is launched, Click below image to access it is launched, Click below image to access it
Technology and Entertainment Blog

The computer has rebooted from a bugcheck

Title: The computer has rebooted from a bugcheck


Many a time we come across a issue where we see that our service is terminated\rebooting unexpectedly and we have know clue what went wrong.

From event viewer we can only find error event about unexpected shutdown with some short of error code.

In event log we see follwoing entry - Unexpected shutdown : The computer has rebooted from a bugcheck. The bugcheck was:

Let's try to understand what this error code means.

0x0000000a = IRQL NOT LESS OR EQUAL:
This is Stop message, this indicates that a kernel-mode process attempted to access a portion of memory at an Interrupt Request Level (IRQL) that was too high.
A kernel-mode process can only access other processes that have an IRQL lesser than or equal to its own.

0x000000d1 = IRQL_NOT_LESS_OR_EQUAL:
Typically cause by bugs in device drivers or incompatibility with the operating system (ie NT drivers used on Windows 2000). F

This is Stop message, also known as Stop 0x1E, indicates that a kernel-mode process tried to execute an illegal or unknown processor instruction. This error handler is a default error handler that catches errors not associated with other specific error handlers. See the link below for more details.

0x00000022 = FILE_SYSTEM - Explanation:
This is a Windows 2000 Executive character-mode STOP message. This indicates a generic file system problem. User Action: If this is the first time you have booted after installing new hardware, remove the hardware and boot again. Check the Microsoft Hardware compatibility List to verify that the hardware and its drivers are compatible with Windows 2000. For information about the hardware, contact the supplier.

0x00000024 = NTFS_FILE_SYSTEM:
This is Stop message, also known as Stop 0x24, indicates that a problem occurred within Ntfs.sys (the driver file that allows the system to read and write to NTFS drives).

Indicates there are no physical pages available. Restart and set the Recovery options in the System Control Panel or the /CRASHDEBUG system start option.

Occurs on many circumstances and it usually indicates faulty drivers. There are quite a few number of Q articles on Microsoft's site. Do a search on "0x00000050".

This signifies that a driver corrupted pool memory used for holding pages destined for disk. When the Memory Manager dereferenced the file, it discovered the corruption in pool memory.

Indicates a problem with the boot disk.

Appears when a driver tries to execute an illegal processor instruction.

A memory access violation occurred. (Parameter 4 of the bug check is the address, which the driver attempted to access.) Typically generated by faulty drivers.

This error occurs when a user-mode subsystem, such as WinLogon or the Client Server Runtime Subsystem (CSRSS), has been fatally compromised and security can no longer be guaranteed. In response, the operating system switches to kernel mode. Microsoft Windows cannot run without WinLogon or CSRSS. Therefore, this is one of the few cases where the failure of a user-mode service can shut down the system. Mismatched system files can also cause this error. This can occur if you have restored your hard disk from a backup. Some backup programs might skip restoring system files that they determine are in use. Search Microsoft's site for 0xc000021a as there are a large number of Q article related to this stop code.

0x00000077 = KERNEL_STACK_INPAGE_ERROR: This is Stop message, also known as Stop 0x77, indicates that the requested page of kernel data from the paging file could not be read into memory. Stop 0x77 can be caused by a number of problems, such as:

- Bad sectors on the hard disk.
- Defective or loose cabling, improper SCSI termination, or the controller not seeing the hard disk.
- Another device is causing a resource conflict with the storage controller.
- Failing RAM.

0xdeaddead = When there is not enough free disk space to write a dump file, Savedump.exe does not write the following entry to the event log. See M235999 for more details. Fixed with SP6.

Keyword: windows error code, unexpected server shutdown, error codes list

No comments: