Stop 0x0000001E or KMODE_EXCEPTION_NOT_HANDLED

The Stop 0x1E message indicates that the Windows XP Professional kernel detected an illegal or unknown processor instruction. The problems that cause Stop 0x1E messages share similarities with those that generate Stop 0xA errors in that they can be due to invalid memory and access violations. This default Windows XP Professional error handler typically intercepts these problems if error-handling routines are not present in the code itself.

Interpreting the Message

This Stop message has four parameters:

1. Exception code that was not handled.
2. Address at which the exception occurred.
3. Parameter 0 of the exception.
4. Parameter 1 of the exception.

The first parameter identifies the exception generated. Common exception codes include:

• 0x80000002: STATUS_DATATYPE_MISALIGNMENT

  An unaligned data reference was encountered. The trap frame supplies additional information.

• 0x80000003: STATUS_BREAKPOINT

  A breakpoint or ASSERT was encountered when no kernel debugger was attached to the system.

• 0xC0000005: STATUS_ACCESS_VIOLATION

  A memory access violation occurred. Parameter 4 of the Stop error (which is Parameter 1 of the exception) is the address that the driver attempted to access.

• 0xC0000044: STATUS_QUOTA_EXCEEDED

  The text Insufficient quota exists to complete the operation indicates a pool memory leak. A quota allocation attempt necessary for the system to continue operating normally was unsuccessful due to a program or driver memory leak.

For a complete list of exception codes, see the Ntstatus.h file located in the Inc directory of the Windows XP Professional Driver Development Kit (DDK). For more information about the DDK, see the Driver Development Kits link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources.

The second parameter identifies the address of the module in which the error occurred. Frequently, the address points to an individual driver or faulty hardware named on the third parameter of the Stop message. Make a note of this address and the link date of the driver or image that contains it.

The last two Stop message parameters vary, depending upon the exception that has occurred. You can typically find a description of the parameters that are included with the name of error code in Ntstatus.h. If the error code has no parameters, the last two parameters of the Stop message are listed as 0x00000000.

Resolving the Problem

The following suggestions are specific to Stop 0x1E errors. For additional troubleshooting suggestions that apply to all Stop errors, see "Stop Message Checklist" later in this appendix.

• Stop 0x1E messages typically occur after installing faulty drivers or system services, or they can indicate hardware problems, such as memory and IRQ conflicts. If a Stop message lists a driver by name, disable, remove, or roll it back to correct the problem. If disabling or removing applications and drivers resolves the issue, contact the hardware manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, and CD mastering tools.
• If the Stop message mentions the file Win32k.sys, the source of the error might be a third-party "remote control" program. If such software is installed, you might be able to disable it by starting the system in safe mode. If not, use Recovery Console to manually delete the system service file that is causing the problem. For more information about safe mode and Recovery Console, see "Tools for Troubleshooting" in this book.
• Problems can result from system firmware incompatibilities. Many Advanced Configuration and Power Interface (ACPI) issues can be resolved by updating to the latest firmware.
• Other possible causes include insufficient disk space while installing applications or performing certain functions that require more memory. You can free up space by deleting unneeded files. Use Disk Cleanup to increase available disk space. From Recovery Console, remove temporary files (those with .tmp file extensions), Internet cache files, application backup files, and .tmp files generated by Chkdsk.exe or Autochk.exe. You can also choose to install additional applications to another hard disk with more free space or move data files, paging files, and so on. For more information about Autochk.exe and Chkdsk.exe, see "Troubleshooting Disks and File Systems" in this book.
• The problem might be due to a memory leak caused by an application or service that is not releasing memory correctly. Poolmon (Poolmon.exe) helps you to isolate the components that are causing kernel memory leaks. For more information about troubleshooting memory leaks, see Microsoft Knowledgebase articles 177415, "How to Use Poolmon to Troubleshoot Kernel Mode Memory Leaks," and 298102, "Finding Pool Tags Used by Third Party Files Without Using the Debugger." To find these articles, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources.

  To find additional articles, search using keywords winnt, poolmon, pool tag, pooltag, and memory leak.

For more information about Stop 0x1E messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources. Search using keywords winnt, 0x0000001E, and 0x1E.