Windows 7 / Getting Started

---

Stop 0x1E or KMODE_EXCEPTION_NOT_HANDLED

The Stop 0x1E message indicates that the Windows kernel detected an illegal or unknown processor instruction. The problems that cause Stop 0x1E messages share similarities with those that generate Stop 0xA errors in that they can be due to invalid memory and access violations. This default Windows error handler typically intercepts these problems if errorhandling routines are not present in the code itself.

Interpreting the Message

This Stop message has four parameters:

1. Exception code that was not handled
2. Address at which the exception occurred
3. Parameter 0 of the exception
4. Parameter 1 of the exception

The first parameter identifies the exception generated. Common exception codes include:

• 0x80000002: STATUS_DATATYPE_MISALIGNMENT An unaligned data reference was encountered. The trap frame supplies additional information.
• 0x80000003: STATUS_BREAKPOINT A breakpoint or ASSERT was encountered when no kernel debugger was attached to the system.
• 0xC0000005: STATUS_ACCESS_VIOLATION A memory access violation occurred. Parameter 4 of the Stop error (which is Parameter 1 of the exception) is the address that the driver attempted to access.
• 0xC0000044: STATUS_QUOTA_EXCEEDED The text Insufficient Quota Exists To Complete The Operation indicates a pool memory leak. A quota allocation attempt necessary for the system to continue operating normally was unsuccessful because of a program or driver memory leak.

The second parameter identifies the address of the module in which the error occurred. Frequently, the address points to an individual driver or faulty hardware named on the third parameter of the Stop message. Make a note of this address and the link date of the driver or image that contains it.

The last two Stop message parameters vary, depending on the exception that has occurred. If the error code has no parameters, the last two parameters of the Stop message are listed as 0x00.

Resolving the Problem

The following suggestions are specific to Stop 0x1E errors. For additional troubleshooting suggestions that apply to all Stop errors, see the section titled "Stop Message Checklist" later in this tutorial.

• Stop 0x1E messages typically occur after you install faulty drivers or system services, or they can indicate hardware problems, such as memory and interrupt request (IRQ) conflicts. If a Stop message lists a driver by name, disable, remove, or roll back that driver to correct the problem. If disabling or removing applications and drivers resolves the issue, contact the hardware manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, and CD mastering tools.
• If the Stop message mentions the file Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, you might be able to disable it by starting the system in safe mode. If not, use Startup Repair to manually delete the system service file that is causing the problem.
• Problems can result from system firmware incompatibilities. You can resolve many Advanced Configuration and Power Interface (ACPI) issues by updating to the latest firmware.
• Other possible causes include insufficient disk space while installing applications or performing certain functions that require more memory. You can free up space by deleting unneeded files. Use Disk Cleanup to increase available disk space.
• The problem might be due to a memory leak caused by an application or service that is not releasing memory correctly. Poolmon (Poolmon.exe) helps you to isolate the features that are causing kernel memory leaks. For more information about troubleshooting memory leaks, see Knowledge Base articles 177415, "How to Use Memory Pool Monitor (Poolmon.exe) to Troubleshoot Kernel Mode Memory Leaks," at http://support.microsoft.com/kb/177415 and 298102, "How to Find Pool Tags That Are Used by Third-Party Drivers," at http://support.microsoft.com/kb/298102.

More Info To find additional articles, search using the keywords poolmon, pool tag, pooltag, and memory leak. For more information about Stop 0x1E messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keyword 0x1E.