Lesson 4 - Conceptions

VPN - Virtual Private Network Definition: A VPN utilizes public telecommunications networks to conduct private data communications. Most VPN implementations use the Internet as the public infrastructure and a variety of specialized protocols to support private communications through the Internet. VPN follows a client and server approach. VPN clients authenticate users, encrypt data, and otherwise manage sessions with VPN servers utilizing a technique called tunneling. VPN clients and VPN servers are typically used in these three scenarios: 1. to support remote access to an intranet, 2. to support connections between multiple intranets within the same organization, and 3. to join networks between two organizations, forming an extranet. The main benefit of a VPN is the lower cost needed to support this technology compared to alternatives like traditional leased lines or remote access servers. VPN users typically interact with simple graphical client programs. These applications support creating tunnels, setting configuration parameters, and connecting to and disconnecting from the VPN server. VPN solutions utilize several different network protocols including PPTP, L2TP, IPsec, and SOCKS. VPN servers can also connect directly to other VPN servers. A VPN server-to-server connection extends the intranet or extranet to span multiple networks. Many vendors have developed VPN hardware and software products. Some of these do not interoperate due to the immaturity of some VPN standards. Protocol (network) Definition: A network protocol defines rules and conventions for communication between network devices. Protocols for computer networking all generally use packet switching techniques to send and receive messages in the form of packets. Network protocols include mechanisms for devices to identify and make connections with each other, as well as formatting rules that specify how data is packaged into messages sent and received. Some protocols also support message acknowledgement and data compression designed for reliable and/or high-performance network communication. Hundreds of different computer network protocols have been developed each designed for specific purposes and environments. Internet Protocols The Internet Protocol family contains a set of related (and among the most widely used network protocols. Besides Internet Protocol (IP) itself, higher-level protocols like TCP, UDP, HTTP, and FTP all integrate with IP to provide additional capabilities. Similarly, lower-level Internet Protocols like ARP and ICMP also co-exist with IP. These higher level protocols interact more closely with applications like Web browsers while lower-level protocols interact with network adapters and other computer hardware. Routing Protocols Routing protocols are special-purpose protocols designed specifically for use by network routers on the Internet. Common routing protocols include EIGRP, OSPF and BGP. How Network Protocols Are Implemented Modern operating systems like Microsoft Windows contain built-in services or daemons that implement support for some network protocols. Applications like Web browsers contain software libraries that support the high level protocols necessary for that application to function. For some lower level TCP/IP and routing protocols, support is implemented in directly hardware (silicon chipsets) for improved performance. Intranet Definition: Intranet is the generic term for a collection of private computer networks within an organization. An intranet uses network technologies as a tool to facilitate communication between people or work groups to improve the data sharing capability and overall knowledge base of an organization's employees. Intranets utilize standard network hardware and software technologies like Ethernet, Wi-Fi, TCP/IP, Web browsers and Web servers. An organization's intranet typically includes Internet access but is firewalled so that its computers cannot be reached directly from the outside. A common extension to intranets, called extranets, opens this firewall to provide controlled access to outsiders. Many schools and non-profit groups have deployed them, but an intranet is still seen primarily as a corporate productivity tool. A simple intranet consists of an internal email system and perhaps a message board service. More sophisticated intranets include Web sites and databases containing company news, forms, and personnel information. Besides email and groupware applications, an intranet generally incorporates internal Web sites, documents, and/or databases. The business value of intranet solutions is generally accepted in larger corporations, but their worth has proven very difficult to quantify in terms of time saved or return on investment. Extranet Most extranets use the Internet as the entry point for outsiders, a firewall configuration to limit access, and a secure protocol for authenticating users. Definition: An extranet is a computer network that allows controlled access from the outside for specific business or educational purposes. Extranets are extensions to, or segments of, private intranet networks that have been built in many corporations for information sharing and ecommerce. IPv6 Definition: IPv6 is the next generation protocol for Internet networking. IPv6 expands on the current Internet Protocol standard known as IPv4. Compared to IPv4, IPv6 offers better addressing, security and other features to support large worldwide networks.  In IPv6, IP addresses change from the current 32-bit standard and dotted decimal notation to a new 128-bit address system. IPv6 addresses remain backward compatible with IPv4 addresses. For example, the IPv4 address "192.168.100.32" may appear in IPv6 notation as "0000:0000:0000:0000:0000:0000:C0A8:6420" or "::C0A8:6420".  The most obvious benefit of IPv6 is the exponentially greater number of IP addresses it can support compared to IPv4. Many countries outside the U.S. suffer from a shortage of IP addresses today. Because IPv6 and IPv4 protocols coexist, those locales with an address shortage can easily deploy new IPv6 networks that work with the rest of the Internet. Experts believe it will take many more years before all networks fully change over to IPv6.  Other benefits of IPv6 are less obvious but equally important. The internals of the IPv6 protocol have been designed with scalability and extensibility in mind. This will allow many different kinds of devices besides PCs, like cell phones and home appliances, to more easily join the Internet in future. Also Known As: IPng (Internet Protocol Next Generation) ARP - Address Resolution Protocol Definition: ARP converts an Internet Protocol (IP) address to its corresponding physical network address. ARP is a low-level network protocol, operating at Layer 2 of the OSI model. ARP usually is implemented in the device drivers of network operating systems. It is most commonly seen on Ethernet networks, but ARP has also been implemented for ATM, Token Ring, and other physical networks. RFC 826 documented the initial design and implementation of ARP. ARP works on Ethernet networks as follows. Ethernet network adapters are produced with a physical address embedded in the hardware called the Media Access Control (MAC) address. Manufacturers take care to ensure these 6-byte (48-bit) addresses are unique, and Ethernet relies on these unique identifiers for message delivery. When any device wishes to send data to another target device over Ethernet, it must first determine the MAC address of that target given its IP address These IP-to-MAC address mappings are derived from an ARP cache maintained on each device. If the given IP address does not appear in a device's cache, that device cannot direct messages to that target until it obtains a new mapping. To do this, the initiating device first sends an ARP request broadcast message on the local subnet. The host with the given IP address sends an ARP reply in response to the broadcast, allowing the initiating device to update its cache and proceed to deliver messages directly to the target. NAT - Network Address Translation Definition: NAT allows an Internet Protocol (IP) network to maintain public IP addresses separately from private IP addresses. NAT is a popular technology for Internet connection sharing. It is also sometimes used in server load balancing applications on corporate networks. In its most common configuration, NAT maps all of the private IP addresses on a home network to the single IP address supplied by an Internet Service Provider (ISP). This allows computers on the home LAN to share a single Internet connection. Additionally, it enhances home network security by limiting the access of external computers into the home IP network space. NAT works by snooping both incoming and outgoing IP datagrams. As needed, it modifies the source or destination address in the IP header (and the affected checksums) to reflect the configured address mapping. NAT technically supports either fixed or dynamic mappings of one or more internal and external IP addresses. NAT functionality is usually found on routers and other gateway devices at the network boundary. NAT can also be implemented entirely in software. Microsoft's Internet Connection Sharing (ICS), for example, adds NAT support to the Windows operating system. By itself, NAT does not provide all the features of a true firewall, but it is often used on servers that feature other firewall and antivirus support. NAT was designed originally to conserve public Internet address space. Internet RFC 1631 contains the basic NAT specification. What Is Packet Switching on Computer Networks? Answer: Packet switching is the approach used by some computer network protocols to deliver data across a local or long distance connection. Examples of packet switching protocols are Frame Relay, IP and X.25. How Packet Switching Works Packet switching entails packaging data in specially formatted units (called packets) that are typically routed from source to destination using network switches and routers. Each packet contains address information that identifies the sending computer and intended recipient. Using these addresses, network switches and routers determine how best to transfer the packet between hops on the path to its destination. Pros and Cons of Packet Switching Packet switching is the alternative to circuit switching protocols used historically for telephone (voice) networks and sometimes with ISDN connections. Compared to circuit switching, packet switching offers the following: ·         More efficient use of overall network bandwidth due to flexibility in routing the smaller packets over shared links. Packet switching networks are often cheaper to build as less equipment is needed given this ability to share. ·         Longer delays in receiving messages due to the time required to package and route packets. For many applications, delays are not long enough to be significant, but for high-performance applications like real-time video, additional data compression and QoS technology is often required to achieve the required performance levels. ·         Potential for network security risks due to the use of shared physical links. Protocols and other related elements on packet switching networks must designed with the appropriate security precautions.

Additional Reading

Windows Internet Connection Sharing Windows ICS allows you to set up one of your computers as a DHCP server, and your other computers to use dynamic private IP addressing managed by the server. ICS - Internet Connection Sharing Definition: ICS allows a local network of Windows computers to share a single Internet connection. Microsoft developed ICS as part of Windows 98 Second Edition. The feature has been included as part of all subsequent Windows releases, but it is not available as a separate installable program. ICS follows a client/server model. To set up ICS, one computer must be chosen as the server. The designated computer must support two network interfaces, one directly connected to the Internet and the other connected to the remainder of the LAN. In a traditional home dial-up network, for example, the server computer is directly connected to the modem. When configured through Windows, the ICS server behaves as a NAT router, directing messages on behalf of multiple computers. ICS incorporates a DHCP server that allows clients to obtain their local addresses automatically rather than needing to be set manually. Compared to hardware routers, ICS has the advantage of being included with the operating system so no additional purchase is required. On the other hand, ICS lacks many of the configuration options that hardware routers possess. OSI (model) - Open Systems Interconnection Definition: The OSI model defines internetworking in terms of a vertical stack of seven layers. The upper layers of the OSI model represent software that implements network services like encryption and connection management. The lower layers of the OSI model implement more primitive, hardware-oriented functions like routing, addressing, and flow control. Layers of the OSI Model In the OSI model, data communication starts with the top layer at the sending side, travels down the OSI model stack to the bottom layer, then traveses the network connection to the bottom layer on the receiving side, and up its OSI model stack. The OSI model was introduced in 1984. Although it was designed to be an abstract model, the OSI model remains a practical framework for today's key network technologies like Ethernet and protocols like IP. Also Known As: Open Systems Interconnection (OSI) reference model, OSI seven layer model Examples: Internet Protocol (IP) corresponds to the Network layer of the OSI model, layer three. TCP and UDP correspond to OSI model layer four, the Transport layer. Lower layers of the OSI model are represented by technologies like Ethernet. Higher layers of the OSI model are represented by application protocols like TCP and UDP.

Windows XP Stop Messages

Stop Messages
When Windows XP detects a problem from which it cannot recover, it displays Stop messages. These are text-mode error messages that report information about the condition.

Stop messages, sometimes referred to as blue screens (BSoD), contain specific information that can help you diagnose and possibly resolve the problem detected by the Windows kernel.

This list describes these messages and helps you understand and interpret them.

This list is NOT exhaustive or meant to resolve EVERY error.

This list of messages is a guide to individual messages and their possible causes and resolutions... Having a basic understanding of these error messages enables you to communicate with your technical support professional more effectively too.

With all these Stop messages, you can pretty much assume someone else has encountered the problem before you. That is why tying in the error message into www.google.com , posting a notice for help on a relevant newsgroup and entering the stop code into the "Microsoft Knowledge Base" can yield help just when you need it!

Here is the (long) list:
Stop 0x0000000A or IRQL_NOT_LESS_OR_EQUAL
The Stop 0xA message indicates that a kernel-mode process or driver attempted to access a memory location to which it did not have permission, or at a kernel interrupt request level (IRQL) that was too high. A kernel-mode process can access only other processes that have an IRQL lower than, or equal to, its own. This Stop message is typically due to faulty or incompatible hardware or software.

Possible Resolutions:

# A Stop 0xA message might occur after installing a faulty device driver, system service, or firmware. If a Stop message lists a driver by name, disable, remove, or roll back the driver to correct the problem. If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, and CD mastering tools.

# A Stop 0xA message might also be due to failing or defective hardware. If a Stop message points to a category of devices (video or disk adapters, for example), try removing or replacing the hardware to determine if it is causing the problem.

# If you encounter a Stop 0xA message while upgrading to Windows XPl, the problem might be due to an incompatible driver, system service, virus scanner, or backup. To avoid problems while upgrading, simplify your hardware configuration and remove all third-party device drivers and system services (including virus scanners) prior to running setup. After you have successfully installed Windows XP, contact the hardware manufacturer to obtain compatible updates.

Microsoft KB articles:
Troubleshooting a Stop 0x0000000A Error in Windows XP
STOP 0x0000000A Error Message When You Change from AC Power to DC Power
STOP 0x0000000A Error Message When You Fast Switch Between Users
STOP 0x0000000A Irql_Not_Less_or... During Windows XP Upgrade
STOP 0x0000000A Windows XP restarts when you try to shut down your computer
STOP 0x0000000A Computer automatically restarts after upgrade to XP


Stop 0x0000001E or KMODE_EXCEPTION_NOT_HANDLED
The Stop 0x1E message indicates that the Windows XP kernel detected an illegal or unknown processor instruction. The problems that cause Stop 0x1E messages share similarities with those that generate Stop 0xA errors in that they can be due to invalid memory and access violations. This default Windows XP error handler typically intercepts these problems if error-handling routines are not present in the code itself.

Possible Resolutions:

# Stop 0x1E messages typically occur after installing faulty drivers or system services, or they can indicate hardware problems, such as memory and IRQ conflicts. If a Stop message lists a driver by name, disable, remove, or roll it back to correct the problem. If disabling or removing applications and drivers resolves the issue, contact the hardware manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, and CD mastering tools.

# If the Stop message mentions the file Win32k.sys, the source of the error might be a third-party "remote control" program. If such software is installed, you might be able to disable it by starting the system in safe mode. If not, use Recovery Console to manually delete the system service file that is causing the problem.

# Problems can result from system firmware incompatibilities. Many Advanced Configuration and Power Interface (ACPI) issues can be resolved by updating to the latest firmware.

# Other possible causes include insufficient disk space while installing applications or performing certain functions that require more memory. You can free up space by deleting unneeded files. Use Disk Cleanup to increase available disk space. From Recovery Console, remove temporary files (those with .tmp file extensions), Internet cache files, application backup files, and .tmp files generated by Chkdsk.exe or Autochk.exe. You can also choose to install additional applications to another hard disk with more free space or move data files, paging files, and so on.

# The problem might be due to a memory leak caused by an application or service that is not releasing memory correctly. Poolmon (Poolmon.exe) helps you to isolate the components that are causing kernel memory leaks. For more information about troubleshooting memory leaks, see Microsoft Knowledgebase articles Q177415, "How to Use Poolmon to Troubleshoot Kernel Mode Memory Leaks," and Q298102, "Finding Pool Tags Used by Third Party Files Without Using the Debugger."

Microsoft KB articles:
STOP 0x0000001E Error Message During Windows Setup
STOP 0x0000001E KMODE_EXCEPTION_NOT_HANDLED Error Message from Aspi32.sys

Stop 0x00000024 or NTFS_FILE_SYSTEM
The Stop 0x24 message indicates that a problem occurred within Ntfs.sys, the driver file that allows the system to read and write to NTFS file system drives. A similar Stop message, 0x23, exists for the file allocation table (FAT16 or FAT32) file systems.

Possible Resolutions:

# Malfunctioning SCSI and Advanced Technology Attachment (ATA) hardware or drivers can also adversely affect the system's ability to read and write to disk, causing errors. If using SCSI hard disks, check for cabling and termination problems between the SCSI controller and the disks. Periodically check Event Viewer for error messages related to SCSI or FASTFAT in the System log or Autochk in the Application log.

# Verify that the tools you use to continually monitor your system, such as virus scanners, backup programs, or disk defragmenters are compatible with Windows XP. Some disks and adapters come packaged with diagnostic software that you can use to run hardware tests.

To test hard disk or volume integrity

Method 1:

1. In the Run dialog box, in the Open box type:

  cmd

2. Start the Chkdsk tool, which detects and attempts to resolve file system structural corruption. At the command prompt type:

  chkdsk drive: /f 

Method 2:

1. Double-click My Computer, and then select the hard disk you want to check.
2. On the File menu, click Properties.
3. Click the Tools tab.
4. In the Error-checking box, click Check Now.
5. In Check disk options, select the Scan for and attempt recovery of bad sectors check box. You can also select the Automatically fix file system errors check box.

If the volume you are checking is in use, a message asks whether you want to delay disk error checking until the next time you restart your computer. After you restart, disk error checking runs and the volume chosen is not available to run other tasks during this process. If you cannot restart the computer due to the error, use safe mode or Recovery Console.

If you are not using the NTFS file system, and the system partition is formatted with the file allocation table (FAT16 or FAT32) file system, long file name (LFN) information can be lost if hard disk tools are started from an MS-DOS command prompt. A command prompt appears when using a startup floppy disk or when using the command prompt startup option on multiple boot systems that use FAT16 or FAT32 partitions with Microsoft Windows 95 OEM Service Release 2 (OSR2), Microsoft Windows 98, or Microsoft Windows Millennium Edition (Me) installed. Do not use tools meant for other operating systems on Windows XP partitions!

# Nonpaged pool memory might be depleted, which can cause the system to stop. You can resolve this situation by adding more RAM, which increases the quantity of nonpaged pool memory available to the kernel.

Microsoft KB articles:
Troubleshooting Stop 0x24 or NTFS_FILE_SYSTEM Error Messages
STOP 0x23 (or STOP 0x24) When restarting PC after installing PC-Magic Encrypted Magic Folders


Stop 0x0000002E or DATA_BUS_ERROR

The Stop 0x2E message indicates a system memory parity error. The cause is typically failed or defective RAM (including motherboard, Level 2 cache, or video memory), incompatible or mismatched memory hardware, or when a device driver attempts to access an address in the 0x8xxxxxxx range that does not exist (does not map to a physical address). A Stop 0x2E message can also indicate hard disk damage caused by viruses or other problems.

Possible Resolutions:

# Stop 0x2E is typically due to defective, malfunctioning, or failed memory hardware, such as memory modules, Level 2 (L2) SRAM cache, or video adapter RAM. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.

# Stop 0x2E messages can also occur after installing faulty drivers or system services. If a file name is given, you need to disable, remove, or roll back that driver. Disable the service or application and confirm that this resolves the error. If so, contact the hardware manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools.

# Hard disk corruption can also cause this Stop message.

# The problem might also be due to cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.

Stop 0x0000003F or NO_MORE_SYSTEM_PTES
The Stop 0x3F message indicates one or more of the following problems:

# The system Page Table Entries (PTEs) are depleted or fragmented due to the system performing a large number of input/output (I/O) actions.

# A faulty device driver is not managing memory properly.

# An application, such as a backup program, is improperly allocating large amounts of kernel memory.

Possible Resolutions:

# Stop 0x3F messages can occur after installing faulty drivers or system services. If a file name is given, you need to disable, remove, or roll back that driver. Disable the service or application and confirm that this resolves the error. If so, contact the hardware manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools.

# The system might not actually be out of PTEs, but a contiguous memory block of sufficient size is not available to satisfy a driver or application request. Check for the availability of updated driver or application files and consult the hardware or program documentation for minimum system requirements.

# Another cause is excessive demands for system PTE by applications. This situation is more common in server environments (like in web hostingservers). Windows XP Professional provides a registry entry, SystemPages, that you can use to increase the number of PTEs allocated.

 Caution:

Do not edit the registry unless you have no alternative. The registry editor bypasses standard safeguards, allowing settings that can damage your system, or even require you to reinstall Windows. If you must edit the registry, back it up first... 

To increase the number of PTEs allocated in the registry

1. In the Run dialog box, and in the Open box, type: regedit

2. In the registry editor, navigate to the subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management.

3. Double-click on PagedPoolSize and SystemPages to view the value for each entry.

4. If PagedPoolSize is not zero, assign a value of 0.

5. If SystemPages is not zero, assign a value of 40000 for systems with 128 MB (or less) of memory, or 110000 for systems with 128 MB to 256 MB of memory. For systems with more memory, do not increase the SystemPages value above 110000 without contacting Microsoft technical support.

6. Click OK, and then close the registry editor.

7. Restart your computer.

Stop 0x00000050 or PAGE_FAULT_IN_NONPAGED_AREA
The Stop 0x50 message indicates that requested data was not in memory. The system generates an exception error when using a reference to an invalid system memory address. Defective memory (including main memory, L2 RAM cache, video RAM) or incompatible software (including remote control and antivirus software) might cause Stop 0x50 messages.

Possible Resolutions:

# If you added new hardware recently, remove and replace the hardware to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the hardware manufacturer to determine if the component has failed.

# Stop 0x50 messages can also occur after installing faulty drivers or system services. If the file name is listed, you need to disable, remove, or roll back that driver. If not, disable the recently installed service or application to determine if this resolves the error. If this does not resolve the problem, contact the hardware manufacturer for updates. Using updated drivers and software is especially important for network interface cards, video adapters, backup programs, multimedia applications, antivirus scanners, and CD mastering tools. If an updated driver is not available, attempt to use a driver from a similar device in the same family. For example, if printing to a Model 1100C printer causes Stop 0x50 errors, using a printer driver meant for a Model 1100A or Model 1000 might temporarily resolve the problem.

Microsoft KB articles:
STOP 0x00000050 PrtSeqRd deferencing null device object
STOP 0x50 Error starting Windows after connecting a scanner

Stop 0x00000077 or KERNEL_STACK_INPAGE_ERROR
The Stop 0x77 message indicates that a page of kernel data requested from the paging (virtual memory) file could not be found or read into memory. This Stop message can also indicate disk hardware failure, disk data corruption, or possible virus infection.

Possible Resolutions:

# Stop 0x77 messages can be caused by bad sectors in the virtual memory paging file or a disk controller error. In extremely rare cases, depleted nonpaged pool resources can cause this error. If the first and third parameters are zero, the stack signature in the kernel stack is missing, which is an error typically caused by defective hardware. If the I/O status is 0xC0000185 and the paging file is on a SCSI disk, check for cabling and termination issues. An I/O status code of 0xC000009C or 0xC000016A indicates that the requested data could not be found. You can try to correct this by restarting the computer. If a problem with disk integrity exists, Autochk, a program that attempts to mark bad disk sectors as defective so that they are not used in the future, starts automatically. If Autochk fails to run, you can manually perform the integrity check yourself by following the instructions to run Chkdsk provided in "Stop 0x00000024 or NTFS_FILE_SYSTEM" earlier in this list.

# Another cause of Stop 0x77 messages is defective, malfunctioning, or failed memory hardware, such as memory modules, Level 2 (L2) SRAM cache, or video adapter RAM. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.

# The problem might also be due to cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.

# Problems that cause Stop 0x77 messages can also cause Stop 0x7A messages. For more information about Stop 0x7A messages, see "Stop 0x0000007A or KERNEL_DATA_INPAGE_ERROR" later in this list.

Microsoft KB articles:
Troubleshooting Stop 0x00000077 or KERNEL_STACK_INPAGE_ERROR


Stop 0x00000079 or MISMATCHED_HAL
The Stop 0x79 message indicates that the hardware abstraction layer (HAL) and the kernel type for the computer do not match. This error most often occurs when ACPI firmware settings are changed. For example, you might install Windows XP on an x86-based computer with the firmware ACPI enable option enabled and later decide to disable it. This error can also result when mismatched single and multi-processor configuration files are copied to the system.

Possible Resolutions:

# A Stop 0x79 message occurs when the system is using out-of-date Ntoskrnl.exe or Hal.dll files. This can occur after manual repairs that involve copying incorrect files to the system. This error also occurs when using mismatched files, such as copying a multiprocessor HAL on to a system using a single-processor kernel (or vice versa). The kernel and HAL files for single-processor and multiprocessor systems are stored on the Windows XP Professional operating system CD using two different file names. For example, the single and multi-processor versions of the kernel, named Ntoskrnl.exe and Ntkrnlmp.exe respectively. Setup copies either Ntoskrnl.exe or Ntkrnlmp.exe to your system as Ntoskrnl.exe. In Recovery Console, you can use the Copy command to copy the correct HAL or kernel files from the CD to the appropriate folder on the hard disk.

# If you experience Stop 0x79 messages after changing firmware settings, restore the original settings used during Windows XP Professional Setup.

Because systems that use the ACPI HAL ignore IRQ assignments stored in firmware, you can only manually change IRQ settings for non-ACPI (Standard PC HAL) systems. Some x86-based provide the option to toggle ACPI functionality. To disable or re-enable ACPI, you must change firmware settings and reinstall Windows XP. Because of the numerous registry and system file changes required, you must run Setup again (an upgrade installation does not work).

Stop 0x0000007A or KERNEL_DATA_INPAGE_ERROR
The Stop 0x7A message indicates that a page of kernel data was not found in the paging (virtual memory) file and could not be read into memory. This might be due to incompatible disk or controller drivers, firmware, or hardware.

Frequently, the cause of this error can be determined from the second parameter, the I/O status code. Some common status codes are:

# 0xC000009A, or STATUS_INSUFFICIENT_RESOURCES, indicates a lack of nonpaged pool resources

# 0xC000009C, or STATUS_DEVICE_DATA_ERROR, indicates bad blocks (sectors) on the hard disk

# 0xC000009D, or STATUS_DEVICE_NOT_CONNECTED, indicates defective or loose data or power cables, a problem with SCSI termination, or improper controller or disk configuration

# 0xC000016A, or STATUS_DISK_OPERATION_FAILED, indicates bad blocks (sectors) on the hard disk

# 0xC0000185, or STATUS_IO_DEVICE_ERROR, indicates improper termination, defective storage controller hardware, or defective disk cabling, or two devices attempting to use the same resources.

Possible Resolutions:

# Stop 0x7A can be caused by bad sectors in the virtual memory paging file, disk controller error, virus infection, or memory hardware problems. In extremely rare cases, depleted nonpaged pool resources can cause this error. If the first and third parameters are zero, the stack signature in the kernel stack is missing, an error typically caused by defective hardware. If the I/O status is 0xC0000185 and the paging file is on a SCSI disk, check for cabling and termination issues. An I/O status code of 0xC000009C or 0xC000016A indicates that the requested data could not be found. You can try to correct this by restarting the computer. If a problem with disk integrity exists, Autochk, a program that attempts to mark bad disk sectors as defective so that they are not used in the future, starts automatically. If Autochk fails to run, you can manually perform the integrity check yourself by following the instructions to run Chkdsk provided in "Stop 0x00000024 or NTFS_FILE_SYSTEM" earlier in this appendix.

# Another cause of Stop 0x7A messages is defective, malfunctioning, or failed memory hardware, such as memory modules, Level 2 (L2) SRAM cache, or video adapter RAM. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.

# Check the hardware manufacturer's Web site (hosted on top web hosting server) for updates to disk adapter firmware or drivers that improve compatibility. Verify that your disks and controller support the same set of advanced features, such as higher transfer rates. If necessary, select a slower transfer rate if an update is not yet available. Consult your hardware or device documentation for more information.

 Important

- You can install disk controller drivers not present on the Windows XP Professional operating system CD by responding to the following prompt shortly after starting Setup:
- Press F6 if you need to install a third party SCSI or RAID driver.
- Press F6, and when prompted, provide the appropriate storage controller driver (ATA or SCSI) supplied by the manufacturer.

# The problem might also be due to cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.

# Problems that cause Stop 0x7A messages can also cause Stop 0x77 messages. For more information about Stop 0x77 messages, see "Stop 0x00000077 or KERNEL_STACK_INPAGE_ERROR" earlier in this list.

Stop 0x0000007B or INACCESSIBLE_BOOT_DEVICE
The Stop 0x7B message indicates that Windows XP has lost access to the system partition or boot volume during the startup process. Installing incorrect device drivers when installing or upgrading storage adapter hardware typically causes stop 0x7B errors. Stop 0x7B errors could also indicate possible virus infection.

The second parameter is very important because it can indicate whether the 0x7B Stop message was caused by file system issues or problems with storage hardware and drivers. Values of 0xC000034 or 0xC000000E typically indicate:

# Disks or storage controllers that are failing, defective, or improperly configured.

# Storage-related drivers or programs (tape management software, for example) that are not fully compatible with Windows XP Professional.

Possible Resolutions:

# During I/O system initialization, the controller or driver for the startup device (typically the hard disk) might have failed to initialize the necessary hardware. File system initialization might have failed because of disk or controller failure, or because the file system did not recognize the data on the boot device.

# Repartitioning disks, adding new disks, or upgrading to a new disk controller might cause the information in the Boot.ini file, or Boot Manager, to become outdated. If this Stop message occurs after installing new disks to your system, edit the Boot.ini file or adjust the Boot Manager parameters to allow the system to start. If the error occurs after upgrading the disk controller, verify that the new hardware is functioning and correctly configured.

# Verify that the system firmware and disk controller BIOS settings are correct and that the storage device was properly installed. If you are unsure, consult your computer's documentation about restoring default firmware settings or configuring your system to auto-detect settings. If the error occurs during Windows XP Professional setup, the problem might be due to unsupported disk controller hardware. In some cases, drivers for new hardware are not in the Windows XP Professional Driver.cab library, and you need to provide additional drivers to complete the Windows XP setup successfully. If this is the case, follow the hardware manufacturer's instructions when installing drivers. Periodically check for driver and firmware updates.

# Hard disk corruption can also cause this Stop message. For more information about checking hard disk integrity, see the instructions provided in "Stop 0x00000024 or NTFS_FILE_SYSTEM" earlier in this list.

# Problems that cause 0x7B errors might also cause Stop 0xED errors. For more information about 0xED Stop messages, see "Stop 0x0000007B or INACCESSIBLE_BOOT_DEVICE" later in this list.

Microsoft KB articles:

- Troubleshooting STOP 0x0000007B or 0x4,0,0,0 Error
- STOP 0x0000007B Error After You Move the Windows XP System Disk to Another Computer
- STOP 0x0000007B Error Message When You Restart Computer
- STOP 0x0000007B Caused by Missing [SysprepMassStorage] Section on Windows XP sysprep Images
- STOP 0x0000007B Error Occurs When You Press F6 to Load Drivers During Unattended Windows Setup


Stop 0x0000007F or UNEXPECTED_KERNEL_MODE_TRAP
The Stop 0x7F message indicates that one of three types of problems occurred in kernel-mode:

# A condition that the kernel is not allowed to have or intercept (also known as a bound trap)

# Software problems

# Hardware failures

Possible Resolutions:

# Stop 0x7F messages are typically due to defective, malfunctioning, or failed memory hardware. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.

# Running the CPU beyond the rated specification, known as "overclocking," can cause Stop 0x7F or other error messages due to heat buildup. When diagnosing problems on overclocked systems, first restore all clock and bus speed settings to the manufacturer recommended values to determine if this resolves the issues.

# The problem might also be due to cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.

# Stop 0x7F messages can occur after installing incompatible applications, drivers, or system services. Contact the software manufacturer about possible Windows XP specific updates. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools.

Microsoft KB articles:
STOP 0x0000007F Errors - General Causes
STOP 0x0000007F Computer Turns Off During Text-Mode Setup if it is too hot
STOP 0x0000007F During Setup on Hewlet Packard Pavilion 7840


Stop 0x0000009F or DRIVER_POWER_STATE_FAILURE
The Stop 0x9F message indicates that a driver is in an inconsistent or invalid power state.

Possible Resolutions:

# Stop 0x9F messages can occur after installing faulty applications or drivers or system services. If a file is listed by name and you can associate it with an application, uninstall the application. For drivers, disable, remove, or roll back that driver to to determine if this resolves the error. If it does, contact the hardware manufacturer for a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools.

# For information about troubleshooting standby and hibernate mode issues, see KB article Q266169, "How to Troubleshoot Problems with Standby Mode, Hibernate Mode, and Shutting Down Your Computer in Windows 2000."

Microsoft KB articles:
Troubleshooting a Stop 0x9F Error in Windows XP
STOP 0X0000009F Computer hangs at shutdown or "Cannot find enough resources"


Stop 0xBE or ATTEMPTED_WRITE_TO_READONLY_MEMORY
The Stop 0xBE message indicates that a driver attempted to write to read-only memory.

Possible Resolutions:

# A Stop 0xBE message might occur after installing a faulty device driver, system service, or firmware. If a Stop message lists a driver by name, disable, remove, or roll back the driver to correct the problem. If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, DVD playback, and CD mastering tools.

Microsoft KB articles:
STOP 0xBE Qwestdex Dex Toolbar not totally compatible with Windows XP


Stop 0xC2 or BAD_POOL_CALLER
The Stop 0xC2 message indicates that a kernel-mode process or driver incorrectly attempted to perform memory operations in the following ways:

# By allocating a memory pool size of zero bytes.
# By allocating a memory pool that does not exist.
# By attempting to free a memory pool that is already free.
# By allocating or freeing a memory pool at an IRQL that was too high.

This Stop message is typically due to a faulty driver or software.

Possible Resolutions:

# A Stop 0xC2 messages might occur after installing a faulty device driver, system service, or firmware. If a Stop message lists a driver by name, disable, remove, or roll back the driver to correct the problem. If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update. Using updated software is especially important for multimedia applications, antivirus scanners, DVD playback, and CD mastering tools.

# A Stop 0xC2 messages might also be due to failing or defective hardware. If a Stop message points to a category of devices (such as disk controllers, for example), try removing or replacing the hardware to determine if it is causing the problem.

# If you encounter a Stop 0xC2 message while upgrading to Windows XP, the problem might be due to an incompatible driver, system service, virus scanner, or backup. To avoid problems while upgrading, simplify your hardware configuration and remove all third-party device drivers and system services (including virus scanners) prior to running setup. After you have successfully installed Windows XP, contact the hardware manufacturer to obtain compatible updates.

Microsoft KB articles:
How to Debug Stop 0xC2 or Stop 0x000000C2 Error Messages
STOP 0x000000c2 Computer with ATI FURY MAXX hangs after upgrade to Windows XP STOP 0x000000c2 After you install IomegaWare
STOP 0xC2 Bad_Pool_Caller When you upgrade from Windows 2000

Stop 0x000000CE or DRIVER_UNLOADED_WITHOUT_CANCELLING
_PENDING_OPERATIONS
This Stop messages indicates that a driver failed to cancel pending operations before exiting.

Possible Resolutions:

# Stop 0xCE messages can occur after installing faulty drivers or system services. If a driver is listed by name, disable, remove, or roll back that driver to confirm that this resolves the error. If so, contact the manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD mastering tools.

Microsoft KB articles:
STOP 0x000000CE in Dxapi.sys Error on Blue Screen
STOP 0x000000CE When you stop SFU 2.0 NFS Client Service on Windows-XP Based Computer


Stop 0x000000D1 or DRIVER_IRQL_NOT_LESS_OR_EQUAL
The Stop 0xD1 messages indicates that the system attempted to access pageable memory using a kernel process IRQL that was too high. Drivers that have used improper addresses typically cause this error.

Possible Resolutions:

# Stop 0xD1 messages can occur after installing faulty drivers or system services. If a driver is listed by name, disable, remove, or roll back that driver to confirm that this resolves the error. If so, contact the manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD mastering tools.

Microsoft KB articles:
STOP 0x000000D1 Error Message When You Turn Your Computer Off
STOP 0xD1 Error Message When You Start Windows XP
STOP 0xD1 Second Mylex AcceleRAID SCSI Controller Causes Error Message
STOP 0x000000D1 WRQ AtGuard Program causes error message in Windows XP


Stop 0x000000EA or THREAD_STUCK_IN_DEVICE_DRIVER

A device driver problem is causing the system to pause indefinitely. Typically, this problem is caused by a display driver waiting for the video hardware to enter an idle state. This might indicate a hardware problem with the video adapter or a faulty video driver.

Possible Resolutions:

# Stop 0xD1 messages can occur after installing faulty drivers (especially video drivers) or system services. If a driver is listed by name, disable, remove, or roll back that driver to confirm that this resolves the error. If so, contact the manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD mastering tools.

Microsoft KB articles:
STOP 0x000000EA ErrMsg Running Video-Intensive Programs
STOP 0x000000EA THREAD_STUCK_IN_DEVICE_DRIVER


Stop 0x000000ED or UNMOUNTABLE_BOOT_VOLUME
The kernel mode I/O subsystem attempted to mount the boot volume and it failed. This error might also occur during an upgrade to Windows XP Professional on systems that use higher throughput ATA disks or controllers with incorrect cabling. In some cases, your system might appear to work normally after you restart.

Possible Resolutions:

# If using higher throughput ATA disks and controllers, those capable of data transfer rates above 33.3 megabytes per second, replace the standard 40-pin cable with an 80-pin cable. Using an 80-pin cable is optional for transfer rates up to and including 33.3 megabytes per second, but is mandatory for higher transfer rates. The additional grounded pins are required to avoid data loss.

# Some firmware enables you to force higher transfer rates even when you are using the incorrect cable type. Your firmware might issue a warning but allow the startup process to proceed. Restore the default firmware setting for ATA cable detection.

# Problems that cause 0xED errors might also cause Stop 0x7B errors. For more information about 0x7B Stop messages, see "Stop 0x0000007B or INACCESSIBLE_BOOT_DEVICE" earlier in this appendix.

Microsoft KB articles:
STOP 0x000000ED Error Message When Volume on IDE Drive with Caching Enabled Is Mounted

STOP 0x000000ED UNMOUNTABLE_BOOT_VOLUME Error Message


Stop 0xC0000221 or STATUS_IMAGE_CHECKSUM_MISMATCH
This Stop message indicates driver, system file, or disk corruption problems (such as a damaged paging file). Faulty memory hardware can also cause this Stop message to appear.

Possible Resolutions:

# You can use Driver Rollback or System Restore from safe mode, to restore a previous driver. You can also use Windows XP Professional recovery features such as the Last Known Good Configuration startup option, Backup, or Automated System Recovery to restore a previous working configuration. After restoring from backup media, you might need to reapply service packs or hotfixes, depending on when the backups were made.

# If the Stop message names the specific file, try replacing it manually with a fresh copy from the Windows XP Professional operating system CD using safe mode or Recovery Console. For systems using the FAT16 or FAT32 file system, you have the option of using a Windows 98 or Windows Millennium Edition Emergency Boot Disk to access the hard disk.

If the original file from the operating system CD has a file name that ends with an underscore (_) character, you cannot use the file until it is uncompressed. The Recovery Console's Copy command is ideal for copying compressed files because it detects and expands them. If you do not specify a destination file name, you must rename the expanded file with the correct extension before using it. From safe mode or Recovery Console, you can use the Expand command to uncompress and copy a file to a destination location. In Recovery Console, the expanded file is given the correct name after being copied to the destination location. For more information about the Copy or Expand commands, see Windows XP Help and Support Centre.

Microsoft KB articles:
STOP C0000221 Unknown Hard Error
STOP 0xc000026C or Stop 0xc0000221 Unable to Load Device Driver Error Occurs When You Start Windows XP