A Windows Protection Error! Now what?
Are you aware that a Windows Protection Error is not the same as a General Protection Error? When there's a problem, the Windows Protection Error message is most often seen when you start or shut down Windows. "While initializing device _Some-device-name _ Windows Protection Error". These errors can occur when Windows loads or unloads a virtual device driver, also known as a VXD. Did you already know this, do you know how to fix one?
I do not want to mislead you and tell you exactly how to fix one. I am going to tell you what I have gone through fixing one recently, in the hopes it will help you the next time you need to track one down.
From the Microsoft site:
Windows Protection error messages can occur under any of the following conditions:
- If a real-mode driver and a protected-mode driver are in conflict.
- If the registry is damaged.
- If either the Win.com file or the Command.com file are infected with a virus, or if either of the files are damaged.
- If a protected-mode driver is loaded from the System.ini file and the driver is already initialized.
- If there is a physical input/output (I/O) address conflict or a random access memory (RAM) address conflict.
- If there are incorrect complementary metal oxide semiconductor (CMOS) settings for a built-in peripheral device (such as cache settings, CPU timing, hard disks, and so on).
- If the Plug and Play feature of the computer's basic input/output system (BIOS) is not working correctly.
- If the computer contains a malfunctioning cache or malfunctioning memory.
- If the computer's motherboard is not working properly
End of Microsoft.
Now for the English translation:
- Real mode is 16 bit, or when operating in DOS, Protected mode is 32 bit as in Windows. So when you boot your computer, the BIOS (the operating system for the computer motherboard) loads your hard drive, it is using a real mode driver, slow motion driver.
- I/O address is the memory address a device on the motherboard was assigned. These can be assigned by the BIOS or by Windows. you are always better off if you let Windows assign the I/O
- To add to the I/O conflict, it can also be an IRQ, See our glossary for IRQ
- Microsoft left out a few items, like defective RAM, CPU, Motherboard, or corrupt BIOS.
A Windows Protection Error can be very difficult to diagnose. The cause of the error may not be apparent even though you may see the VXD name in the error message, thereby believing it is the causative factor of the error. The VXD name however, is only the result of the error. Let me try to explain; envision a wine rack that is filled with wine bottles, each bottle has its own slot. Each of these slots represent a memory address; each VXD is loaded to a memory address. If A VXD is loaded in a memory address that another VXD is loaded to, not even the same VXD, wham - a Windows Protection Error. Why? Well, if the wine rack is being filled by automation and the slot is already filled and a new bottle tries to take its place, the new bottle will fall on the ground and break. Hence, Windows reports the VXD error, the one that is broken, the one that is trying to fit in the slot or memory address; as you see it "Windows Protection Error: VMM (VXD) : 0007:5BDE5". Therefore, if you try to replace that file, you will probably not cure the problem.
So now how do we find what is causing the error? Well the best way I can explain how is to tell you what I recently had to do to fix one, and how I developed a Windows Protection Error.
I was recently revamping and setting up my 5 computers, one at a time. I started setting up the backup Web Server, but could not get it to boot past the BIOS post. After much ado, I determined that the motherboard must be bad and decided to build a new computer. Now I believe that as a Web Server it only needs to serve files to my visitors, so the hard drive (a 10,000 rpm SCSI) is the most important piece of hardware, outside a great firewall and router. The CPU only runs at 4% and uses only 68 megs of memory, although I have 128 Megs of RAM and a huge pagefile (swapfile). The next most important thing is to keep the computer cool, the server is going to run 24/7 for several years. So it's getting lots of fans: CPU fan, a side fan to blow over the CPU, a top case fan, front, rear, power box, and one more fan for good measure vented through the top of the computer. You never know when one fan will die.
I am telling you all this because you need to understand what you can be up against when trying to find and fix a Windows Protection Error. These errors are normally caused by hardware drivers and VXDs being incompatible. Now I need to fill you in on the rest.
I do not need a 1.5 GHz CPU for a Web Server, too much heat, so I decided to replace what I call my second machine, my backup production machine, to a 1.5 GHz. My second machine did not get a lot of use, but all the hardware has been tested and known to be good. It has a K6-III 450 CPU and 256 Megs of RAM. This will make a great Web Server, I will remove the sound card, modem, Network card, display adapter, floppy drive, CD-ROMs, and install a older display adaptor, a new SCSI Controller card, and new network card. The new backup server was up and running with a fresh SCSI drive and a fresh copy of Windows 2003 Server in just a few hours. No problems were encountered.
Now comes the problem, building the new second production machine. I used the hard drives, display adaptor, CD-ROMS, floppy, sound card, network card, modem that I took out of my second machine. The hard drives contain all of Microsoft's operating systems except Windows DOS, 3.1 and Windows 95 because they are obsolete and cannot support the newer hardware on their own. Each OS, Windows 98, 98SE, ME, NT4, 2 versions of 2000, 3 versions of 2003, 2 versions of XP, are installed to a different partition and can be booted to. All are working perfectly and all are Plug and Play capable, so Windows should be able to install the new hardware without any conflicts. The NT4 OS will need a little help from me.
In comes all my parts for the new computer, a new tower and power supply, a pre-tested motherboard - RAM and CPU, you know one of those bundled deals. Assembled my new computer in a flash. I read the motherboard manual before I start it up just to make sure I did not overlook anything. It's now time to power it up to the first OS, Windows ME. ME will see the new hardware, install it, and everything should go without a glitch.
WRONG! Up came the Windows ME splash screen and then the BSOD with a Windows Protection Error, even in Safe Mode. For those not in the know, a BSOD is the Blue Screen Of Death. By the way I made my BSOD different colors for each OS using my BSOD program . Well, I said to myself, maybe I figured wrong about Windows ME.
I tried to boot to all the other operating systems with the same results. I know the operating systems are fine, the file systems are fine. I did not install any new software in a long time. So what could be the problem? At this point I went back into the BIOS and started disabling everything I could, thinking that it must be a hardware conflict, such as an IRQ conflict. Still, the BSOD was there on every boot. Then I started to disable things like System Bios Cache, and shadows. These items use memory addresses, and no IRQs, and maybe Windows is trying to write to one of those addresses. Everything that used a memory address or IRQ was disabled, except for the IDE and floppy controllers.
I then decided to try to reinstall Windows ME, but I got a SUWIN error and setup would close. So then I tried to reinstall Windows 2000 and 2003 and XP, all ended up with a BSOD during the installations. It seemed to me that is was the IDE controllers conflicting, because the BSOD was early in the boot, about the time Windows would load drivers for the hard drives. I even tried to delete the Enum Key in the Registry from DOS on the Windows ME OS, the Enum Key is the hardware Key. RegEdit would return an error "Unable to open the Registry (1,016)", even after replacing the Registry with a few different backups. This would lead one to think the file system or FAT was corrupt. I got out every DOS disk utility I had including the all standard Scandisk and ran them all. They all reported lots of errors, and fixed them. Scandisk would hang at 85%. Anyway, in the end Scandisk did not really find any errors or fix any of them, as there really were none to fix.
After about 8 hours of frustration, I disabled the L1 Cache, known as the Internal Cache or the CPU Cache, the last item to disable, and L1 does not use an IRQ or a memory address. It is its own memory address. This slowed the machine down to as slow as ice melting on a cold winter day. I attempted to install Windows ME again from DOS. Setup said it would only take 122 minutes, it took over 12 hours to reinstall Windows when all was said and done, including several Windows installation hang-ups, necessitating both slow and painful reboots.
Well, with this task done I re-enabled the L1 Cache and reboot to have Windows finish the setup and setup the Control Panel and whatever else it does, only to learn that the BSOD was there again. I rebooted and turn off the L1 Cache again and Windows booted, slower then slow. I rebooted again and this time went in Safe Mode and did some manual setup of hardware to ensure that I would not have any conflict. Rebooted and turned everything back on in the BIOS and yes you guessed it, the BSOD. I then turned off only the L1 Cache and Windows booted with just 4 minutes to finish installing Windows, which took about another 90 minutes or so.
Well the point here is, if before I had gotten the Windows Protection Error and I had just installed a new piece of software I would have looked at the file system for changes. If I installed a new piece of hardware I would look at the IRQs. If I did both I would remove the new hardware and see what happens. If I had installed nothing, I would have looked for a corrupt Registry or failing CPU. If my operating system had been giving me a problem before the BSOD I would look at the file system, the Registry and CPU (possibly), unless it was hardware related, such as a flickering screen. Then I would look at just the hardware. If I found that the files that I was working in, were corrupt from time to time prior to all this, I would look at RAM or the CPU.
But why look at my pre-tested motherboard, RAM, and CPU bundle, it all is pre-tested! None of these items use IRQ's except for the IDE controllers, the motherboard will assign the standard IRQ's for IDE' controllers, 14 and 15. Therefore, it must be a corrupted VXD file! So let me replace all my VXD files, and try rebooting; it's a no-go.
It turned out that all I needed was a new stick of RAM to fix the Windows Protection Error. The tested one I bought was bad. It was only through trial and error that led me to this discovery.
You're asking me how to fix your Windows Protection Error? Only you know what you have changed lately, and if you changed nothing, you need to look at everything. There is no software out there that can find your Windows Protection Error, it is something you need to find yourself. A Windows reinstall should work most of the time, but not always.
One last trick you can use is the bootlog file. While your computer is running fine, create and save a bootlog. Then when you get a Windows Protection Error, create a new bootlog and compare them. The new bootlog will either stop at the file causing the error or the next file that is not reported in the new bootlog but is in the old bootlog. So you need to look at the saved bootlog to find the next file Windows is trying to load. A big help would be to know what the file is that is causing the error and what it does, or at least what it is for.