This text came from the Norton AntiVirus Page at
http://service2.symantec.com/SUPPORT/ent-security.nsf/3d2a1f71c5a003348525680f006426be/d892c49e5be7254888256a220027286a?OpenDocument

===========================================================================================================

How to diagnose and correct Fatal Exception, Invalid Page Fault, and General Protection Fault errors

Situation:
Your computer displays Fatal Exception, Invalid Page Fault, General Protection Fault, or other memory-related error messages. You want to track down the cause of the problem and correct it.

Solution:
This document describes some common symptoms of memory-related errors and methods used to diagnose and correct them.


Common symptoms and their cause

Problems related to memory are revealed in various ways. The following list describes some of the more common symptoms and their causes:

X caused a General Protection Fault in module Y: Module X trespassed in the memory space allocated to module Y. This does not necessarily indicate that either X or Y was the culprit. A third module may have been involved, which the Windows memory manager did not include in the error message. Regardless of the apparent severity of the problem, if it is possible, you should save all data, close all applications, and then shut down Windows. You should turn off the power to the computer and then back on before restarting Windows.
Unable to load X: This is typically caused by the X file being damaged. Try replacing the file by either copying it from another source, such as another computer, or expanding the file from the original installation medium. If this does not solve the problem, then you likely have a memory problem.
Unable to find X: This is one of the most common and misleading memory-related messages. The message indicates that the X file is not where it is expected to be according to the Path statement, the registry, or an .ini file. If the file is undamaged, correctly pathed, and exists in the correct location, then the cause could be insufficient file handles or a corrupted memory manager.
The mouse cursor constantly indicates the system is busy: This indicates that a program has not released control of the processor for use by Windows or other applications. Pressing Ctrl+Alt+Del one time will open the Close Program dialog box and may indicate which program is not responding. You may click the offending program, and then click End Task. Memory corruption or resource depletion are the most frequent causes of this problem, although interrupt and IRQ misconfiguration are also factors.
Fatal Exception 0D: This is a processor exception reporting a General Protection Fault (as mentioned previously) that was trapped in hardware by the processor, not by the operating system. In Windows 95/98, this will most often be associated with a device driver. There will usually be no recovery from this error; only a screen with a blue background and white text advising you that your session is about to be terminated. In the unlikely event that you can get back to your desktop, you should save all data, close all applications, and then shut down Windows. You should turn off the power to the computer and then back on before restarting Windows.
Fatal Exception 0E: This is a processor exception reporting a Page Fault that was trapped in hardware by the processor, not by the operating system. In Windows 95/98, this will most often be associated with a low-level device driver that deals with hardware interrupts (video, communications, printer, scanner, or other peripherals using the I/O system). There will usually be no recovery from this error; only a screen with a blue background and white text advising you that your session is about to be terminated. In the unlikely event that you can get back to your desktop, you should save all data, close all applications, and then shut down Windows. You should turn off the power to the computer and then back on before restarting Windows. Device Manager will often indicate a conflict for the offending device.

Fatal Exception 0E can also be the result of logical or physical damage to the swap file or virtual memory manager (VMM) tables. A swap file, whether temporary or permanent, that is too small can be the cause. Creating a larger permanent swap file will often solve this problem
Segment load failure: This usually indicates that the memory manager cannot load part of a requested program or .dll file. (Occasionally, it will indicate that the module is corrupted, rather than the memory manager.) The cause may be one of the following:
Lack of file handles
Lack of memory
Fragmented memory allocations
Corrupted management table or pointers


How to determine the cause of the memory problem

The process of diagnosing a memory-related problem begins by simplifying the memory environment. You do this by establishing a baseline configuration in which the operating system and the application experiencing the problem run successfully. Gradually increase the complexity of the environment, by installing programs and enabling program options, until the system fails. At that point you should have a pretty good idea of which program or program option caused the failure.

The following sections contain specific steps you can follow to help isolate and correct memory problems.


Windows 95/98 troubleshooting path:

The following three steps will set you on the path to resolving many memory and hardware related problems:
1. Device Manager
2. MEM /C /P
3. [386enh]

The information gained will help in selecting the appropriate methods from those listed below. Before embarking on the following procedures, check the following:
1. Check System Properties for general for Windows 95/98 version information.
2. Check the Performance tab for:
System Resources free
Amount of RAM
Status of File System and Virtual Memory: 32-bit File System and VM is normal. DOS Compatibility Mode is not normal, and most 32-bit disk utilities may exhibit anomalous behavior if running under DOS Compatibility Mode. This may indicate a virus, a Real Mode disk-related driver, a device conflict or configuration issue, or a failure of Windows 95/98 to properly initialize the system for 32-bit operation.
3. Check Device Manager for conflicts. You must resolve conflicts before addressing functionality issues. If you are supporting a 16-bit program, this is not your job; if a 32-bit application, this may or may not be your job.
4. Check the System.ini file's [386enh] for DEVICE= statements that do not begin with an asterisk. (You want DEVICE=*..., but you do not want DEVICE=SOFTRAM.386.) Non-asterisk devices are non-Windows 95/98 devices, probably installed by Windows 3.x applications.
5. Check the TaskList for running 32-bit applications, then open up a DOS window, and type:

mem /c /p

Mem /c /p will display the Largest Executable Program Size and a list of programs loaded in DOS memory. Write it all down. Those programs carry across all VMs.
6. Type set and then press Enter to determine the Path and the location of the temporary directory.

QuickFix
If typing mem /c /p or the System.ini file's [386enh] yield any non-Windows 95/98 components, then use the System Configuration Editor (Sysedit.exe) to modify the boot files to establish a clean environment. Make these changes:
Autoexec.bat: Do not allow TSRs or drivers to load into memory.
Config.sys: Ensure devices HIMEM.SYS and EMM386.EXE NOEMS load from the Windows 95/98 folder, and that no other devices are loaded or installed.
Win.ini: Comment out the RUN= and LOAD= lines.
System.ini: Comment out all DEVICE= statements that do not begin with an asterisk. (You want DEVICE=*..., but not DEVICE=SOFTRAM.386.) Be ruthless.

If the system is not amenable to a QuickFix, then at least you are now armed with some basic information. Follow these steps to proceed with a thorough cauterization:
1. Verify your application is in the path if it needs to be, and that TEMP="some existing temp directory". If not, fix it in Autoexec.bat.
2. Delete all *.TMP files from all TEMP and TMP directories.
3. Run Norton Disk Doctor (NDD /COMPLETE) or ScanDisk (SCANDISK /SURFACE).
4. Set up a large permanent swap file. If the drive is too fragmented, run Speed Disk or Defrag, then set up a large permanent swap file. (In this context, large means at least 40-60 MB for an 8 MB RAM system, 32-60 MB for 16 MB RAM) If the swap file is already permanent, remove the swap file, boot to a Command Prompt, delete the swap file (WIN386.SWP), reboot to Safe Mode with no swap file and no startup folder, then set up a new swap file, and reboot to Normal Mode.
5. F8 boot to the Windows 95/98 StartUp menu, and select Step-by-Step Confirmation: (A more drastic and therefore more desirable alternative is Step 8 below.)
6. In Config.sys:
Choose YES to "Process the system Registry."
Choose NO to "Create a startup log file."
Choose NO to "Process your startup device drivers" (Config.sys).
Choose YES to everything else in Config.sys.
7. In Autoexec.bat:
Choose YES to all PATH and SET statements.
Choose YES to "load all windows drivers".
Choose NO to everything else.

NOTE: The above steps provide a better environment in nearly all cases, and will rarely have an adverse effect on the client's configuration. The steps below may be temporary, intended for diagnostic purposes only, and will need to be undone to restore the computer to its previous configuration. However, if you need to go this far, you will not usually restore the computer's configuration.

8. Rename Config.sys, Autoexec.bat and Win.ini. A not so drastic and therefore less desirable alternative is Steps 5-7 above. 
9. When interrupt or communications issues are potentially involved, check that System.ini [boot] comm.drv=comm.drv.
10. Empty the StartUp folder.
11. Set Graphics Hardware Acceleration to None.
12. Change from SVGA to VGA mode.
13. Reboot to Safe Mode then to normal mode to force reconstruction of VMM32.
14. Verify the task list is empty except for Explorer. If the problem remains, do one of the following in System.cb:
Add "mouse.drv=mouse.drv" to [boot]
Add "mouse=*vmouse, msmouse.vxd" to [386Enh]
15. Rename System.ini.
16. Copy System.cb to System.ini.
17. If you do not use System.cb, then in the System.ini [386Enh] section, remark out all DEVICE= statements that do not equate to asterisk (*) something. Windows 95/98 drivers are installed in the Registry, not the INI files.

Your tools in this process are:
System Properties / Device Manager
MEM /C /P
Rename
SET
F8 boot, vanilla Windows

These tools provide the information necessary to determine which of the above steps are appropriate, and, in some cases (such as a Device Manager conflict), whether there is any point to proceeding at all.

Cauterization In a Pure 32-bit Environment
What do you do when you have memory problems, and there are only 32-bit applications running on a 32-bit platform?

So far, there are few applications that cause memory problems in Windows 95/98; all applications seem to be well-behaved and abide by the rules except for applications, utilities, or tools that deal directly with memory. "RAM doublers" and alternate memory do not work well on all computers and applications. The same is true of disk caches, drive-performance enhancers, and replacement shells. Sever the connection between Windows 95/98 and surrogate memory managers and shells before trying to run down memory problems.

The most frequent 32-bit sources of Windows 95/98 memory problems are video drivers, the virtual memory subsystem, the Plug and Play subsystem, and hardware configuration. Consequently, your resources for this process are:
Device Manager
Performance
Display Settings

Before embarking on the following procedures, check the following:
1. Check System Properties for general for Windows 95/98 version information.
2. Check the Performance tab for:
System Resources free
Amount of RAM
Status of File System and Virtual Memory: 32-bit File System and VM is normal. DOS Compatibility Mode is not normal, and most 32-bit disk utilities may exhibit anomalous behavior if running under DOS Compatibility Mode. This may indicate a virus, a Real Mode disk-related driver, a device conflict or configuration issue, or a failure of Windows 95/98 to properly initialize the system for 32-bit operation.
3. Check Device Manager for conflicts. You must resolve conflicts before addressing functionality issues. If you are supporting a 16-bit program, this is not your job; if a 32-bit application, this may or may not be your job.
4. Check the TaskList for running 32-bit applications.
5. Check Add/Remove Programs for any installed elements that may not appear on the TaskList (for example some uninstallers, memory managers).

Using the previous information, follow these steps:
1. Delete all *.tmp files from the TEMP directories.
2. Run Norton Disk Doctor (NDD /COMPLETE) or ScanDisk (SCANDISK /SURFACE).
3. Set up a large permanent swap file. If the drive is too fragmented, run Speed Disk or Defrag, set up a large permanent swap file. (In this context, large means at least 40 to 60 MB for an 8 MB RAM system, 32-60 MB for 16 MB RAM.) If the swap file is already permanent, remove the swap file, boot to a Command Prompt, delete the swap file (WIN386.SWP), restart to Safe Mode with no swap file and no startup folder, then set up a new swap file, and restart to Normal Mode.
4. Empty the StartUp folder.
5. End Task on all task list items except Explorer.
6. Set Graphics Hardware Acceleration to None.
7. Change from SVGA to VGA mode.
8. Rename Config.sys, Autoexec.bat and Win.ini.
9. In System.cb:
Add "mouse.drv=mouse.drv" to [boot]
Add "mouse=*vmouse, msmouse.vxd" to [386enh]
10. Rename System.ini.
11. Copy System.cb to System.ini.
12. Restart to Safe mode then to Normal mode to force reconstruction of VMM32.

Your tools in this process are:
System Properties / Device Manager
VMM Optimization
Video Simplification
Vanilla Boot

A Word on Windows 95/98 Plug'n'Play
Inappropriate hardware registration can cause symptoms that look like memory faults, especially Fatal Exceptions 0D and 0E, but also conventional page faults and GPFs. P'n'P registration is very sensitive to timing. One characteristic of P'n'P problems is the inconsistency of their manifestations. A particular session may be error-free, another plagued with errors. A cold boot is more likely to result in a broken session than a warm boot. In these cases the initialization and registration timing is marginal, sometimes succeeding and sometimes failing.

Hardware configuration errors are more likely to manifest consistently. Video card/driver configuration problems will be more consistent than scanner registration problems. To further complicate matters, hardware misconfiguration can make the Windows 95/98 P'n'P process even more problematic, resulting in a consistent set of symptoms occasionally supplemented by an inconsistent set.

Distinguishing between true memory problems and subtle hardware/registry interplay is not easy. Your resources in this are:
Attention to Detail: Be certain the environment is very clean.
Informed Common Sense: Windows 95/98 has a rationale all its own. Use your common sense, but base it on knowledge of Windows 95/98's behavior.

Cauterize 16-bit
This section discusses DOS/Windows 3.x memory problems. Before embarking on the following procedures, follow these steps to gather some basic information to help make sense of what you see later:
1. Resources: Program Manager, Help, About displays the Windows version, resources available, and amount of physical memory. Make a note of all three.
2. Typing mem /c /p lists programs loaded in memory and the Largest Executable Program Size. Write it all down.
3. Typing set will provide the location of the temporary directory.
4. Config.sys will show the number of files and buffers.

Now that you are armed with that basic information, follow these steps:
1. Verify that FILES= at least 50, maybe 99 (depending on applications); and BUFFERS=40. If not, fix it in the Config.sys.
2. Verify your application is on the path if it needs to be, and TEMP= an existing temporary directory. If not, fix it in Autoexec.bat.
3. Delete all *.TMP files in all TEMP and TMP directories.
4. Run Norton Disk Doctor (NDD /COMPLETE) or ScanDisk (SCANDISK /SURFACE) from DOS, not from Windows.
5. Set up a large permanent swap file. If the drive is too fragmented, run Speed Disk or Defrag, then set up a large permanent swap file. In this context, large means a minimum of 24 MB total virtual memory (physical RAM + SwapFile) or 8 MB+physical RAM, whichever is largest.

NOTE: The above steps provide a better environment in nearly all cases, and will rarely have an adverse effect on your system configuration. The steps below are temporary, intended for diagnostic purposes only, and will need to be undone to restore the computer to its previous configuration. Use a unique remark (like ;;; or ;x; or ;day-of-week;) to make it easier to identify what you have done.

6. Empty the Win.ini RUN= and LOAD= lines.
7. In the System.ini file's [386Enh] section, remark out any non-Windows and/or dubious DEVICE= statements that do not equate to asterisk (*) something.
8. When interrupt or communications issues are involved, check that System.ini [boot] contains comm.drv=comm.drv, and for Windows for WorkGroups check that the date of SERIAL.386 is no earlier than 2/17/94.
9. Check the memory manager for necessary exclusions (especially video memory), forced inclusions, cloaking, and HiScan / Stealth.
10. Check versions of suspect releases of memory managers (for example, QEMM7.5 prior to Spring '95/98 and SoftRAM)
11. If necessary, perform an F8 boot. In the Config.sys, respond like this
YES to DEVICE=C:\WINDOWS\HIMEM.SYS
YES to FILES=??
YES to BUFFERS=??
NO to all other DEVICE, DEVICEHIGH, and INSTALL statements
YES to "run Autoexec.bat?"
12. In the Autoexec.bat, respond like this:
YES to all PATH and SET statements
NO to everything else
13. Type win and then press Enter to start Windows if necessary.

Your tools in this process are:
Resources
MEM /C /P
SET
F8 boot, Himem and path only.

These tools provide the information necessary to determine which of the above steps are appropriate.

 
Product(s): General
Operating System(s): Windows 95, Windows 98, Windows 3.1, Windows for Workgroups 3.11, DOS
Document ID: 1996112592021
Date Created: 11/25/96
Last Modified: 01/31/2001