Blue Screen error - WARNING: Unable to verify timestamp for Ntfs.sy

Anonymous
2022-01-25T13:15:11+00:00

Microsoft (R) Windows Debugger Version 10.0.22000.194 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [G:\APA\Minidump\Mini082721-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*

Executable search path is:

Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntkrnlpa.exe

*************************************************************************

*** ***

*** ***

*** Either you specified an unqualified symbol, or your debugger ***

*** doesn't have full symbol information. Unqualified symbol ***

*** resolution is turned off by default. Please either specify a ***

*** fully qualified symbol module!symbolname, or enable resolution ***

*** of unqualified symbols by typing ".symopt- 100". Note that ***

*** enabling unqualified symbol resolution with network symbol ***

*** server shares in the symbol path may cause the debugger to ***

*** appear to hang for long periods of time when an incorrect ***

*** symbol name is typed or the network symbol server is down. ***

*** ***

*** For some commands to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_MMPTE_TRANSITION ***

*** ***

*************************************************************************

Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (8 procs) Free x86 compatible

Product: Server, suite: TerminalServer SingleUserTS

Machine Name:

Kernel base = 0x8201f000 PsLoadedModuleList = 0x82136c70

Debug session time: Fri Aug 27 00:06:19.373 2021 (UTC + 2:00)

System Uptime: 17 days 8:36:32.647

Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntkrnlpa.exe

*************************************************************************

*** ***

*** ***

*** Either you specified an unqualified symbol, or your debugger ***

*** doesn't have full symbol information. Unqualified symbol ***

*** resolution is turned off by default. Please either specify a ***

*** fully qualified symbol module!symbolname, or enable resolution ***

*** of unqualified symbols by typing ".symopt- 100". Note that ***

*** enabling unqualified symbol resolution with network symbol ***

*** server shares in the symbol path may cause the debugger to ***

*** appear to hang for long periods of time when an incorrect ***

*** symbol name is typed or the network symbol server is down. ***

*** ***

*** For some commands to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_MMPTE_TRANSITION ***

*** ***

*************************************************************************

Loading Kernel Symbols

...............................................................

................................................................

................................................................

................

Loading User Symbols

Loading unloaded module list

..............

************* Symbol Loading Error Summary **************

Module name Error

ntkrnlpa The system cannot find the file specified

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.

You should also verify that your symbol search path (.sympath) is correct.

For analysis of this file, run !analyze -v

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

RESOURCE_NOT_OWNED (e3)

A thread tried to release a resource it did not own.

Arguments:

Arg1: 8809c280, Address of resource

Arg2: 888c0748, Address of thread

Arg3: 886d1160, Address of owner table if there is one

Arg4: 00000003

Debugging Details:


*** WARNING: Unable to verify timestamp for Ntfs.sys

*** WARNING: Unable to verify timestamp for vzcore.sys

*** WARNING: Unable to verify timestamp for fltmgr.sys

*** WARNING: Unable to verify timestamp for mfehidk.sys

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

Windows for home | Previous Windows versions | Performance and system failures

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Anonymous
    2022-01-25T15:52:15+00:00

    Hi Mina Ezzat AZIZ :

    What is your computer make and model, and do you know if your Vista SP2 OS is patched to the end of support on 11-Apr-2017? Am I correct that you're trying to analyze a mini-dump (e.g.,C:\Windows\minidump.dmp) file saved on your G:\ drive instead of your full dump file (e.g., C:\Windows\memory.dmp) using the Windows Debugger (WinDbg)? See the article Windows Crash Dump Location (memory.dmp file) for more information on the common location of BSOD crash dumps if your C:\ drive is your system boot drive.

    Please see my 07-Jan-2022 post in About the BSOD on Windows Vista for hints on troubleshooting BSODs on Vista computers. The BlueScreenView and/or WhoCrashed utilities that analyze the small mini-dump files might provide some helpful information, but if you'd like your full dump files analyzed with the Windows Debugger (WinDbg) I'd suggest you post in BleepingComputer's free Windows Crashes and Blue Screen of Death (BSOD) Help and Support board and ask one of the trained volunteers there for assistance. Posting guidelines for are pinned <here> at the top of that BleepingComputer board and explain what information you should include in your first post.

    Note that Microsoft deactivated the Windows Update servers on August 3, 2020 for computers with unsupported Window XP and Vista operating systems that do not support SHA-2 code signing - see the Microsoft support article Windows Update SHA-1 Based Endpoints Discontinued for Older Windows Devices for more information. If your Vista OS is patched to 11-Apr-2017 then your Internet Explorer 9 browser should have Update Versions 9.0.60 / KB4014661 (Cumulative Security Update for Internet Explorer 9: April 11, 2017) or later.

    Image

    32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Malwarebytes Premium v3.5.1.2522-1.0.365
    HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, 256 GB WD SATA HDD, NVIDIA GeForce 8400M GS

    0 comments No comments