How do I find out what caused the Stop 0x0000001E?

Stop 0x0000001E or KMODE_EXCEPTION_NOT_HANDLED

This Stop message, also known as Stop 0x1E, indicates that a kernel-mode process tried to execute an illegal or unknown processor instruction. This error handler is a default error handler that catches errors not associated with other specific error handlers.

Interpreting the Message

The four parameters listed in the message are defined in order of appearance as follows:

1. Exception code that was not handled
2. Address at which the exception occurred
3. Parameter 0 of the exception
4. Parameter 1 of the exception

For example:
STOP: 0x0000001E (0xC0000005, 0xFCA733B9, 0x00000000, 0x00000000)
KMODE_EXCEPTION_NOT_HANDLED 0xC0000005 from 0xFCA733B9 (0x0, 0x0)Address FCA733B9 has base at FCA70000 - SRV.SYS

The first parameter is a Windows 2000 error code, which is defined by the type of error encountered in the file Ntstatus.h of the Microsoft« Windows 2000 Device Driver Development Kit (DDK). Most commonly this is as shown above, 0xC0000005 which means that the program attempted to access memory that was not allocated to it. This is typically caused by a NULL pointer (i.e. 0x00000000) parameter passed to a function. ItÆs not easy to determine if this was the case from the four parameters alone as it may simply mean that there was no 1st or 2nd parameter for this function. See description of parameters three and four below for clarification.

The second parameter identifies the address of the module in which the error occurred. Frequently, the address (0xFCA733B9 in the example above) points to an individual driver or piece of faulty hardware, which is generally listed on the third line of the Stop message. Always make a note of this address, as well as the link date of the driver or image that contains it.

The last two parameters vary, depending upon the exception that has occurred. You can typically find a description of the parameters that are included with the name of error code in Ntstatus.h. If the error code has no parameters, the last two parameters are listed as 0x00000000.

Resolving the Problem

Buggy device driver or system service. In addition, a buggy device driver or system service might be responsible for this error. Hardware issues, such as memory conflicts and interrupt request (IRQ) conflicts, can also generate this error.

If a driver is listed by name within the Stop message, disable or remove that driver. Disable or remove any drivers or services that were recently added. If the error occurs during the startup sequence, restart the computer using Safe Mode to rename or delete the file. If the driver is used as part of the system startup process in Safe Mode, you need to start the computer by using the Recovery Console to access the file. For more information about Safe Mode and the Recovery Console, see "Troubleshooting Tools and Strategies" in the Windows 2000 Professional Resource Kit.

If the problem is associated with Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, the service can be removed by starting the system using the Recovery Console and disabling the offending system service.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing Stop 0x1E. Disabling memory caching of the BIOS might also resolve the error. You also need to run hardware diagnostics, especially the memory scanner, supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer.

One type of this kind of error displays exception code 0x80000003. This error indicates a hard-coded breakpoint or assertion was hit, but the system was started with the /NODEBUG switch. This problem rarely occurs. If it occurs repeatedly, make sure a kernel debugger is connected and the system is started with the /DEBUG switch.
The error that generates this message can occur after the first restart during Windows 2000 Setup, or after setup is finished. A possible cause of the error is lack of disk space for installation and system BIOS incompatibilities. For problems during Windows 2000 installation that are associated with a lack of disk space, reduce the number of files on the target hard disk. Check for and delete any unneeded temporary files, Internet cache files, application backup files, and CHK files containing saved file fragments from disk scans. You can also use another hard disk with more free space for the installation. BIOS problems can be resolved by upgrading the system BIOS version.

For more troubleshooting information about the 0x1E Stop message, refer to the Microsoft Knowledge Base link, using the keywords winnt and 0x0000001E.

User mode application causes of Stop 0x1E
Applications that are allocating system handles without releasing them may cause the operating system to stop with a 0x1e. This is often referred to by programmers as a ôhandle leakö.

To check to see if an application is causing this problem, you can use performance monitor to collect information about the suspected program or programs. This should be done from a second machine connected via the network.
However, before this course of action is taken, the stack trace should be examined to see what lies at the base of the stack. If this isnÆt NTOSKRNL, then donÆt pursue this as it is highly unlikely to be the problem. This is because handles are objects owned by the operating system kernel. Not by device drivers or other ôRing 0ö pieces of code.

Pseudo user mode application causes of Stop 0x1E.

Many apparently user mode applications in fact employ ôRing 0ö code to perform a function. Here is a typical but not necessarily exhaustive list of these types of applications:

ò Remote control software (e.g. ReachOut).
ò Anti-virus software.
ò Backup agents.

Remote control software provides a remote interface to the system console on the machine. These are typically used so that administrators need not be physically present in a computer room.

This software interacts with the Graphics Device Interface (GDI) which is an integral component of Windows operating systems.

Here is a list of some of the known problems that are seen with this class of software:
http://support.microsoft.com/SUPPORT/KB/ARTICLES/Q260/8/31.ASP
http://support.microsoft.com/support/kb/articles/Q196/2/24.ASP
http://support.microsoft.com/support/kb/articles/Q168/9/07.ASP

Anti-virus software, as well as the Backup Agent class of software, typically install what is referred to as a filter driver. This is a device driver that inserts itself into the call chain to a system service between an application and the underlying operating system service.

In the case of these two classes of software, this is between the application and file system.

The function in this case is to intercept file system calls and examine the file object that is being called from the disk subsystem for viruses.

In the case of Backup agents, it is typically there to mediate between an application that may potentially have a file left open and the backup agent itself so that the file may be backed up even though it is still open.

Examples of anti-virus software causing stop 0x1E:

http://support.microsoft.com/support/kb/articles/Q263/0/50.ASP
http://support.microsoft.com/support/kb/articles/Q172/5/11.ASP
An example of backup software agents causing a stop 0x1E:
http://support.microsoft.com/support/kb/articles/Q168/6/08.ASP

Colophon

I am not claiming authorship of every part of this document. I compiled the contents for this document to satisfy a need that I had when working as an Escalation Engineer at Microsoft. This was an easy way of providing all the information that was frequently needed.

Much of this document is derived from material in the Windows 2000 Professional Resource Kit. It is not intended to replace that document. You can read most of that book online at:
http://www.microsoft.com/windows2000/techinfo/reskit/en-us/default.asp
The Microsoft Knowledge Base can be found at:
http://search.support.microsoft.com/kb/c.asp?FR=0&SD=MSDN&LN=EN-US