Solved

Windows 8 ntoskrnl.exe is corrupt

Posted on 2014-03-26
7
3,293 Views
Last Modified: 2014-05-07
Hi Guys

One of my clients called today, her Windows 8 machine keeps booting in to repair mode. I talked her through on how to look at the repair log (c:\Windows\System32\LogFiles\Srt\SrtTrail.txt). The message was "C:\Windows\System32\ntoskrnl.exe" is corrupt.

I'm wondering if anyone knows how I can tackle this problem? I don't think she has Windows 8 OS media, however I have one for my machine.

Thanks in advance.
0
Comment
Question by:Ergs
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
7 Comments
 
LVL 20

Expert Comment

by:Lazarus
ID: 39958233
As per MS on Windows 8 NTOSKERNEL:

Method 1: Run a system file checker scan and check if that helps.
 
Refer the following steps to run SFC scan:
 
a) Move the mouse pointer to bottom left of the screen where you see preview of start menu and Right-click to bring up a list of Windows settings.
b) Click on ‘Command Prompt (Admin) to bring up elevated command prompt. Note: Click ‘Yes’ if it prompts for permission.
c) In the command prompt type in the following command: ‘sfc /scannow’.
 
Note: It may ask for windows installation DVD to fix and to enable SFC to make more than minor repairs. Some files saved on your computer might get deleted when fixing corrupted files.
 
Method 2: Let us check if there are any errors on the Hard disk.
 
Please refer to the section "To repair a drive to perform check disk".
 
Improve performance by optimizing your hard drive
 
http://windows.microsoft.com/en-US/windows-8/improve-performance-optimizing-hard-drive
 
Important Note: While performing chkdsk on the hard drive if any bad sectors are found on the hard drive when chkdsk tries to repair that sector if any data available on that might be lost.
 
Hope the information helps to fix the blue screen issue. If the issue persists, or for any Windows related queries, feel free to post. We will be glad to assist you.
0
 

Author Comment

by:Ergs
ID: 39958293
Sushil Sonawane - these are links for XP, not Windows 8
0
 

Author Comment

by:Ergs
ID: 39958295
lazarus98 - You say to "Move the mouse pointer to bottom left of the screen...." where do I do this? remember the system does not boot
0
Building an interactive eFuture classroom

Watch and learn how ATEN provided a total control system solution including seamless switching matrix switch, HDBaseT extenders, PDU, lighting control to build an interactive eFuture classroom.

 
LVL 20

Accepted Solution

by:
Lazarus earned 500 total points
ID: 39958825
OPTION ONE  
To Run the SFC /SCANNOW Command at Boot

1. Open a command prompt at boot.

2. In the command prompt, type diskpart and press Enter, then type list volume and press Enter.

3. Make note of the drive letters for your boot drive (ex: 350MB "System Reserved" partition) and Windows 8 drive, then type Exit and press Enter. (see screenshot above)
NOTE: If you do not have a "System Reserved" partition, and are not multi-booting with another operating system, then the boot drive and Windows 8 drive may be the same drive letter.

4. In the command prompt, type the command below and press Enter.
NOTE: You will see a blinking cursor at the prompt until finished. This will take a while to finish running though.


sfc /scannow /offbootdir=C:\ /offwindir=D:\windows

Note
You will need to substitute the drive letter of the partition/volume where your system boot files are stored in the offbootdir=C: part of the command above instead.

You will need to substitute the drive letter of your Windows 8 partition/volume in the offwindir=D: part of the command above instead.


5. When the scan is complete, hopefully you will see an all is ok message like below.

6. Close the command prompt, and restart the computer to start Windows 8.

Note
If SFC could not fix something, then run the command again to see if it may be able to the next time. Sometimes it may take running the sfc /scannow command 3 times restarting the PC after each time to completely fix everything that it's able to.

If not, then run the Dism /Online /Cleanup-Image /RestoreHealth command to repair any component store corruption, restart the PC afterwards, and try the sfc /scannow command again.

If still not, then you could do a refresh of Windows 8, or run a System Restore using a restore point dated before the bad system file occured to fix it. You may need to repeat doing a System Restore until you find a older restore point that may work.

If still not, then you can use the steps in the TIP box in the OPTION THREE section below to manually replace the files that SFC could not fix.



OPTION TWO  
To Run the SFC /SCANNOW Command in Windows 8

1. Open an elevated command prompt in Windows 8.

2. In the elevated command prompt, type sfc /scannow and press Enter.
NOTE: This may take a while to finish running.

3. When the scan is complete, hopefully you will see an all is ok message.

Note
If SFC could not fix something, then run the command again to see if it may be able to the next time. Sometimes it may take running the sfc /scannow command 3 times restarting the PC after each time to completely fix everything that it's able to.

If not, then run the Dism /Online /Cleanup-Image /RestoreHealth command to repair any component store corruption, restart the PC afterwards, and try the sfc /scannow command again.

If still not, then try using OPTION ONE above to run the sfc /scannow command at boot

If still not, then you could do a refresh of Windows 8, or run a System Restore using a restore point dated before the bad file occured to fix it. You may need to repeat doing a System Restore until you find a older restore point that may work.

If still not, then you can use the steps in the TIP box in the OPTION THREE section below to manually replace the files that SFC could not fix.


OPTION THREE  
How to See and Read Only the "SFC" Scan Results from the CBS.LOG

NOTE: When SFC runs, it logs it's actions into the C:\Windows\Logs\CBS\CBS.log. The steps in this option will show you how to see only the specific SFC entries with the [SR] tags in this CBS.log. This can be helpful to show you what files SFC could not fix automatically if you wanted to try and manually replace them.


1. Open an elevated command prompt in Windows 8.

2. In the elevated command prompt, copy and paste the command below and press Enter.
NOTE: This will place a sfcdetails.txt file on your desktop with only the SFC scan result details from the CBS.LOG in it.
Code:
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >%userprofile%\Desktop\sfcdetails.txt

3. Close the elevated command prompt.

4. Open the sfcdetails.txt file on your desktop to see the SFC scan details in the CBS.LOG.

5. When finished, you can safely delete the sfcdetails.txt file afterwards if you like.

If you have to many files that are corrupted, then run the Dism /Online /Cleanup-Image /RestoreHealth command to repair any component store corruption, restart the PC afterwards, and try the sfc /scannow command again.

If you only have a few, then you could manually extract a new copy directly from your Windows 8 installation DVD or USB thumb drive, or ISO file if in a virtual machine.

Tip
In Windows 8/8.1 and Windows Server 2012, this has changed. It’s called Inbox Corruption Repair and it brings the functionality of CheckSUR into Windows rather than requiring a separate download to get the utility like you do now. This is exposed in two ways, the first is really unseen by the end user and happens when Windows detects a corrupted state when attempting to install fixes via Windows Update. When this happens, Windows fix the corruption silently and then re-install the prior packages. The manual way to use this tool is via DISM (Deployment Imaging and Servicing Management). The way this is exposed is via the DISM /Cleanup-Image functionality.

If a Windows image (Windows component store) becomes unserviceable, you can use the Deployment Imaging and Servicing Management (DISM) tool to update the files and correct the problem.

For example:

To use to fix Windows component store corruption when a SFC /SCANNOW command is unable to repair corrupted system files because the store (source) is corrupted, then run the SFC command again.
To use to fix Windows component store corruption when the same Windows Updates continue to appear to be available to install even though they already show successfully installed in update history.
0
 

Author Comment

by:Ergs
ID: 39960547
I am at the job now and trying the sfc command and getting the following error:
"Windows resource protection could not perform the requsted operation"

note: results for list "list volume"
Volume 0   I                            DVD-ROM
Volume 1   C   Windows        NTFS
Volume 2   D   Data                NTFS
Volume 3   J    Windows RE    NTFS
Volume 4        SYSTEM            FAT32 (has no drive letter)
Volume 5        Recovery im    NTFS (has no drive letter)

Command I tried:
sfc /scannow /offbootdir=J:\ /offwindir=c:\windows
0
 
LVL 20

Assisted Solution

by:Lazarus
Lazarus earned 500 total points
ID: 39961661
Windows Resource Protection could not perform the requested operation.

To resolve this problem, perform the System File Checker scan in safe mode, and make sure that the PendingDeletes and PendingRenames folders exist under %WinDir%\WinSxS\Temp.
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

OfficeMate Freezes on login or does not load after login credentials are input.
In this article, I will show you HOW TO: Perform a Physical to Virtual (P2V) Conversion the easy way from a computer backup (image).
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question