A diagnostic program may immediately close and you may receive a "Stop error code 0x00000050" (PAGE_FAULT_IN_NONPAGED_AREA) or "Stop error code 0x0000000A" (IRQL_NOT_LESS_OR_EQUAL) error message in Windows Server 2003, Windows 2000, or Windows XP
When you try to run one of the following diagnostic programs, the program may immediately close:
Registry Editor (Regedit.exe)
Task Manager (Taskmgr.exe)
System Configuration Utility (Msconfig.exe)
System Information (Msinfo32.exe)
You may also experience any one of the following symptoms:
The computer automatically restarts.
After you log on, you receive the following error message:
Microsoft Windows The system has recovered from a serious error. A log of this error has been created. Please tell Microsoft about this problem. We have created an error report that you can send to help us improve Microsoft Windows. We will treat this report as confidential and anonymous. To see what data this error report contains, click here.
When you click the click here link at the bottom of the message box, you see error signature information that may be similar to one of the following data samples:
When you view the System log in Event Viewer, you may see an entry that is similar to one of the following:
Date: date Source: System Error Time: time Category: (102) Type: Error Event ID: 1003 User: N/A Computer: COMPUTER Description: Error code 00000050, parameter1 ffffff60, parameter2 00000000, parameter3 804fa26f, parameter4 00000000. For more information, see Help and Support Center at http://support.microsoft.com. Data: 0000: 53 79 73 74 65 6d 20 45 System E 0008: 72 72 6f 72 20 20 45 72 rror Er 0010: 72 6f 72 20 63 6f 64 65 ror code 0018: 20 30 30 30 30 30 30 35 0000050 0020: 30 20 20 50 61 72 61 6d 0 Param 0028: 65 74 65 72 73 20 66 66 eters ff 0030: 66 66 66 66 64 31 2c
Date: date Source: System Error Time: time Category: (102) Type: Error Event ID: 1003 User: N/A Computer: COMPUTER Description: Error code 0000000A, parameter1 ffffff94, parameter2 00000000, parameter3 00000000, parameter4 804e15ef. For more information, see Help and Support Center at http://support.microsoft.com. Data: 0000: 53 79 73 74 65 6d 20 45 System E 0008: 72 72 6f 72 20 20 45 72 rror Er 0010: 72 6f 72 20 63 6f 64 65 ror code 0018: 20 30 30 30 30 30 30 35 000000A 0020: 30 20 20 50 61 72 61 6d 0 Param 0028: 65 74 65 72 73 20 66 66 eters ff 0030: 66 66 66 66 64 31 2c
The symptoms of a Stop error vary according to your computer's system failure options. For more information about how to configure system failure options, click the following article number to view the article in the Microsoft Knowledge Base:
307973 How to configure system failure and recovery options in Windows
The four parameters that are inside the parentheses of the Stop error message vary according to the computer's configuration.
Not all "Stop 0x0000000A" errors are caused by the problem that is described in this article. For more information about how to troubleshoot Stop 0x0000000A errors in Windows XP, click the following article number to view the article in the Microsoft Knowledge Base:
314063 Troubleshooting a Stop 0x0000000A error in Windows XP
This problem may occur if the computer is infected with a variant of the Sdbot virus.
The Sdbot virus creates a hidden process. This process closes programs that system administrators use for diagnostic and configuration purposes. The process may also prevent these programs from running.
The file name of the Sdbot virus varies. Many variants of this virus put a driver that is named Msdirectx.sys or Haxdrv.sys on the computer. This driver is used to hide the virus process. The file names that the virus frequently uses include Msdrv.exe and Sdkcore.exe. These virus variants can restore the virus if you delete the files.
To resolve this problem, use one of the following methods:
To automatically remove some versions of this virus, run the Microsoft Malicious Software Removal Tool.
The April release of this utility can remove some variants of this malware. You can find information and downloads for the Malicious Software Removal Tool at the following locations:
Note These files may exist in various folders on the computer. For example, the files have been reported in the following folders:
C:\Documents and Settings\UserName\
Perform a search to find all instances of Msdirectx.sys and Haxdrv.sys. Then, type the commands in this step, but replace the %systemroot%\system32\ path with the path of each file that you find.
Type the following commands to delete the files. Press ENTER after each command.
del %systemroot%\system32\msdirectx.sys del %systemroot%\system32\haxdrv.sys del %systemroot%\system32\msdrv.exe del %systemroot%\system32\sdkcore.exe
If you found other instances of these files in step 7, repeat these commands by using the path of each file that you found.
Restart the computer.
Make sure that your antivirus and anti-spyware programs are updated with the latest definitions. Then, perform a complete system scan. As of April 7, 2005, the following files are detected by the following programs:
Microsoft Windows Server 2003, Web Edition, Microsoft Windows Server 2003, Standard Edition (32-bit x86), Microsoft Windows Server 2003, Enterprise Edition (32-bit x86), Microsoft Windows Server 2003, Datacenter Edition (32-bit x86), Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems, Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems, Microsoft Windows 2000 Server, Microsoft Windows 2000 Professional Edition, Microsoft Windows 2000 Advanced Server, Microsoft Windows XP Tablet PC Edition, Microsoft Windows XP Professional, Microsoft Windows XP Home Edition, Microsoft Windows XP Media Center Edition 2005 Update Rollup 2