Solved

Windows 8 ntoskrnl.exe is corrupt

Posted on 2014-03-26
7
3,040 Views
Last Modified: 2014-05-07
Hi Guys

One of my clients called today, her Windows 8 machine keeps booting in to repair mode. I talked her through on how to look at the repair log (c:\Windows\System32\LogFiles\Srt\SrtTrail.txt). The message was "C:\Windows\System32\ntoskrnl.exe" is corrupt.

I'm wondering if anyone knows how I can tackle this problem? I don't think she has Windows 8 OS media, however I have one for my machine.

Thanks in advance.
0
Comment
Question by:Ergs
  • 3
  • 3
7 Comments
 
LVL 20

Expert Comment

by:Lazarus
ID: 39958233
As per MS on Windows 8 NTOSKERNEL:

Method 1: Run a system file checker scan and check if that helps.
 
Refer the following steps to run SFC scan:
 
a) Move the mouse pointer to bottom left of the screen where you see preview of start menu and Right-click to bring up a list of Windows settings.
b) Click on ‘Command Prompt (Admin) to bring up elevated command prompt. Note: Click ‘Yes’ if it prompts for permission.
c) In the command prompt type in the following command: ‘sfc /scannow’.
 
Note: It may ask for windows installation DVD to fix and to enable SFC to make more than minor repairs. Some files saved on your computer might get deleted when fixing corrupted files.
 
Method 2: Let us check if there are any errors on the Hard disk.
 
Please refer to the section "To repair a drive to perform check disk".
 
Improve performance by optimizing your hard drive
 
http://windows.microsoft.com/en-US/windows-8/improve-performance-optimizing-hard-drive
 
Important Note: While performing chkdsk on the hard drive if any bad sectors are found on the hard drive when chkdsk tries to repair that sector if any data available on that might be lost.
 
Hope the information helps to fix the blue screen issue. If the issue persists, or for any Windows related queries, feel free to post. We will be glad to assist you.
0
 

Author Comment

by:Ergs
ID: 39958293
Sushil Sonawane - these are links for XP, not Windows 8
0
 

Author Comment

by:Ergs
ID: 39958295
lazarus98 - You say to "Move the mouse pointer to bottom left of the screen...." where do I do this? remember the system does not boot
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 20

Accepted Solution

by:
Lazarus earned 500 total points
ID: 39958825
OPTION ONE  
To Run the SFC /SCANNOW Command at Boot

1. Open a command prompt at boot.

2. In the command prompt, type diskpart and press Enter, then type list volume and press Enter.

3. Make note of the drive letters for your boot drive (ex: 350MB "System Reserved" partition) and Windows 8 drive, then type Exit and press Enter. (see screenshot above)
NOTE: If you do not have a "System Reserved" partition, and are not multi-booting with another operating system, then the boot drive and Windows 8 drive may be the same drive letter.

4. In the command prompt, type the command below and press Enter.
NOTE: You will see a blinking cursor at the prompt until finished. This will take a while to finish running though.


sfc /scannow /offbootdir=C:\ /offwindir=D:\windows

Note
You will need to substitute the drive letter of the partition/volume where your system boot files are stored in the offbootdir=C: part of the command above instead.

You will need to substitute the drive letter of your Windows 8 partition/volume in the offwindir=D: part of the command above instead.


5. When the scan is complete, hopefully you will see an all is ok message like below.

6. Close the command prompt, and restart the computer to start Windows 8.

Note
If SFC could not fix something, then run the command again to see if it may be able to the next time. Sometimes it may take running the sfc /scannow command 3 times restarting the PC after each time to completely fix everything that it's able to.

If not, then run the Dism /Online /Cleanup-Image /RestoreHealth command to repair any component store corruption, restart the PC afterwards, and try the sfc /scannow command again.

If still not, then you could do a refresh of Windows 8, or run a System Restore using a restore point dated before the bad system file occured to fix it. You may need to repeat doing a System Restore until you find a older restore point that may work.

If still not, then you can use the steps in the TIP box in the OPTION THREE section below to manually replace the files that SFC could not fix.



OPTION TWO  
To Run the SFC /SCANNOW Command in Windows 8

1. Open an elevated command prompt in Windows 8.

2. In the elevated command prompt, type sfc /scannow and press Enter.
NOTE: This may take a while to finish running.

3. When the scan is complete, hopefully you will see an all is ok message.

Note
If SFC could not fix something, then run the command again to see if it may be able to the next time. Sometimes it may take running the sfc /scannow command 3 times restarting the PC after each time to completely fix everything that it's able to.

If not, then run the Dism /Online /Cleanup-Image /RestoreHealth command to repair any component store corruption, restart the PC afterwards, and try the sfc /scannow command again.

If still not, then try using OPTION ONE above to run the sfc /scannow command at boot

If still not, then you could do a refresh of Windows 8, or run a System Restore using a restore point dated before the bad file occured to fix it. You may need to repeat doing a System Restore until you find a older restore point that may work.

If still not, then you can use the steps in the TIP box in the OPTION THREE section below to manually replace the files that SFC could not fix.


OPTION THREE  
How to See and Read Only the "SFC" Scan Results from the CBS.LOG

NOTE: When SFC runs, it logs it's actions into the C:\Windows\Logs\CBS\CBS.log. The steps in this option will show you how to see only the specific SFC entries with the [SR] tags in this CBS.log. This can be helpful to show you what files SFC could not fix automatically if you wanted to try and manually replace them.


1. Open an elevated command prompt in Windows 8.

2. In the elevated command prompt, copy and paste the command below and press Enter.
NOTE: This will place a sfcdetails.txt file on your desktop with only the SFC scan result details from the CBS.LOG in it.
Code:
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >%userprofile%\Desktop\sfcdetails.txt

3. Close the elevated command prompt.

4. Open the sfcdetails.txt file on your desktop to see the SFC scan details in the CBS.LOG.

5. When finished, you can safely delete the sfcdetails.txt file afterwards if you like.

If you have to many files that are corrupted, then run the Dism /Online /Cleanup-Image /RestoreHealth command to repair any component store corruption, restart the PC afterwards, and try the sfc /scannow command again.

If you only have a few, then you could manually extract a new copy directly from your Windows 8 installation DVD or USB thumb drive, or ISO file if in a virtual machine.

Tip
In Windows 8/8.1 and Windows Server 2012, this has changed. It’s called Inbox Corruption Repair and it brings the functionality of CheckSUR into Windows rather than requiring a separate download to get the utility like you do now. This is exposed in two ways, the first is really unseen by the end user and happens when Windows detects a corrupted state when attempting to install fixes via Windows Update. When this happens, Windows fix the corruption silently and then re-install the prior packages. The manual way to use this tool is via DISM (Deployment Imaging and Servicing Management). The way this is exposed is via the DISM /Cleanup-Image functionality.

If a Windows image (Windows component store) becomes unserviceable, you can use the Deployment Imaging and Servicing Management (DISM) tool to update the files and correct the problem.

For example:

To use to fix Windows component store corruption when a SFC /SCANNOW command is unable to repair corrupted system files because the store (source) is corrupted, then run the SFC command again.
To use to fix Windows component store corruption when the same Windows Updates continue to appear to be available to install even though they already show successfully installed in update history.
0
 

Author Comment

by:Ergs
ID: 39960547
I am at the job now and trying the sfc command and getting the following error:
"Windows resource protection could not perform the requsted operation"

note: results for list "list volume"
Volume 0   I                            DVD-ROM
Volume 1   C   Windows        NTFS
Volume 2   D   Data                NTFS
Volume 3   J    Windows RE    NTFS
Volume 4        SYSTEM            FAT32 (has no drive letter)
Volume 5        Recovery im    NTFS (has no drive letter)

Command I tried:
sfc /scannow /offbootdir=J:\ /offwindir=c:\windows
0
 
LVL 20

Assisted Solution

by:Lazarus
Lazarus earned 500 total points
ID: 39961661
Windows Resource Protection could not perform the requested operation.

To resolve this problem, perform the System File Checker scan in safe mode, and make sure that the PendingDeletes and PendingRenames folders exist under %WinDir%\WinSxS\Temp.
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting. This w…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now