot use the file until it is uncompressed. The Recovery Console s Copy command is ideal for copying compressed files because it detects and expands them. If you do not specify a destination file name, you must rename the expanded file with the correct extension before using it. From safe mode or Recovery Console, you can use the Expand command to uncompress and copy a file to a destination location. In Recovery Console, the expanded file is given the correct name after being copied to the destination location. For more information about the Copy or Expand commands, see Windows XP Professional Help and Support Center and Tools for Troubleshooting in this book.
Stop message 0xC000026C, caused by similar conditions, provides the name of the system file. You can also use the preceding suggestions to resolve this error.
For more information about Stop 0xC0000221 messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources Search using keywords winnt and 0xC0000221.