MyITkb.net

Windows Stop Error codes

Last modified on 2009-05-16 23:42:30 GMT. 31 comments. Top.

Ever wonder what those error codes mean when windows has a blue screen of death? Here is a list of the windows stop codes. The hex number will be the first number that appears in the blue screen of death followed by the comment.

0×0000000A: IRQ_NOT_LESS_OR_EQUAL
Typically due to faulty or incompatible hardware or software. Usually a kernel-mode process or driver attempted to access a memory location to which it did not have permission, or at a kernel Interrupt Request Level (IRQL) that was too high. A kernel-mode process can access only other processes that have a IRQL lower than, or equal to, its own.

This stop error,IRQ_NOT_LESS_OR_EQUAL, is probably the most common stop error experienced from users. Basically a device driver was reading or writing a memory address that is either not assigned to the device driver to use or , as you will see, is no longer available.

How to troubleshoot:

If you recently installed a new device, load the last known good confiuration.

Restart Windows and press F8 when Windows first boots up. Be on the alert that the time you have to press F8 is very short. If you repeatedly press F8 right after the POST test, this should get you to the menu. Then If this this list of Windows stop codes does not have what you are looking for, here is a more complete list of Stop error codes that can be seen in Windows XP Stop errors, Windows Vista stop errors, and as many refer to the Blue screen of deatharrow down to the Last known Good Configuration and press enter. As long as the device did not install any problematic applications outside of the HKLM\System\CurrentControlSet registry hive then this should work. If this does not then load Windows to safe mode and uninstall any applications that were installed by the device driver.

If you did not load, installed, any device drivers, I have found that more often than not the error is attributed to bad hardware. I have seen this error caused by bad memory. Shutdown your pc and follow your manufacturer’s instructions on removing / replacing memory for your PC. If you can, remove only one memory stick at a time to see if the problem goes away. This will tell you which memory stick is bad.

I have also seen this error caused by a failing hard drive. Run chkdsk or scandisk to check the hard drive for bad sectors. If bad sectors are found backup your data and replace the hard drive immediately.

Your BIOS may have an integrated Diagnostic. Watch the POST test, (which is what you see before the operating systems loads. You may see a prompt to press F2 for setup or F12 for boot device. If you press F12, on Dell PC’s, there is a chose for Diagnostic. Run and see if any errors are returned. If errors are returned, take note during which test the error appeared.

For example the memory test is running and an error is reported. This would mean you may have bad memory. Or as another example, during the hard drive test a read or write test fails. Then your hard drive is bad. I would say that if the issue is hardware, the hard drive will most likely be the PC hardware that failed.

0×0000001E: KMODE_EXCEPTION_NOT_HANDLED
The Win XP kernel detected an illegal or unknown processor instruction. The problems that cause this stop message share similarities with those that generate Stop 0xA errors in that they can be due to invalid memory and access violations. This default Windows XP error handler typically intercepts these problems if error-handling routines are not present in the code itself.

0×00000024: NTFS_FILE_SYSTEM
A problem occurred within NTFS.SYS, the driver file that allows the system to read and write to NTFS file system drives. (A similar Stop message,0×00000023, exists for File Allocation Table file systems, FAT16 and FAT32.)

I received this error on Microsoft Windows Vista, 0×00000024 (0×001904ab, 0×82fdfa70, 0×82fdf76c, 0×81c5ef6d). Microsoft Windows Vista Vista returned back this error as being caused by a virus scanner, AVG. Also consider that the hard drive is going bad. Run Check disk to check for disk errors. If there are errors, back up your data as soon as possible and replace the hard drive.

0×0000002E: DATA_BUS_ERROR
This indicates a system memory parity error, typically caused by failed ordefective RAM (including motherboard, Level 2 cache, or video memory),incompatible or mismatched memory hardware, or when a device driver attemptsto access an address in the 0×8xxxxxxx range that does not exist (does not map to a physical address). This Stop message also can indicate hard diskdamage caused by viruses or other problems

0×0000003F: NO_MORE_SYSTEM_PTES Indicates one or more of the following problems: (1) The system Page Table Entries (PTEs) are depleted or fragmented due to the system performing alarge number of input/output (I/O) actions. (2) A faulty device driver is not managing memory properly. (3) An application, such as a backup program, is improperly allocating large amounts of kernel memory.

0×0000004E: PFN_LIST_CORRUPT
This indicates that the memory management Page File Number list is corrupted. Can be caused by corrupt physical RAM.

0×00000050: PAGE_FAULT_IN_NONPAGED_AREA
Requested data was not in memory. An invalid system memory address was referenced. Defective memory (including main memory, L2 RAM cache, video RAM) or incompatible software (including remote control and antivirus software) might cause this Stop message.

Try removing memory. If you can, remove one stick at a time to see if the error goes away. Also try stopping any antivirus software. Check vender’s website for any hotfix’s to the vendor’s antivirus software.

0×00000077: KERNEL_STACK_INPAGE_ERROR
A page of kernel data requested from the pagefile could not be found or read into memory. This message also can indicate disk hardware failure, disk data corruption, or possible virus infection.

0×00000079: MISMATCHED_HAL

0×0000007A: KERNEL_DTA_INPAGE_ERROR
A page of kernel data was not found in the pagefile and could not be read into memory. This might be due to incompatible disk or controller drivers,firmware, or hardware.

0×0000007B: INACCESSIBLE_BOOT_DEVICE
Win XP lost access to the system partition or boot volume during the start up process. Typical causes: Installing incorrect device drivers when installing or upgrading storage adapter hardware, or a virus.

0×0000007F: UNEXPECTED_KERNEL_MODE_TRAP
One of three types of problems occurred in kernel-mode: (1) A bound trap(i.e., a condition that the kernel is not allowed to have or intercept). (2)Software problems. (3) Hardware failures.

0×0000009A: STATUS_INSUFFICIENT_RESOURCES
The Windows kernel has allocated all of its allotted paged-pool memory.

0×0000009F: DRIVER_POWER_STATE_FAILURE
A driver is in an inconsistent or invalid power state. Typically occurs during events that involve power state transitions, such as shutting down,or moving into or out of standby or hibernate mode.

0×000000A5 The cause of this message is always errors in the ACPI BIOS.
Nothing can bedone at an operating system level to fix the problem. This error can be replicated by turning off ACPI in the BIOS. As a result make sure this setting is enabled.

0×000000BE: ATTEMPTED_WRITE_TO_READONLY_MEMORY
A driver attempted to write to read-only memory. Commonly occurs afterinstalling a faulty device driver, system service, or firmware.

0×000000C2: BAD_POOL_CALLER
A kernel-mode process or driver incorrectly attempted to perform memory operations. Typically, a faulty driver or buggy software causes this.

0×000000CE: DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS
A driver failed to cancel pending operations before exiting. Commonly occurs after installing faulty drivers or system services.

0×000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
The system attempted to access pageable memory using a kernel process IRQL that was too high. The most typical cause is a bad device driver (one that uses improper addresses).

0×000000D8: DRIVER_USED_EXCESSIVE_PTES
Typically occurs if your computer runs out of Page Table Entries (PTEs) due to a driver that requests large amounts of kernel memory.

0×000000EA: THREAD_STUCK_IN_DEVICE_DRIVER
A device driver problem has caused the system to pause indefinitely (hang).Typically, this is caused by a display driver waiting for the video hardware to enter an idle state. This might indicate a hardware problem with the video adapter, or a faulty video driver.

0×000000ED: UNMOUNTABLE_BOOT_VOLUME
The kernel mode I/O subsystem attempted to mount the boot volume and it failed. This error also might occur during an upgrade to Win XP on systems that use higher throughput ATA disks or controllers with incorrect cabling. In some cases, your system might appear to work normally after you restart.

0×000000F2: HARDWARE_INTERRUPT_STORM
This error message appers if the kernel detects an interrupt storm i.e.,when a level-interrupt-triggered device fails to release an IRQ. Usually,this is caused by a bad device driver.

0xC0000218: UNKNOWN_HARD_ERROR
A necessary Registry hive file couldn’t be loaded. The file may be corruptor missing (requiring either an Emergency Repair Disk or a Windows reinstallation). The Registry files may have been corrupted because of harddisk corruption or some other hardware problem. A driver may have corruptedthe Registry data while loading into memory, or the memory where the registry is loading may have a parity error (turn off the external cache and check the physical RAM).

0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED
This occurs when Windows XP switches into kernel mode and a user-mode subsystem,such as Winlogon or the Client Server Runtime Subsystem (CSRSS), is compromised and security can no longer be guaranteed. Because Win XP can’t run without Winlogon or CSRSS, this is one of the few situations where the failure of a user-mode service can cause the system to stop responding. This Stop message also can occur when the computer is restarted after a system administrator has modified permissions so that the SYSTEM account no longer has adequate permissions to access system files and folders.

0xC0000221: STATUS_IMAGE_CHECKSUM_MISMATCH
Indicates driver problems, system file problems, disk corruption problems(such as a damaged pagefile), or faulty memory hardware.

0xC000026C
Usually indicates device driver problems.

0xC000021a {Fatal System Error}
This error is a result of the logon process. Specifically the winlogon.exe and csrss.exe.

How to troubleshoot 0xC000021a {Fatal System Error}

• Systems files are corrupt do to a service pack that was interrupted or if a restore was just run from backup, some of the system files have been restored but not all.
• Most common is an external third party program. Third party programs that monitor system files often can cause this error. The third party program will do a partial restore of the syytem files or will block a hotfix or service pack recently.
• Also suspect anti virus or spyware applications. These types of applications should be turned off while applying a service pack.

To determine which process failed, register Dr. Watson as the default system debugger (if it is not already the default debugger). Dr. Watson for Windows NT logs diagnostic information about process failures to a log file (Drwtsn32.log). Also, you can configure this program to produce memory dump files of failed processes that you can analyze in a debugger to determine why a process fails.

To set up Dr. Watson to trap user-mode program errors, follow these steps: 1. At a command prompt, type System Root\System32\Drwtsn32.exe -I, and then press ENTER.

This command configures Dr. Watson as the default system debugger.

2. At a command prompt, type System Root\System32\Drwtsn32.exe, and then select the following options:

• Append to existing log fileCreate crash dumpVisual Notification

3. After the computer restarts from the STOP 0xC000021A error, run Dr. Watson (Drwtsn32.exe).

4. View the Dr. Watson log to determine what user mode process may be causing the problem.

5. If the Dr. Watson log does not contain sufficient information to determine the cause of the problem, analyze the User.dmp file to determine the cause of the STOP 0xC000021A error.

If Dr. Watson did not create a User.dmp file for either Winlogon.exe or Csrss.exe, you may have to use a different tool to generate a memory dump file of the process that fails.

Note Most STOP 0xC000021A errors occur because Winlogon.exe fails, which typically occurs because of a faulty third-party Graphical Identification and Authentication (GINA) DLL. The GINA is a replaceable DLL component that Winlogon.exe loads. The GINA implements the authentication policy of the interactive logon model. The GINA performs all identification and authentication user interactions.

Note Follow the instructions in the Knowledge Base article to troubleshoot a process that shuts down with an exception. While you follow these instructions, monitor the following processes to troubleshoot the STOP 0xC000021A error:

- Winlogon.exe

- Csrss.exe

It is very common for certain types of remote control software to replace the default Windows GINA DLL (Msgina.dll). Therefore, a good first step is to examine the system to see if it has a third-party GINA DLL. To do this, locate the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Value = GinaDLL REG_SZ

If the Gina DLL value is present and is anything other than Msgina.dll, this probably means that a third-party product has changed this value.

If this value is not present, the system uses Msgina.dll as the default GINA DLL.

If this error first occurred after the installation of a new or updated device driver, system service, or third-party program, the new software should be removed or disabled. Contact the manufacturer of the software to see if an update is available.

Last known good configuration

If the previous steps in this article do not resolve the problem, start the computer using the last known good configuration. To start the computer using the last known good configuration, follow these steps:Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1. Click Start, and then click Shut Down.

2. Click Restart, and then click OK.

3. Press F8 at the indicated time:

- For an x86-based computer: When a screen of text appears and then disappears (the screen of text may include a memory test, lines about the BIOS, and other lines), press F8. There may be a prompt that tells you when to press F8.

- For an Itanium architecture-based computer: After making your selection from the boot menu, press F8. There may be a prompt that tells you when to press F8.

4. Use the arrow keys to select Last Known Good Configuration, and then press ENTER. NUM LOCK must be off before the arrow keys on the numeric keypad will function.

5. Use the arrow keys to highlight an operating system, and then press ENTER.

Notes:

• Choosing the Last Known Good Configuration startup option provides a way to recover from problems such as a newly added driver that may be incorrect for your hardware. It does not solve problems caused by corrupted or missing drivers or files.
• When you choose Last Known Good Configuration, only the information in registry key HKLM\System\CurrentControlSet is restored. Any changes you have made in other registry keys remain.

If you can not find the Windows Stop Error code that you are looking for here, try looking at this more complete list of Windows stop error code that can be seen in Windows Vista stop error, Windows XP stop error as many refer to the Blue screen of death: http://msdn2.microsoft.com/en-us/library/ms789516.aspx