The Blue Screen of Death: Interpreting STOP Error Messages
| At the beginning of this chapter, we split Windows problems into three primary classifications. You've looked at how to solve problems encountered during Windows installation, and problems related to Windows startup; let's turn our attention to dealing with problems that occur when Windows is already up and running. Although there are a number of different errors that can occur after Windows XP has started up, the most damaging and frustrating is the dreaded STOP error, or Blue Screen of Death (BSOD), which is the first symptom listed in Table 12.1 earlier in this chapter. Note The specific shade of blue in the BSOD is the subject of some debate. I have one friend who insists that it is a shade of periwinkle . Far be it from me to cast aspersions on her color sense, but we'll just leave it at basic blue for the purposes of brevity. The appearance of a STOP error screen is always an unwelcome sight (see Figure 12.6). It indicates that the operating system encountered something so catastrophic or destabilizing that it was unable to continue running. As noted earlier, a STOP error screen can appear during Windows installation, during Windows startup, while you are in the Windows GUI, or even during Windows shutdown. Given that it is one of the more common symptoms of a Windows problem, it is important to know more about what information a STOP error screen contains, and how to interpret it. Figure 12.6. A Blue Screen of Death. Let's go through the content of the BSOD shown here, and see what information you can glean from it. The top line of the screen contains what Microsoft refers to as bugcheck information . This includes a hexadecimal code for the STOP error, followed by a number of error parameters. The parameters (which appear in parentheses) are also written in hexadecimal. This line is followed by a friendly message informing you, in case you hadn't noticed, that Windows has been shut down. Under this message is additional bugcheck information in the form of a symbolic name . The symbolic name is often what you will use to look up more information on the error, including possible solutions. Under the symbolic name is a suggested course of action for you to take. Microsoft refers to this information as the r ecommended user action . Depending on the nature of the STOP error, the recommended user action can sometimes actually be useful. However, it is fairly generic information, and you will often need to do more investigation in order to isolate the cause of the problem. After the recommended user action, you will find (if applicable ) the name of the driver or program that's associated with the STOP error. This information can be very valuable when trying to determine the source of the error, although in some cases it could be a red herring. Finally, the last section of the STOP error screen shows information pertaining to debugging tools and memory dump files. If you have a computer running a kernel debugger hooked up to the malfunctioning system via a COM port, this information will be noted in the last section of the error screen. Also, if Windows was configured to create a memory dump file in the event of a system crash (an option that's configured using the Advanced tab in the System applet in Control Panel), the success or failure of this action will be reported here. Tip There is a very important setting that affects the behavior of STOP errors that's configured through the System applet in Control Panel. On the Advanced tab, in the section labeled System Failure, you will see an option that reads Automatically Restart. If this check box is filled, the system will only display the STOP error screen for as long as it takes to write the memory dump file, after which it will automatically restart the computer. If you want STOP error screens to stay in place until you manually restart the system (this is almost always the case), you should clear the check box for this option. Make a Record of STOP ErrorsWhen a STOP error screen appears, before you do anythingbefore you touch a single key on the keyboard or button on the front of the PCgrab a piece of paper and a pen and write down the contents of the STOP error screen in its entirety. This cannot be stressed enough: If you fail to write down the information from the STOP error screen before rebooting, you may lose a valuable clue that indicates the source of the problem. Don't be in a hurry to press the Reset button; take the time to start documenting the problem so that you have all the information available at your disposal. Common STOP ErrorsAs is often the case with computer-related issues, there are certain problems that are more common to Windows XP than others. This means that there are certain messages that appear on STOP error screens with greater frequency than others. In this section, you will find a list of the most common STOP error messages (and their probable causes) that appear in the event of a system crash. Each STOP error is listed with its bugcheck information and symbolic name, one or more associated explanations for the STOP error, and a number of possible resolutions . STOP: 0x0000000A IRQL_NOT_LESS_OR_EQUAL This STOP error message is often caused by a flawed device driver or system firmware. If the device driver is listed in the STOP error message, try disabling it or rolling back to the previous version. If this STOP error occurs while you are doing an upgrade installation of Windows XP, you should do a compatibility check of the system by using the Windows XP Upgrade Advisor. This error can also occur if there is antivirus or antispyware software running on the system you are trying to upgrade. Be sure to shut down any instances of these types of software before upgrading a previous version of Windows. STOP: 0x0000001E KMODE_EXCEPTION_NOT_HANDLED This STOP error is related to unknown or illegal processor instructions. This error can be caused by a flawed device driver, or by memory or IRQ conflicts. If a driver is mentioned in the error message, disable it or roll back to a previous version. This particular error can also be caused by a third-party "remote control" software program. This is usually indicated by the mention of the file WIN32K.SYS . If this is the case, try to disable the software in question by restarting Windows in Safe mode. STOP: 0x00000024 NTFS_FILE_SYSTEM This message indicates a problem with the NTFS.SYS driver file that is responsible for reading and writing to NTFS file systems. Possible causes for this error are malfunctioning SCSI and/or ATA hard drives or the drivers for such devices. Another possible cause of this error is if you are using certain utilities that access the hard drive in a specific manner, and if these utilities are incompatible with Windows XP. Examples of such programs include antivirus, antispyware, backup, and disk defragmenting software. Check the compatibility of any such programs by looking them up online in the Windows Catalog on the Microsoft website. STOP: 0x0000002E DATA_BUS_ERROR This STOP error message is related to problems with system memory. Types of memory that can cause this error include RAM modules, the Level 2 cache on the CPU, and video memory on a display adapter. Use a third-party utility to test the system RAM, processor, and display adapter memory. Earlier, I mentioned the Windows Memory Diagnostic from Microsoft, which you can use to check system RAM. Another great hardware diagnostic utility is Sandra ( S ystem AN alyser, D iagnostic, and R eporting A ssistant) from SiSoftware. You can download the free Sandra Lite version of this tool at http://www.sisoftware.net/. This error can also indicate that there is a damaged or defective component on the systemboard. If all of the memory checks out as okay, visually inspect the systemboard for any cracks, scratches, or burn marks. STOP: 0x0000003F NO_MORE_SYSTEM_PTES This error message is related to Page Table Entries (PTEs). Specifically , it indicates that the system's PTEs are either depleted or damaged. This can be caused by a flawed device driver, or by an application that is allocating too much kernel memory. If a device driver is listed, try disabling it, rolling it back to a previous version, or replacing it with a newer version. Other possible suspects include recently installed backup programs, multimedia applications, antivirus software, and CD mastering utilities. STOP: 0x00000050 PAGE_FAULT_IN_NONPAGED_AREA Faulty memory, including RAM, processor L2 cache, and video card RAM, are often the culprits behind this STOP error. Test your memory if possible, or if you suspect that a recently installed piece of hardware is the issue, try removing it and see if that solves the problem. STOP: 0x00000077 KERNEL_STACK_INPAGE_ERROR This error is caused when Windows kernel data that's located in the virtual memory page file cannot be found. Possible causes include defective memory modules, bad sectors within the page file on the hard drive, or a disk controller error. More information on this error can be found in the first parameter that appears in parentheses at the top of the STOP error message. Possible entries include:
STOP: 0x00000079 MISMATCHED_HAL This STOP error is displayed when the system tries to use out-of-date versions of the NTOSKRNL.EXE or HAL.DLL files. (HAL stands for Hardware Abstraction Layer .) This error can occur after you have made repairs using Recovery Console. There are two versions of the NTOSKRNL.EXE and HAL.DLL files on the Windows XP installation CD; one version is for single-processor systems, the other is for multiprocessor systems. If you copy the wrong version of either of these files to your system, the MISMATCHED_HAL STOP error will occur. The multi-processor versions of these files are NTKRNLMP.EXE and HALMPS.DLL . STOP: 0x0000007A KERNEL_DATA_INPAGE_ERROR This STOP error is extremely similar to the KERNEL_STACK_INPAGE_ERROR message listed previously in this section. It relates to Windows kernel data that is supposed to be in the page file, but cannot be found or written into memory. Treat this error the same as a KERNEL_STACK_INPAGE_ERROR message. STOP: 0x0000007B INACCESSIBLE_BOOT_DEVICE This error is specific to Windows startup. It indicates that Windows was unable to initialize the file system. This could be caused by a hard drive failure, a damaged hard drive controller, or incorrect settings in the BOOT.INI startup file. If all of the hardware is functioning normally, it is still possible that the startup files have become corrupted, or that the Master Boot Record has become damaged. Follow the instructions in the "Using Recovery Console" section of this chapter to restore these files. STOP: 0x0000007F UNEXPECTED_KERNEL_MODE_TRAP The most common cause of this STOP error is defective memory such as RAM modules, L2 processor cache, or video card memory. It can also be caused by an overheating system; make sure that all cooling fans, particularly CPU heatsink fans, are working properly. STOP: 0x0000009F DRIVER_POWER_STATE_FAILURE This error is based on power-related activities such as shutting down the system, or suspending/resuming from standby or hibernation mode. Check the driver that's named in the error message, and try replacing it or rolling back to a previous version. STOP: 0xBE ATTEMPTED_WRITE_TO_READONLY_MEMORY This is another "bad driver" error. It occurs when a software driver attempts to write to a section of read-only memory. Replace, roll back, or delete. STOP: 0xC2 BAD_POOL_CALLER No, this error has nothing to do with a snarky lifeguard. It has everything to do with a flawed piece of software or device driver trying to do memory operations in ways that it's not supposed to. If it is a software program causing the error, remove it. If it is a device driver, replace, roll back, or delete. Stop: 0x000000CE DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS Another issue related to a misbehaving driver. In this instance, a driver exited without canceling pending operations. Replace, roll back, or delete. STOP: 0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL This error is commonly caused by a flawed driver trying to access pageable memory using an improper IRQL. Replace, roll back, or delete. STOP: 0x000000D8 DRIVER_USED_EXCESSIVE_PTES This error is essentially identical to the NO_MORE_SYSTEM_PTES error listed earlier in this section. Follow the same steps that were given for that STOP error message. STOP: 0x000000EA THREAD_STUCK_IN_DEVICE_DRIVER Driver trouble again...although this error is almost always linked specifically to the video card display driver. Check with the manufacturer for a Windows XP compatible driver. STOP: 0x000000ED UNMOUNTABLE_BOOT_VOLUME This STOP error occurs when the input/output subsystem fails to mount the boot volume. This can be due to a damaged file system, but in certain instances can also be caused by a conflict between the disk controller and the hard drive cable. If the system uses an Ultra Direct Memory Access (UDMA) controller, and the hard drive is plugged in with a standard 40-wire cable rather than the necessary 80-wire UDMA cable, the end result can be the 0x000000ED UNMOUNTABLE_BOOT_VOLUME STOP error. However, if the first parameter to appear in parentheses at the top of the STOP error is 0xC0000032, the problem is being caused by a damaged file system. Try using the CHKDSK /R command from Recovery Console; if this doesn't solve the problem, try using the FIXBOOT command. (You will take a closer look at the CHKDSK tool later in this chapter.) STOP: 0x000000F2 HARDWARE_INTERRUPT_STORM This error is related to interrupt requests (IRQs); specifically, this error occurs when a hardware device fails to comply with an interrupt release signal sent by a device driver. It can also occur if a flawed device driver doesn't send an interrupt release signal to a device, or if the flawed driver claims an IRQ that's assigned to a different device. The HARDWARE_INTERRUPT_STORM error most commonly occurs just after installing a new piece of hardware. Remove the new device, and see if that solves the problem. If it does, check and see if the device appears in the Windows Catalog as a compatible device. You can also look at the manufacturer's website to see if they have any information concerning Windows XP compatibility issues, or if there are newer drivers available for the device. STOP: 0xC000021A STATUS_SYSTEM_PROCESS_TERMINATED This STOP error is usually caused by a recently installed device driver or software program. If the STOP error lists a driver or program file, try removing the driver or program in order to solve the issue. This error can also be caused by restoring system data from a backup set, but the backup program doesn't restore certain files that it believes are currently in use on the system. This can be avoided by ensuring that your backup software is compatible with Windows XP. STOP: 0xC0000221 STATUS_IMAGE_CHECKSUM_MISMATCH This error message is usually attributable to a damaged system file or device driver. The name of the file causing the error will usually appear as part of the STOP message. Try using Safe mode or Recovery Console to replace the file with a new copy from the Windows XP installation CD.  |
EAN: 2147483647
Pages: 128