Unable to load image systemroot system32 ntoskrnl exe win32 error 0n2

I have solve this problem as follows:

1.Create a sub directory named “45D69A89490000” in C:symbolFilePathntoskrnl.exe;

2.Copy ntoskrnl.exe from dump machine (%windir%/system32) to C:symbolFilePathntoskrnl.exe45D69A89490000

ntoskrnl.exe symbol can load
accurately now.

0: kd> !analyze -v
*******************************************************************************
*                                                                          
  *
*                        Bugcheck Analysis                                    *
*                                                                          
  *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffadf52a90526, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffffadf2798f290, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
——————

Could not read faulting driver name

READ_ADDRESS:  fffffadf52a90526 

FAULTING_IP: 
disk!memmove+60
fffffadf`2798f290 488b040a        mov     rax,qword ptr [rdx+rcx]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  7

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0x50

PROCESS_NAME:  clienteng.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf257d2520 — (.trap 0xfffffadf257d2520)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffadf3288b010 rbx=0000000000000000 rcx=fffffadf329e0e00
rdx=00000000200af726 rsi=0000000000000000 rdi=0000000000000000
rip=fffffadf2798f290 rsp=fffffadf257d26b8 rbp=fffffadf39a8e1b0
 r8=0000000000000018  r9=0000000000000003 r10=5be72d2eea34000b
r11=fffffadf329e0e00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
disk!memmove+0x60:
fffffadf`2798f290 488b040a        mov     rax,qword ptr [rdx+rcx] ds:0004:fffffadf`52a90526=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a58f2 to fffff8000102e950

STACK_TEXT:  
fffffadf`257d2448 fffff800`010a58f2 : 00000000`00000050 fffffadf`52a90526 00000000`00000000 fffffadf`257d2520 : nt!KeBugCheckEx
fffffadf`257d2450 fffff800`0102d519 : fffffadf`39697750 00000000`00000000 fffffadf`00000000 fffffadf`32aaef40 : nt!MmAccessFault+0xa1f
fffffadf`257d2520 fffffadf`2798f290 : fffffadf`2798c8dd 00000000`00000000 fffffadf`39697750 00000000`00000000 : nt!KiPageFault+0x119
fffffadf`257d26b8 fffffadf`2798c8dd : 00000000`00000000 fffffadf`39697750 00000000`00000000 fffffadf`39a8e670 : disk!memmove+0x60
fffffadf`257d26c0 fffffadf`29a5637a : fffff800`c0100080 fffffadf`257d2950 fffffadf`32aa8440 fffffadf`257d2cf0 : disk!DiskDeviceControl+0x7ed
fffffadf`257d2930 fffff800`01379339 : fffffadf`32aa8440 fffffadf`257d2cf0 00000000`00000000 fffffadf`32aa8440 : PartMgr!PmDeviceControl+0x4aa
fffffadf`257d29c0 fffffadf`27937922 : ffffffff`ffffffff 00000000`20206f49 fffffadf`32aa8440 fffffadf`38e6c620 : nt!RawDispatch+0x159
fffffadf`257d2a10 fffff800`01280111 : 00000000`00000000 fffffadf`257d2cf0 00000000`00000001 fffffadf`32aaef40 : fltMgr!FltpDispatch+0x1c2
fffffadf`257d2a70 fffff800`0127fc16 : 00000000`000003f8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xa79
fffffadf`257d2b90 fffff800`0102e3fd : fffffadf`32911c20 fffffadf`32acd840 fffffadf`32911f00 00000000`00000000 : nt!NtDeviceIoControlFile+0x56
fffffadf`257d2c00 00000000`78ee0a5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`02aed1f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x78ee0a5a

• Edited by
  bendsha
  Tuesday, October 21, 2014 9:27 AM
• Marked as answer by
  bendsha
  Tuesday, October 21, 2014 10:45 AM

Hi, I have a few computers that have started to BSOD

No new applications software have been installed, ive run a full memory check (memtest86) and chkdsk’d the disks all come back with no errors, the BSOD’s seem to happen randomly. (Win7 64bit)

Here is the dump file if anyboady can help it would be greatly appreciated!

—————————————————————————————————-

Microsoft (R) Windows Debugger Version 6.2.8400.0 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [F:\070612-19921-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:Symbols
Executable search path is:
Unable to load image SystemRootsystem32ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Machine Name:
Kernel base = 0xfffff800`02c02000 PsLoadedModuleList = 0xfffff800`02e46670
Debug session time: Thu Jul  5 17:06:55.001 2012 (UTC + 1:00)
System Uptime: 0 days 0:01:23.007
Unable to load image SystemRootsystem32ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
………………………………………………………
……………………………………………………….
……………………………
Loading User Symbols
Loading unloaded module list
….
*******************************************************************************
*                                                                            
*
*                        Bugcheck Analysis                                   
*
*                                                                            
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {91, 1, fffffa8006b8bb50, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                  
***
***                                                                  
***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn’t have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing «.symopt- 100». Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                  
***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                  
***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                         
***
***                                                                  
***
***    Type referenced: nt!_KPRCB                                    
***
***                                                                  
***
*************************************************************************
*************************************************************************
***                                                                  
***
***                                                                  
***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn’t have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing «.symopt- 100». Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                  
***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                  
***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                         
***
***                                                                  
***
***    Type referenced: nt!KPRCB                                     
***
***                                                                  
***
*************************************************************************
*************************************************************************
***                                                                  
***
***                                                                  
***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn’t have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing «.symopt- 100». Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                  
***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                  
***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                         
***
***                                                                  
***
***    Type referenced: nt!_KPRCB                                    
***
***                                                                  
***
*************************************************************************
*************************************************************************
***                                                                  
***
***                                                                  
***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn’t have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing «.symopt- 100». Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                  
***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                  
***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                         
***
***                                                                  
***
***    Type referenced: nt!KPRCB                                     
***
***                                                                  
***
*************************************************************************
*************************************************************************
***                                                                  
***
***                                                                  
***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn’t have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing «.symopt- 100». Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                  
***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                  
***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                         
***
***                                                                  
***
***    Type referenced: nt!_KPRCB                                    
***
***                                                                  
***
*************************************************************************
*************************************************************************
***                                                                  
***
***                                                                  
***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn’t have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing «.symopt- 100». Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                  
***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                  
***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                         
***
***                                                                  
***
***    Type referenced: nt!_KPRCB                                    
***
***                                                                  
***
*************************************************************************
*************************************************************************
***                                                                  
***
***                                                                  
***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn’t have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing «.symopt- 100». Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                  
***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                  
***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                         
***
***                                                                  
***
***    Type referenced: nt!_KPRCB                                    
***
***                                                                  
***
*************************************************************************
*************************************************************************
***                                                                  
***
***                                                                  
***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn’t have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing «.symopt- 100». Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                  
***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                  
***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                         
***
***                                                                  
***
***    Type referenced: nt!_KPRCB                                    
***
***                                                                  
***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+7f1c0 )

Followup: MachineOwner
———

#26
Will Steele (User) Posts: 17	Unable to load image ntoskrnl.exe 17 Feb 2010 — 18:52 I want to be sure I have WinDbg configured properly. I’ve got a minidump that returns this error when I load it: Loading Dump File [C:Documents and SettingswillDesktopMini021610-02.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: srv*;srv*c:Symbols*http://msdl.microsoft.com/download/symbols Executable search path is:  Unable to load image WINDOWSsystem32ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible Product: WinNt Machine Name: Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0 Debug session time: Tue Feb 16 10:21:13.427 2010 (GMT-6) System Uptime: 0 days 1:31:16.250 Unable to load image WINDOWSsystem32ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Loading Kernel Symbols ............................................................... ............................................. Loading User Symbols Loading unloaded module list ...... ERROR: FindPlugIns 80070015 ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000008E, {c0000005, 8056ed77, b1813970, 0} ***** Kernel symbols are WRONG. Please fix symbols to do analysis. I have downloaded and pointed to the correct, checked symbols for the OS (XP SP3) and encounter this error. I did glean from another post (http://www.ozzu.com/mswindows-forum/ntos…e-errors-t61620.html) that the c0000005 parameter noted in the BugCheck suggests a memory issue. Is there anything I might reconfigure (or download) to get past this error?
	Logged IP
	The administrator has disabled public write access.

#28
Robert Kuster (Visitor) Moderator Posts: 39	Re:Unable to load image ntoskrnl.exe 18 Feb 2010 — 13:15 Will, Hi. Unable to load image WINDOWSsystem32ntoskrnl.exe, Win32 error 0n2 For some reason WinDbg doesn’t find the associated ntoskrnl.exe image. You usually need both for Crash Dumps: a) The executable itself (in this case «ntoskrnl.exe»), so that WinDbg is able to show you the disassembly and so on b) The PDB files -> to get even more information about the executables in question Here is what I would try to do: 1) put the executable «ntoskrnl.exe» to a place where WinDbg will find it. Take a look at: File (menu) -> Image File Path . If this doesn’t help I would: 2) Change your symbol path: « srv*; srv*c:Symbols*msdl.microsoft.com/download/symbols» -> «srv*c:Symbols*msdl.microsoft.com/download/symbols» I don’t know if the first srv*; can confuse WinDbg; in any case it won’t help either. 3) Enter the following commands to WinDbg: > !sym noisy > ld ntoskrnl > .reload /f /v ntoskrnl.exe If everything went fine WinDbg will have loaded «ntoskrnl.exe» and its PDB files by now. You can easily check this with one of the following commands: > !lmi ntoskrnl > lm vm ntoskrnl 4) If WinDbg still failed to find/retrieve the appropriate files you should at least get a hint of what went wrong because of the «!sym noisy» command (noisy mode — symbol prompts on). Check 7) Symbols and 10) Loaded modules and image information for more details about the commands mentioned above. I hope this helps, Robert
	Thinking debugging? Think www.windbg.info.
	Logged IP
	The administrator has disabled public write access.

#30
Will Steele (User) Posts: 17	Re:Unable to load image ntoskrnl.exe 18 Feb 2010 — 16:37 I feel dumb. While thumbing though the glossary of my copy of Windows Internals I noticed there are two kernel .exe files: ntkrnlmp and ntoskrnl. The first (ntkrnlmp) is for multiprocessor machines. The second (ntoskrnl) is for single processor machines. The light bulb came on and I verified that my machine (a newer dual processor laptop) would not have the single processor .exe. I went to double check with my co-worker who did in fact say the machine which generated the dump is in fact a single-processor appliance. It was a very simple piece of the puzzle I didn’t have. Thanks for the steps I will be sure to keep those close by in case I need them for a real problem.
	Logged IP
	The administrator has disabled public write access.

#59
Chris Cates (User) Posts: 3	Re: Unable to load image ntkrnlpa.exe 07 May 2010 — 21:04 I have been dealing with a similar issue for several weeks now. We need to run a kernel dump (we are using livekd) on a secure Status server that we CANNOT open up to the internet in order to download symbols from Microsoft’s symbols server. We have download the symbols to an identical Stratus server and ran the livekd kernel dump successfully…even moving the symbols directory/path around at will. However, moving the downloaded symbols to another Stratus server (I just keep mentioning Stratus so you guys know I’m talking about identical servers), has a negative result. Even though the command is looking in the correct directory and the symbol is in the directory, the dump still fails. Here’s a log file example: DBGHELP: new session: Fri May 07 12:17:47 2010 DBGHELP: _NT_SYMBOL_PATH: E:WindowsKernelDumpSymbols DBGHELP: Symbol Search Path: .;E:CtsEftFilesPostilionWindowsKernelDumpSymbols DBGHELP: .ntkrpamp.pdb — file not found DBGHELP: .exentkrpamp.pdb — file not found DBGHELP: .symbolsexentkrpamp.pdb — file not found DBGHELP: E:WindowsKernelDumpSymbolsntkrpamp.pdb78B6BD304838400DB0B6EE67B2DB48AF1ntkrpamp.pdb — mismatched pdb DBGHELP: ntkrpamp.pdb — file not found DBGHELP: Couldn’t load mismatched pdb for ntkrnlpa.exe DBGHELP: ntkrnlpa — export symbols We’ve tried renaming the sub-directory to match the hex string you see above with no success. We believe that Microsoft has configured their symbol downloads to have a unique signature per server (keying off MAC number?). Does anyone know if this is the case or have they had any success downloading symbols on one server and using them on another? Thanks for any help.
	Logged IP
	The administrator has disabled public write access.

#60
Robert Kuster (Visitor) Moderator Posts: 39	Re: Unable to load image ntkrnlpa.exe 08 May 2010 — 12:31 Chris, welcome. We believe that Microsoft has configured their symbol downloads to have a unique signature per server (keying off MAC number?). Nope. The linker puts a signature (a GUID) into both the executable and the associated PDB as it creates them. This PDB is valid for this one executable wherever installed. You mention that one of your computers is on the Internet and the other isn’t. Is it possible that a service pack or KB update installed a new «ntkrnlpa.exe» on one of your computers but not on the other? Is it really the same «ntkrnlpa.exe» on both machines if you compare them with a hex-editor for example? We need to run a kernel dump (we are using livekd) on a secure Status server that we CANNOT open up to the internet in order to download symbols from Microsoft’s symbols server. Hm, do you want to create a dump or do you need live kernel-debugging? For if you just need a DUMP you don’t need any symbols. You simply create a DUMP which you then investigate with WinDbg on any other computer which has an Internet connection so WinDbg will obtain the correct symbols from the Microsoft server. If you on the other side want to do live kernel-debugging: Is it an option to attach WinDbg to your target computer in question, say via Firewire? In this case you only require an Internet connection for your host computer — the one which runs WinDbg (to obtain the symbols). You target computer being debugged doesn’t need to be online. I hope this helps, Robert
	Thinking debugging? Think www.windbg.info.
	Logged IP
	The administrator has disabled public write access.

#61
Chris Cates (User) Posts: 3	Re: Unable to load image ntkrnlpa.exe 11 May 2010 — 20:08 Thank you for the reply Robert. I actually found out that the two servers actually had different hardware even though the kernel was the same..stupid oversight on my part. We were able to download the symbols on the ‘open’ server and test them on a test ‘secure’ server successfully. We now need to find out if there will be a descrepancy between Windows Server 2003 R2 sp2 and Windows Server 2003 sp2…. ….I’ll keep you updated. Thanks again! -Chris
	Logged IP
	The administrator has disabled public write access.

#65
Robert Kuster (Visitor) Moderator Posts: 39	Re: Unable to load image ntkrnlpa.exe 28 May 2010 — 15:59 Chris, you are welcome. I hope you applied correct symbols to all your environments in the meantime. I didn’t try it but I guess you ended up with two different symbol sets for Windows Server 2003 and 2003 R2 respectively… Warm Regards, Robert
	Thinking debugging? Think www.windbg.info.
	Logged IP
	The administrator has disabled public write access.

#69
Chris Cates (User) Posts: 3	Re: Unable to load image ntkrnlpa.exe 01 Jun 2010 — 21:49 There does NOT appear to be a descrepancy for the ‘R2’ variant. We were able to sucessfully download symbols from Microsoft Symbols Server on server A and import/utilize them on server B. The symbols folder name was ‘ntkrpamp.pdb’. There appears to be a dependency on hardware configuration outside of two servers having matching kernels. I found this interesting, but very logical. Thanks again for your help and letting me bounce this off of here. Kind Regards, Chris
	Logged IP
	The administrator has disabled public write access.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:UsersOneDesktopMinidump42912-20202-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Windows 7 Kernel Version 7600 MP (6 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 7600.16385.amd64fre.win7_rtm.090713-1255

Machine Name:

Kernel base = 0xfffff800`0324e000 PsLoadedModuleList = 0xfffff800`0348be50

Debug session time: Sun Apr 29 20:12:35.842 2012 (UTC + 4:00)

System Uptime: 0 days 6:09:40.216

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Loading Kernel Symbols

………………………………………..Unable to load image Unknown_Module_00000000`00000000, Win32 error 0n2

*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000

Unable to add module at 00000000`00000000

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41287, a00000018, 0, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

Probably caused by : ntoskrnl.exe ( nt+7fa3a )

Followup: MachineOwner

———[/spoiler]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:UsersOneDesktopMinidump43012-20358-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image SystemRootsystem32ntoskrnl.exe, Win32 error 0n2

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Windows 7 Kernel Version 7600 MP (6 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 7600.16385.amd64fre.win7_rtm.090713-1255

Machine Name:

Kernel base = 0xfffff800`03264000 PsLoadedModuleList = 0xfffff800`034a1e50

Debug session time: Mon Apr 30 05:55:12.393 2012 (UTC + 4:00)

System Uptime: 0 days 0:22:15.767

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image SystemRootsystem32ntoskrnl.exe, Win32 error 0n2

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Loading Kernel Symbols

………………………………………………………

……………………………………………………….

……………….

Loading User Symbols

Loading unloaded module list

….

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff96000164b88, fffff8800a2df140, 0}

Unable to load image SystemRootSystem32win32k.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for win32k.sys

*** ERROR: Module load completed but symbols could not be loaded for win32k.sys

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

Probably caused by : win32k.sys ( win32k+c4b88 )

Followup: MachineOwner

———

Во время работы или при включении компьютера внезапно может появиться так называемый «синий экран смерти». Если вчитаться в текст, написанный поверх, то там будет указана причина сбоя – некорректная работа файла Ntoskrnl.exe. Этот элемент очень важен для функционирования ОС, и когда с ним что-то происходит, пользоваться ПК становится невозможно.

Что такое Ntoskrnl.exe

Когда вы включаете компьютер, запускается целый ряд служб, в том числе, Ntoskrnl.exe, который подготавливает к работе драйверы и визуализирует изображение на экране. При этом может произойти ошибка, что влечет за собой остановку процесса. Данная служба обычно располагается на диске «С» вместе с другими компонентами системы и занимает несколько папок: System32, Driver Cache и т. п.

Причины неисправности

Ошибка ntoskrnl.ехе может возникать по целому ряду причин:

1. Некорректный оверклокинг и андервольтинг, приведший к перегреву.
2. Физическое удаление файла (вообще-то это достаточно трудно сделать, но возможно, если использовать ПО, влияющее на системные элементы).
3. Повреждение/замена файла вирусом.
4. Повреждение записей в реестре.
5. Наличие проблемных или старых драйверов.
6. Внутренний системный сбой.
7. Сбой в работе винчестера.
8. ОС не обновлена до актуальной версии.
9. Повреждение или сбой в работе ОЗУ.

Возможные решения

Ошибка ntoskrnl.exe – это серьёзно, но не всегда фатально, и сейчас мы расскажем, как её исправить.

1. Для начала нужно добраться до «Десктопа» и получить доступ к функциям ПК, так как, синий экран закрывает собой все пространство.
2. Для этого выполните перезагрузку, и нажимайте клавишу F2 или Del (иногда бывают и другие варианты, это зависит от внутренней структуры системы ввода-вывода).
3. Перед вами развернутся опции БСВВ.
4. Выберите пункт Load setup defaults («Загрузить настройки по умолчанию»).
   
5. Кликните по F10, чтобы подтвердить выбор.
6. Снова перезапустите ПК – синий экран исчезнет, и можно будет переходить к исправлению ошибки.

Очистка реестра

Пока не вернулась ошибка ntoskrnl.exe с синим экраном (кстати, чаще всего она возникает на windows 7), нужно начать действовать. Первым делом попробуйте почистить реестр от неправильно выполненных и устаревших записей. Удобнее и безопаснее всего делать это с помощью специальных утилит, например, небезызвестной CCleaner.

1. Скачайте программу и установите её.
2. Откройте окно и слева в списке найдите главу «Очистка реестра».
3. Нажмите «Анализ» и дождитесь обнаружения всех проблемных записей.
   
4. Вверху укажите «Выделить все» и «Исправить выделенное».
   
5. Программа предложит сделать копию реестра – соглашайтесь, только сохраняйте ее не в «Документы» на диске «С», как указано по умолчанию, а в отдельную папку на диске «D».
   
6. После очистки запустите «Анализ» ещё раз – и так до тех пор, пока список повреждённых элементов не останется пустым.

Исправление диска

Далее нужно проверить системный диск и исправить кое-какие ошибки, если они будут обнаружены. Для этого:

1. Найдите значок «Компьютер» и разверните содержимое.
2. Дважды щелкните ПКМ по диску «С» (у вас он может называться как-нибудь еще – главное, помните, что нам нужен раздел, где хранится ОС);
   
3. Выберите последний пункт «Свойства», а затем подпункт «Сервис» и запустите проверку.
   
4. Компьютер может несколько раз перезагрузиться в процессе – это нормально, не волнуйтесь.

Для этих же целей проверяем внутренние системные файлы и исправляем неполадки следующим образом:

1. Нажмите Win+R и дождитесь появления небольшого окошка со строкой ввода.
2. Впишите в нее «cmd».
   
3. Теперь появится окно с черным полем, куда нужно ввести: «sfc/scannow» и нажать «Интер».
   
4. Также можно задать команду «chkdsk».
   

Подождите, пока не появится сообщение об успешном выполнении операции, а потом перезагрузите ПК.

Проверка на вирусы

Нередко причиной остановки запуска Windows бывают вирусы, которые удаляют файл Ntoskrnl.exe из корневой папки Winnt_rootSystem32. Не сбрасывайте со счетов такую возможность и обязательно проверьте систему:

1. Установите какой-нибудь хороший антивирус: Касперского, «Доктор веб», «Эсет» и т. п.
2. Запустите полную проверку всех дисков.
   
3. Дождитесь окончания процедуры (это может занять много времени, можно оставить на ночь).
4. Удалите все вредоносные файлы или переместите в карантин – лучше поступить так, как рекомендует антивирус.
   
5. Проверьте файловую систему на ошибки и восстановите все поврежденное, как это было описано выше.

Если вирус занесен какой-то программой, ее необходимо деинсталлировать. Скорее всего, добровольно удаляться она не захочет – тогда вам поможет деинсталлятор (например, Uninstall Tool) и опция «принудительное удаление».

Обновление ОС и драйверов

Иногда проблемы с ntoskrnl.exe и синий экран возникают из-за того, что система давно не обновлялась: в Windows 10 сложно отключить автоматическую установку пакетов, но в седьмой версии такое часто происходит – просто зайдите в Update Center и запустите обновления, а для драйверов оборудования скачайте их отдельно (только обращайте внимание на разрядность: x64 или х86 для 64-bit систем).  Удалите все драйвера старого, не используемого оборудования: принтеров, графических планшетов, сканеров, МФУ и т.п. («Панель управления» — «Диспетчер устройств» — клик правой кнопкой по устаревшему устройству – команда «Удалить»).

Восстановление системы

И, наконец, если все предыдущие шаги не увенчались успехом, можно восстановить систему до того состояния, когда все нормально работало. Чтобы сделать это, нужно:

1. На Windows 7 последовательно открываем: «Пуск» – «Все программы» – «Стандартные» – «Служебные» – «Восстановление системы», на Windows 10 в «Поиск» наберите «Создание точки восстановления» и откройте соответствующий значок.
   
2. Нажмите «Далее» в появившемся окне и выбираем «Показать точки восстановления».
3. Выберите дату, когда компьютер стабильно работал.
   
4. Нажмите «Готово».

Дождитесь окончания процесса – ни в коем случае не выключайте компьютер из сети и позаботьтесь о том, чтоб у ноутбука не села батарея.