Troubleshooting Common Stop Messages | Microsoft Corporation Staff, IT Professional Staff - Microsoft Windows 2000 Server Operations Guide

For the most commonly encountered Stop messages, troubleshooting tips and recommendations have been gathered together to help you resolve the problem on your own. If the error persists after you have tried all of the recommendations listed both here and within the Stop message display, contact your technical support group for further assistance.

Stop 0x0000000A or IRQL_NOT_LESS_OR_EQUAL

This Stop message, also known as Stop 0xA, indicates that a kernel-mode process attempted to access a portion of memory at an Interrupt Request Level (IRQL) that was too high. A kernel-mode process can only access other processes that have an IRQL lesser than or equal to its own.

Interpreting the Message

The four parameters listed in the Stop 0xA message are defined in order of appearance as follows :

Memory address referenced
IRQL
Type of access (0 = read operation, 1 = write operation)
Address that referenced memory in parameter 1

If the third parameter is the same as the first parameter, a special condition exists in which a system worker routine, executed by a worker thread to handle background tasks known as work items, returned at a raised IRQL. In that case, the parameters are defined as follows:

Address of the worker routine
IRQL
Address of the worker routine
Address of the work item

Resolving the Problem

Buggy device driver, system service or BIOS. The error that generates Stop 0xA usually occurs after the installation of a buggy device driver, system service, or BIOS. To resolve it quickly, restart your computer, and press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows 2000 Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.

Incompatible device driver, system service, virus scanner or backup tool. If you encounter Stop 0xA while upgrading to a newer version of Windows, it might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version. If possible, remove all third-party device drivers and system services and disable any virus scanners prior to upgrading. Contact the software manufacturers to obtain updates of these tools.

For additional error messages that might help pinpoint the device or driver that is causing the error, check the System Log in Event Viewer. Disabling memory caching of the BIOS might also resolve this error. You should also run hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner's manual for your computer.

If your system has small computer system interface (SCSI) adapters, contact the adapter manufacturer to obtain updated Windows 2000 drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination. For enhanced integrated device electronics (EIDE) devices, define the onboard EIDE port as Primary only. Also, check each EIDE device for the proper master/slave or stand-alone setting. Try removing all EIDE devices except for hard disks.

If the message appears during an installation of Windows 2000, make sure that the computer and all installed peripherals are listed on the Microsoft Windows 2000 Hardware Compatibility List (HCL). For more information about the HCL, see "Additional Resources" at the end of this chapter.

Microsoft periodically releases a package of product improvements and problem resolutions called a Service Pack. Because many problems are resolved by installing the latest Service Pack, it is recommended that all users install them as they become available. To check which Service Pack, if any, is installed on your system, click Start, click Run, type winver, and then press ENTER. The About Windows 2000 dialog box displays the Windows version number and the version number of the Service Pack, if one has been installed. For information about installing the latest Service Pack, see "Additional Resources" at the end of this chapter.

Occasionally, remedies to specific problems are developed after the release of a Service Pack. These remedies are called hotfixes. Microsoft does not recommend that you install a post-Service Pack hotfix unless the specific problem it addresses has been encountered. Service Packs include all of the hotfixes released since the release of the previous Service Pack. The status of hotfix installations is not indicated in the About Windows 2000 dialog box. For information about downloading hotfixes and Service Packs, see "Additional Resources" at the end of this chapter.

For more troubleshooting information about the 0xA Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0x0000000A. For information about this resource, see "Additional Resources" at the end of this chapter.

Stop 0x0000001E or KMODE_EXCEPTION_NOT_HANDLED

This Stop message, also known as Stop 0x1E, indicates that a kernel-mode process tried to execute an illegal or unknown processor instruction. This error handler is a default error handler that catches errors not associated with other specific error handlers.

Interpreting the Message

The four parameters listed in the message are defined in order of appearance as follows:

Exception code that was not handled
Address at which the exception occurred
Parameter 0 of the exception
Parameter 1 of the exception

The first parameter is a Windows 2000 error code, which is defined by the type of error encountered in the file Ntstatus.h of the Windows 2000 Device Driver Kit (DDK). For information about the DDK, see "Additional Resources" at the end of this chapter. The second parameter identifies the address of the module in which the error occurred. Frequently, the address points to an individual driver or piece of faulty hardware, which is generally listed on the third line of the Stop message. Always make a note of this address, as well as the link date of the driver or image that contains it. The last two parameters vary, depending upon the exception that has occurred. You can typically find a description of the parameters that are included with the name of error code in Ntstatus.h. If the error code has no parameters, the last two parameters are listed as 0x00000000.

Resolving the Problem

Hardware incompatibility. First, make sure that any new hardware installed is listed on the Windows 2000 Hardware Compatibility List (HCL). For more information about the HCL, see "Additional Resources" at the end of this chapter.

Buggy device driver or system service. In addition, a buggy device driver or system service might be responsible for this error. Hardware issues, such as memory conflicts and IRQ conflicts, can also generate this error.

If a driver is listed by name within the Stop message, disable or remove that driver. Disable or remove any drivers or services that were recently added. If the error occurs during the startup sequence and the system partition is formatted with NTFS file system, you might be able to use safe mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in safe mode, you need to start the computer by using the Recovery Console to access the file. For more information about safe mode and the Recovery Console, see chapters under "System Recovery" in this book.

If the problem is associated with Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, the service can be removed by starting the system using the Recovery Console and deleting the offending system service file.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing Stop 0x1E. Disabling memory caching of the BIOS might also resolve the error. You should also run hardware diagnostics, especially the memory scanner, supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer.

One type of this kind of error displays exception code 0x80000003. This error indicates a hard-coded breakpoint or assertion was hit, but the system was started with the /NODEBUG switch. This problem should rarely occur. If it occurs repeatedly, make sure a kernel debugger is connected and the system is started with the /DEBUG switch.

The error that generates this message can occur after the first restart during Windows 2000 Setup, or after setup is finished. A possible cause of the error is lack of disk space for installation and system BIOS incompatibilities. For problems during Windows 2000 installation that are associated with a lack of disk space, reduce the number of files on the target hard disk. Check for and delete any unneeded temporary files, Internet cache files, application backup files, and CHK files containing saved file fragments from disk scans. You can also use another hard disk with more free space for the installation. BIOS problems can be resolved by upgrading the system BIOS version.

For more troubleshooting information about the 0x1E Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0x0000001E. For information about this resource, see "Additional Resources" at the end of this chapter.

Stop 0x00000024 or NTFS_FILE_SYSTEM

This Stop message, also known as Stop 0x24, indicates that a problem occurred within Ntfs.sys (the driver file that allows the system to read and write to NTFS drives).

Interpreting the Message

The four parameters listed in the message are defined in order of appearance as follows:

Source file and line number
A non-zero value contains the address of the exception record
A non-zero value contains the address of the context record
A non-zero value contains the address where the original exception occurred

All Stop messages due to problems with the file system have encoded in their first parameter the source file and the line number within the source file that generated the Stop. The high 16 bits (the first four hexadecimal digits after the 0x) identify the source file number, while the lower 16 bits (the last four hexadecimal digits of the parameter) identify the source line in the file where the stop occurred.

Resolving the Problem

Disk Corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and EIDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error.

Check Event Viewer for error messages from SCSI and FASTFAT (System Log) or Autochk (Application Log) that might help pinpoint the device or driver that is causing the error. Try disabling any virus scanners, backup programs, or disk defragmenter tools that continually monitor the system. You should also run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.

Warning

If your system partition is formatted with the file allocation table (FAT) file system, the long file names used by Windows 2000 can be damaged if Scandisk or another MS-DOS-based hard disk tool is used to verify the integrity of your hard disk from an MS-DOS prompt. (An MS-DOS prompt is typically derived from an MS-DOS startup disk or from starting MS-DOS on a multiboot system.) Always use the Windows 2000 version of Chkdsk on Windows 2000 disks.

Depletion of nonpaged pool memory. If you create a Services for Macintosh volume on a large partition (7 gigabytes or larger) with a large number of files (at least 100,000) while the AppleTalk driver Apf.sys is loaded, the indexing routine consumes a large amount of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error. To resolve this error, either increase the amount of installed random access memory (RAM), which increases the quantity of nonpaged pool memory available to the kernel, or reduce the number of files on the Services for Macintosh volume.

Occasionally, remedies to specific problems are developed after the release of a Service Pack. These remedies are called hotfixes. Microsoft does not recommend that you install a post-Service Pack hotfix unless the specific problem it addresses has been encountered. Service Packs include all of the hotfixes released since the release of the previous Service Pack. The status of hotfix installations is not indicated in the About Windows 2000 dialog box. For more information about Service Packs and hotfixes, see "Additional Resources" at the end of this chapter.

For more troubleshooting information about the 0x24 Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0x00000024. For information about this resource, see "Additional Resources" at the end of this chapter.

Stop 0x0000002E or DATA_BUS_ERROR

This message, also known as Stop 0x2E, typically indicates that a parity error in system memory has been detected. This error is almost always caused by a hardware problem—either a configuration issue, defective hardware or incompatible hardware. The exception is when a device driver has accessed an address in the 0x8xxxxxxx range that does not exist (that is, does not have a physical address mapping).

Interpreting the Message

The four parameters listed in the message are defined in order of appearance as follows:

Virtual address that caused the fault
Physical address that caused the fault
Processor status register (PSR)
Faulting instruction register (FIR)

Resolving the Problem

Hardware problem. The most common cause of this error is a hardware problem, usually related to defective RAM, Level 2 (L2) RAM cache, or video RAM.

Stop 0x2E usually occurs after the installation of faulty hardware or when existing hardware fails. If hardware has recently been added to the system, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. You should run hardware diagnostics supplied by the system manufacturer to determine which hardware component has failed. For details on these procedures, see the owner's manual for your computer. Check that all adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure that adapter card contacts are clean.

If the problem occurs on a newly installed system, check the availability of updates for the following items: firmware on reduced instruction set computing (RISC) systems, BIOS revisions on the motherboard, the SCSI controller or network cards. Updates of this kind are typically available on the Web site or BBS of the hardware manufacturer.

If the error occurs after installing a new or updated device driver, the driver should be removed or replaced. If, under this circumstance, the error occurs during startup and the system partition is formatted with NTFS, you might be able to use safe mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in safe mode, you need to start the computer using the Recovery Console in order to access the file. For more information about safe mode and the Recovery Console, see chapters under "System Recovery" in this book.

For additional error messages that might help pinpoint the device or driver that is causing the error, check the System Log in Event Viewer. Disabling memory caching of the BIOS might also resolve this error. In addition, check the system for viruses, using any up-to-date, commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows 2000 file systems can be infected by viruses.

Disk corruption. This error can also be a result of hard disk corruption. Run Chkdsk /f /r on the system partition. You must restart the system before the disk scan begins. If you cannot start the system due to the error, use the Recovery Console and run Chkdsk /r. For more information about the Recovery Console, see chapters under "System Recovery" in this book.

Warning

Microsoft periodically releases a package of product improvements and problem resolutions for Windows 2000 called a Service Pack. Because many problems are resolved by installing the latest Service Pack, it is recommended that all users install them as they become available. To check which Service Pack, if any, is installed on your system, click Start, click Run, type winver, and then press ENTER. The About Windows 2000 dialog box displays the Windows version number and the version number of the Service Pack, if one has been installed.

Occasionally, remedies to specific problems are developed after the release of a Service Pack. These remedies are called hotfixes. Microsoft does not recommend that you install a post-Service Pack hotfix unless the specific problem it addresses has been encountered. Service Packs include all of the hotfixes released since the release of the previous Service Pack. The status of hotfix installations is not indicated in the About Windows 2000 dialog box. For more information about Service Packs and hotfixes, see "Additional Resources" at the end of this chapter.

Finally, if all the above suggestions fail to resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can also cause this error.

For more troubleshooting information about the 0x2E Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0x0000002E. For information about this resource, see "Additional Resources" at the end of this chapter.

Stop 0x00000050 or PAGE_FAULT_IN_NONPAGED_AREA

This Stop message, also known as Stop 0x50, occurs when requested data is not found in memory. The system generates a fault, which normally indicates that the system looks for data in the paging file. In this circumstance, however, the missing data is identified as being located within an area of memory that cannot be read to disk. The system faults, but cannot find, the data and is unable to recover. Faulty hardware, a buggy system service, antivirus software, and a corrupted NTFS volume can all generate this type of error.

Interpreting the Message

The four parameters listed in the message are defined in order of appearance as follows:

Virtual address which caused the fault
Type of access (0 = read operation, 1 = write operation)
If not zero, the instruction address which referenced the address in parameter 1
Opaque information about the stop, interpreted by the kernel

Resolving the Problem

Faulty hardware. Stop 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM). If hardware has been added to the system recently, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. You should run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer.

Buggy system service. Often, the installation of a buggy system service is a culprit. Disable the service and confirm that this resolves the error. If so, contact the manufacturer of the system service about a possible update. If the error occurs during system startup, restart your computer, and press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows 2000 Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.

Antivirus software. Antivirus software can also trigger this error. Disable the program and confirm that this resolves the error. If it does, contact the manufacturer of the program about a possible update.

Corrupted NTFS volume. A corrupted NTFS volume can also generate this error. Run Chkdsk /f /r to detect and repair disk errors. You must restart the system before the disk scan begins on a system partition. If the hard disk is SCSI, check for problems between the SCSI controller and the disk.

Warning

Finally, check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Disabling memory caching of the BIOS might also resolve this error.

Occasionally, remedies to specific problems are developed after the release of a Service Pack. These remedies are called hotfixes. Microsoft does not recommend that you install a post-Service Pack hotfix unless the specific problem it addresses has been encountered. Service Packs include all of the hotfixes released since the release of the previous Service Pack. The status of hotfix installations is not indicated in the About Windows 2000 dialog box. For more information about Service Packs and hotfixes, see "Additional Resources" at the end of this chapter.

For more troubleshooting information about the 0x50 Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0x00000050. For information about this resource, see "Additional Resources" at the end of this chapter.

Stop 0x00000077 or KERNEL_STACK_INPAGE_ERROR

This Stop message, also known as Stop 0x77, indicates that the requested page of kernel data from the paging file could not be read into memory.

Interpreting the Message

The four parameters listed in the message are defined in order of appearance as follows:

(zero)
Value found in stack where signature should be
(zero)
Address of signature on kernel stack

The first set of definitions apply only if the first and third parameters are both zero. Otherwise, the following definitions are applicable:

Status code
I/O status code
Page file number
Offset into page file

Frequently, the cause of this error can be determined from the second parameter, the I/O status code. Examples include:

0xC000009A, or STATUS_INSUFFICIENT_RESOURCES, is caused by lack of nonpaged pool resources.
0xC000009C, or STATUS_DEVICE_DATA_ERROR, is generally due to bad blocks (sectors) on the hard disk.
0xC000009D, or STATUS_DEVICE_NOT_CONNECTED, indicates defective or loose cabling, termination, or the controller not seeing the hard disk.
0xC000016A, or STATUS_DISK_OPERATION_FAILED, is also caused by bad blocks (sectors) on the hard disk.
0xC0000185, or STATUS_IO_DEVICE_ERROR, is caused by improper termination or defective cabling on SCSI devices, or two devices attempting to use the same IRQ.

These codes are the most common ones for which specific causes have been determined. For information about other possible status codes that can be returned, see the file Ntstatus.h of the Windows 2000 Device Driver Kit (DDK). For information about the DDK, see "Additional Resources" at the end of this chapter.

Resolving the Problem

Bad block. Stop 0x77 is caused by a bad block (sector) in a paging file or a disk controller error. In extremely rare cases, it is caused when nonpaged pool resources run out.

If the first and third parameters are zero, the stack signature in the kernel stack was not found. This error is caused by defective hardware. If the I/O status is C0000185 and the paging file is on a SCSI disk, the disk cabling and SCSI termination should be checked for problems.

Viruses. In addition, check your computer for viruses using any up-to-date, commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows 2000 file systems can be infected by viruses.

An I/O status code of 0xC000009C or 0xC000016A normally indicates that the data could not be read from the disk due to a bad block (sector). If you can restart the system after the error, Autochk runs automatically and attempts to map the bad sector to prevent its further use. If Autochk does not scan the hard disk for errors, you can manually start the disk scanner. Run Chkdsk /f /r on the system partition. You must restart the system before the disk scan begins. If you cannot start the system due to the error, use the Recovery Console and run Chkdsk /r. For more information about the Recovery Console, see chapters under "System Recovery" in this book.

Warning

If your system partition is formatted with the FAT file system, the long file names used by Windows 2000 can be damaged if Scandisk or another MS-DOS-based hard disk tool is used to verify the integrity of your hard disk from an MS-DOS prompt. (An MS-DOS prompt is typically derived from a MS-DOS startup disk or from starting MS-DOS on a multiboot system.) Always use the Windows 2000 version of Chkdsk on Windows 2000 disks.

Failing RAM. Another common cause of this error message is failing RAM. You should run hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner's manual for your computer. Also, check that all the adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean.

In addition, check the System Log in Event Viewer for additional error messages that might help pinpoint the device that is causing the error. Disabling memory caching of the BIOS might also resolve this error.

Finally, if all the above steps fail to resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can also cause this error.

For more troubleshooting information about the 0x77 Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0x00000077. For information about this resource, see "Additional Resources" at the end of this chapter.

Stop 0x00000079 or MISMATCHED_HAL

This message, also known as Stop 0x79, is displayed when the hardware abstraction layer (HAL) and the kernel or the computer type do not match. This error most often occurs when single-processor and multiprocessor configuration files are mixed on the same system.

Interpreting the Message

The types of mismatch parameters are defined in order of appearance in the sets as follows. The first parameter determines which set is applicable.

If this parameter is 1, the processor control block (PRCB) release levels mismatch (something is out of date).
Major PRCB level of Ntoskrnl.exe.
Major PRCB level of Hal.dll.
(zero).
– Or –
If this parameter is 2, the build types mismatch.
Build type of Ntoskrnl.exe.
Build type of Hal.dll.
(zero).
(Build Types: 0 = free, multiprocessor-enabled build; 1 = checked, multiprocessor-enabled build; and 2 = free, single-processor build)

Resolving the Problem

Stop 0x79 can occur if either the Ntoskrnl.exe or Hal.dll files have been manually updated. The error can also indicate that one of those two files is out of date (that is, the HAL is designed for Microsoft® Windows NT® version 4.0 and the kernel is for Windows 2000). Additionally, the computer might erroneously have a multiprocessor HAL and a single-processor kernel installed, or vice versa.

The kernel file Ntoskrnl.exe is for single-processor systems and Ntkrnlmp.exe is for multiprocessor systems. However, these file names correspond to the files on the installation media; after Windows 2000 has been installed, the file is renamed to Ntoskrnl.exe, regardless of the source file used. The HAL file also uses the name Hal.dll after installation, but there are several possible HAL files on the installation media.

To resolve this error, restart the computer using either the product CD or the four Setup disks. At the Welcome screen, press F10 to start the Recovery Console. Use the Copy command to copy either the correct HAL or kernel file from the original CD into the appropriate folder on the hard disk. The Copy command detects whether the file to be copied is in the Microsoft compressed file format. If so, it automatically expands the file copied on the target drive. For more information about the Recovery Console, see "System Recovery" in this book.

For more troubleshooting information about the 0x79 Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0x00000079. For information about this resource, see chapters under "Additional Resources" at the end of this chapter.

Stop 0x0000007A or KERNEL_DATA_INPAGE_ERROR

This Stop message, also known as Stop 0x7A, indicates that the requested page of kernel data from the paging file could not be read into memory.

Interpreting the Message

The four parameters listed in the message are defined in order of appearance as follows:

Lock type that was held (value 1, 2, 3, or Page Table Entry, PTE, address).
I/O status code.
Current process (virtual address for lock type 3, or PTE).
Virtual address that could not be read into memory.

For information about all possible status codes that might be returned, see the file Ntstatus.h of the Windows 2000 Device Driver Kit (DDK). For information about the DDK, see "Additional Resources" at the end of this chapter.

Resolving the Problem

Stop 0x7A is usually caused by a bad block (sector) in a paging file, a virus, a disk controller error, or failing RAM. In rare cases, it is caused when nonpaged pool resources run out. It is also caused by defective hardware.

SCSI problems. If the I/O status is C0000185 and the paging file is on a SCSI disk, check the disk cabling and SCSI termination for problems.

Viruses. Check your computer for viruses, using any up-to-date, commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows 2000 file systems can be infected by viruses.

Bad block. An I/O status code of 0xC000009C or 0xC000016A normally indicates the data cannot be read from the disk due to a bad block (sector). If you can restart the system after the error, Autochk runs automatically and attempts to map out the bad sector. If Autochk does not scan the hard disk for errors, you can manually launch the disk scanner. Run Chkdsk /f /r on the system partition. You must restart the system before the disk scan begins. If you cannot start the system due to the error, use the Recovery Console and run Chkdsk /r. For more information about the Recovery Console, see chapters under "System Recovery" in this book.

Warning

Failing RAM. Another common cause of this error message is failing RAM. Run hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner's manual for your computer. Also, check that all adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device that is causing the error. Disabling memory caching of the BIOS might also resolve it.

Occasionally, remedies to specific problems are developed after the release of a Service Pack. These remedies are called hotfixes. Microsoft does not recommend that you install a post-Service Pack hotfix unless the specific problem it addresses has been encountered. Service Packs include all of the hotfixes released since the release of the previous Service Pack. The status of hotfix installations is not indicated in the About Windows 2000 dialog box. For more information about Service Packs and hotfixes, see "Additional Resources" at the end of this chapter.

For more troubleshooting information about the 0x7A Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0x0000007A. For information about this resource, see "Additional Resources" at the end of this chapter.

Stop 0x0000007B or INACCESSIBLE_BOOT_DEVICE

This Stop message, also known as Stop 0x7B, indicates that Windows 2000 lost access to the system partition during the startup process. This error always occurs while the system is starting and cannot be debugged because it generally occurs before the operating system has loaded the debugger.

Interpreting the Message

The four parameters listed in the message are defined in order of appearance as follows:

Address of a Unicode string data structure representing the Advanced RISC Computing (ARC) specification name of the device from which the startup was being attempted
Pointer to ARC name string in memory
(zero)
(zero)

The first parameter typically contains two separate pieces of data. For example, if the parameter is 0x00800020, 0x0020 is the actual length of the Unicode string and 0x0080 is the maximum name string length. The next parameter contains the address of the buffer. This address is in system space, so the high-order bit is set.

If the file system that is supposed to read the boot device failed to initialize or simply did not recognize the data on the boot device as a file system structure, the following parameter definition applies:

Address of the device object that could not be mounted
(zero)
(zero)
(zero)

The value of the first argument determines whether the argument is a pointer to an ARC name string (ARC names are a generic method of identifying devices within the ARC environment) or a device object, because a Unicode string never has an odd number of bytes, and a device object always has a Type code of 0003.

Resolving the Problem

Failed boot device. During I/O system initialization, the boot device driver might have failed to initialize the boot device (typically a hard disk). File system initialization might have failed because it did not recognize the data on the boot device.

Also, repartitioning the system partition or installing a new SCSI adapter or disk controller might induce this error. If this happens, the Boot.ini file must be edited. For additional information about the Boot.ini file, see "Additional Resources" at the end of this chapter.

Incompatible disk hardware. If the error occurred at the initial setup of the system, the system might have been installed on an unsupported disk or SCSI controller. Some controllers are supported only by drivers that are in the Windows Driver Library (WDL), which requires the user to do a custom installation. If Setup autodetected the controller, you might need to skip detection and use a specific manufacturer's diskette to load the driver. Also, check the availability of updates for the system BIOS and SCSI controller firmware. Updates of this kind are typically available on the Web site or BBS of the hardware manufacturer.

Remove any recently added hardware, especially hard disks or controllers, to see if the error is resolved. If the offending piece of hardware was a hard disk, the disk firmware version might be incompatible with Windows 2000. Contact the manufacturer for updates. If the removal of another piece of hardware resolved the error, IRQ or I/O port conflicts likely exist. Reconfigure the new device according to the manufacturer's instructions.

Confirm that all hard disks, hard disk controllers, and SCSI adapters are listed on the Microsoft Windows 2000 Hardware Compatibility List (HCL). For more information about the HCL, see "Additional Resources" at the end of this chapter.

If a driver was recently added, restart your computer, and press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows 2000 Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.

In addition, check your computer for viruses using any up-to-date, commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows 2000 file systems can be infected by viruses.

This error can also be a result of hard disk corruption. Run Chkdsk /f /r on the system partition. You must restart the system before the disk scan begins. If you cannot start the system due to the error, use the Recovery Console and run Chkdsk /r. For more information about the Recovery Console, see chapters under "System Recovery" in this book.

Warning

If your system has SCSI adapters, contact the adapter manufacturer to obtain updated Windows 2000 drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination. For EIDE devices, define the onboard EIDE port as Primary only. Also check each EIDE device for the proper master/slave/stand alone setting. Try removing all EIDE devices except for hard disks. Finally, check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error.

Occasionally, remedies to specific problems are developed after the release of a Service Pack. These remedies are called hotfixes. Microsoft does not recommend that you install a post-Service Pack hotfix unless the specific problem it addresses has been encountered. Service Packs include all of the hotfixes released since the release of the previous Service Pack. The status of hotfix installations is not indicated in the About Windows 2000 dialog box. For more information about Service Packs and hotfixes, see "Additional Resources" at the end of this chapter.

Note

In order to install the latest Service Pack, you might need to install a second, parallel copy of Windows 2000, and then install the latest Service Pack to the new installation, and finally copy updated files to the original installation folders. For information about Service Packs, see "Additional Resources" at the end of this chapter.

For more troubleshooting information about the 0x7B Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0x0000007B. For information about this resource, see "Additional Resources" at the end of this chapter.

Stop 0x0000007F or UNEXPECTED_KERNEL_MODE_TRAP

This Stop message, also known as Stop 0x7F, means that one of two types of problems occurred in kernel-mode, either a kind of condition that the kernel is not allowed to have or catch (a bound trap), or a kind of error that is always fatal. Occasionally, this message can be caused by software problems, but the most common cause is hardware failure.

Interpreting the Message

The four parameters listed in the message are defined in order of appearance as follows:

Processor exception code
(zero)
(zero)
(zero)

The first and most important parameter (0x0000000x) can have several different values. The cause of this error can vary, depending on the value of this parameter. All conditions that cause a Stop 0x7F can be found in any x86 microprocessor reference manual because they are specific to the x86 platform. Here are some of the most common exception codes:

0x00000000, or Divide by Zero Error, is caused when a DIV instruction is run and the divisor is 0. Memory corruption, other hardware problems, or software failures can cause this error.
0x00000004, or Overflow, occurs when the processor executes a call to an interrupt handler when the overflow (OF) flag is set.
0x00000005, or Bounds Check Fault, is generated when the processor, while executing a BOUND instruction, finds that the operand exceeds the specified limits. A BOUND instruction is used to ensure that a signed array index is within a certain range.
0x00000006, or Invalid Opcode, is generated when the processor attempts to run an invalid instruction. This is generally caused when the instruction pointer has become corrupted and is pointing to the wrong location. The most common cause of this is hardware memory corruption.
0x00000008, or Double Fault, is when an exception occurs while trying to call the handler for a prior exception. Normally, the two exceptions can be handled serially. However, there are several exceptions that cannot be handled serially, and in this situation the processor signals a double fault. This is almost always caused by hardware problems.

Other exception codes are defined as follows:

0x00000001—A system-debugger call.
0x00000003—A debugger breakpoint.
0x00000007—A hardware coprocessor instruction with no coprocessor present.
0x0000000A—A corrupted Task State Segment.
0x0000000B—An access to a memory segment that was not present.
0x0000000C—An access to memory beyond the limits of a stack.
0x0000000D—An exception not covered by some other exception; a protection fault that pertains to access violations for applications.

Resolving the Problem

Hardware failure or incompatibility. Stop 0x7F usually occurs after the installation of faulty or mismatched hardware (especially memory) or in the event that installed hardware fails. If hardware was recently added to the system, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. Run hardware diagnostics supplied by the system manufacturer, especially the memory scanner, to determine which hardware component has failed. For details on these procedures, see the owner's manual for your computer. Check that all adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean.

If the error appears on a newly installed system, check the availability of updates for the following items: firmware on RISC systems and BIOS revisions on the motherboard, the SCSI controller or network cards. Updates of this kind are typically available on the Web site or BBS of the hardware manufacturer.

Confirm that all hard disks, hard disk controllers, and SCSI adapters are listed on the Windows 2000 Hardware Compatibility List (HCL). For more information about the HCL, see "Additional Resources" at the end of this chapter.

If the error occurred after the installation of a new or updated device driver, the driver should be removed or replaced. If, under this circumstance, the error occurs during the startup sequence and the system partition is formatted with NTFS, you might be able to use safe mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in safe mode, you need to start the computer using the Recovery Console in order to access the file. For more information about safe mode and the Recovery Console, see chapters under "System Recovery" in this book. Also try restarting your computer, and press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows 2000 Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.

Overclocking. Setting the CPU to run at speeds above the rated specification (known as overclocking the CPU) can cause this error. If this has been done to the computer experiencing the error, return the CPU to the default clock speed setting.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Disabling memory caching of the BIOS might also resolve it.

If you encountered this error while upgrading to Windows 2000, it might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version. If possible, remove all third-party device drivers and system services and disable any virus scanners prior to upgrading. Contact the software manufacturer to obtain updates of these tools.

Occasionally, remedies to specific problems are developed after the release of a Service Pack. These remedies are called hotfixes. Microsoft does not recommend that you install a post-Service Pack hotfix unless the specific problem it addresses has been encountered. Service Packs include all of the hotfixes released since the release of the previous Service Pack. The status of hotfix installations is not indicated in the About Windows 2000 dialog box. For more information about Service Packs and hotfixes, see "Additional Resources" at the end of this chapter.

For more troubleshooting information about the 0x7F Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0x0000007F. For information about this resource, see "Additional Resources" at the end of this chapter.

Stop 0xC000021A or STATUS_SYSTEM_PROCESS_TERMINATED

This Stop message occurs when a user-mode subsystem, such as Winlogon or the Client Server Runtime Subsystem (CSRSS), is fatally compromised and security can no longer be guaranteed. The operating system switches into kernel-mode and generates this error. Because Windows 2000 cannot run without Winlogon or CSRSS, this is one of the few situations where the failure of a user-mode service can bring down the system. Running the kernel debugger is not useful in this situation because the actual error occurred in a user-mode process.

Interpreting the Message

The first three parameters listed in the message are defined in order of appearance as follows:

Status code
(zero)
(zero)

Resolving the Problem

Device drivers, system services, and third-party applications. Because Stop 0xC000021A occurs in a user-mode process, the most common culprits are third-party applications. If the error occurred after the installation of a new or updated device driver, system service or third-party application, the new software should be removed or disabled. Contact the manufacturer of the software about a possible update.

If the error occurs during system startup, restart your computer, and press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows 2000 Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time. If this does not resolve the error, try manually removing the offending software. If the system partition is formatted with FAT, use an MS-DOS startup disk to gain access to the computer's hard disk. If the system partition is formatted with NTFS, you might be able to use safe mode to rename or delete the faulty software. If the faulty software is used as part of the system startup process in safe mode, you need to start the computer using the Recovery Console in order to access the file. For more information about safe mode and the Recovery Console, see chapters under "System Recovery" in this book. If a newly installed piece if hardware is suspected, remove it to see if this resolves the issue.

Try running the Emergency Recovery Disk (ERD) and allow the system to repair any errors that it detects. For more information about the ERD disk, see chapters under "System Recovery" in this book.

Mismatched system files. Mismatched system files can also cause this error. Running a full system restore from tape might generate this error (some restore programs might skip restoring system files they determine are in use). Check if there is an updated version of the Backup/Restore program available from the manufacturer.

Occasionally, remedies to specific problems are developed after the release of a Service Pack. These remedies are called hotfixes. Microsoft does not recommend that you install a post-Service Pack hotfix unless the specific problem it addresses has been encountered. Service Packs include all of the hotfixes released since the release of the previous Service Pack. The status of hotfix installations is not indicated in the About Windows 2000 dialog box. For more information about Service Packs and hotfixes, see "Additional Resources" at the end of this chapter.

For more troubleshooting information about the 0xC000021A Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0xC000021A. For information about this resource, see "Additional Resources" at the end of this chapter.

Stop 0xC0000221 or STATUS_IMAGE_CHECKSUM_MISMATCH

This Stop message indicates that a driver or a system DLL has been corrupted. Typically, the name of the damaged file is displayed as part of the message.

Resolving the Problem

To remedy this error, run the Emergency Recovery Disk (ERD) and allow the system to repair or replace the missing or damaged driver file on the system partition. For more information about the ERD disk, see chapters under "System Recovery" in this book.

You can also run an in-place upgrade over the top of the existing copy of Windows 2000. This preserves all registry settings and configuration information, but replaces all system files. If any Service Packs and hotfixes had previously been applied, you need to reinstall them afterward in the appropriate order (latest Service Pack, then any post-Service Pack hotfixes in the order in which they were originally installed, if applicable).

If a specific file was identified in the Stop message as being corrupted, you can try replacing that individual file manually. If the system partition is formatted with FAT, start from an MS-DOS startup disk and copy the file from the original source onto the hard disk. If the partition is NTFS, you need to restart the system, press F8 at the operating system Loader menu, and choose safe mode with Command Prompt. From there, copy a fresh version of the file from the original source onto the hard disk. If the file is used as part of the system startup process in safe mode, you need to start the computer using the Recovery Console in order to access the file. For more information about safe mode and the Recovery Console, see chapters under "System Recovery" in this book. If these methods fail, try reinstalling Windows 2000 and then restoring the system from a backup.

Note

If the original file from the product CD has a file name extension ending in an underscore, the file needs to be uncompressed before it can be used. The Recovery Console's Copy command automatically detects compressed files and expands them as they are copied to the target location. If you are using safe mode to access a drive, use the Expand command to uncompress and copy the file to the target folder. You can use the Expand command in the command line environment of safe mode.

Disk errors can be a source of file corruption. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.

Warning

If the error occurred immediately after RAM was added to the system, the paging file might be corrupted or the new RAM itself might be either faulty or incompatible.

To determine if newly added RAM is causing a Stop message

Return the system to the original RAM configuration.
Use the Recovery Console to access the partition containing the paging file and delete the file Pagefile.sys. For more information about the Recovery Console, see chapters under "System Recovery" in this book.
While still in the Recovery Console, run Chkdsk /r on the partition that contained the paging file.
Restart the system.
Set the paging file to an optimal level for the amount of RAM added.
Shut down the system and add your RAM.
The new RAM must meet the system manufacturer's specifications for speed, parity, and type (that is, fast page mode (FPM) vs. extended data out (EDO) vs. synchronous dynamic random access memory (SDRAM)). Try to match the new RAM to the existing installed RAM as closely as possible. RAM can come in many different capacities, and more importantly, in different formats (single inline memory modules (SIMMs) or dual inline memory modules (DIMMs)). The electrical contacts can be either gold or tin and it is not wise to mix these contact types.

If you experience the same error message after reinstalling the new RAM, run hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner's manual for your computer.

When you can log on to the system again, check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Disabling memory caching of the BIOS might also resolve this error.

For more troubleshooting information about the 0xC0000221 Stop message, refer to the Microsoft Support Web site, using the keywords winnt and 0xC0000221. For information about these resources, see "Additional Resources" at the end of this chapter.