BSOD - Unable to verify timestamp for ntoskrnl.exe

Question

Recently, my Dell desktop has been randomly crashing when left running for an extended period of time. The following information was written to the dump file:

Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
WARNING: Unable to verify timestamp for ntoskrnl.exe
ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff80001e5c000 PsLoadedModuleList = 0xfffff8000201edb0
Debug session time: Mon Aug 31 19:33:29.995 2009 (GMT-7)
System Uptime: 0 days 11:59:15.563

Has anyone experienced this issue with the ntoskrnl.exe causing Windows Vista to crash? I am running Windows Vista 64-bit home premium

Update

This behavior starting occurring last week after the latest set of Windows Vista updates were automatically installed on my computer (KB973879, KB973874, KB970653 and KB972036). I also uninstalled and old version of McFee Security Center and installed AVS Anti-Virus Free Editon 8.5.

Also, the BSOD would also occur when I disconnected my iPhone from my computer.

@Wil - Is there a suggested tool for determining if I have a roolkit installed on my workstation.

Update 2

Here are the crash codes from my latest BSOD. Also, I had to reinstall my drivers for my Belkin G Wireless USB Network Adapter and it cleared my cookies cache from IE8.

BCCode: 1000007e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF800021D3B81
BCP3: FFFFFA60017B4798
BCP4: FFFFFA60017B4170

Update 3

@Wil - I tried running Rootkit Revealer and it wrote the following application error to the event log:

Faulting application RootkitRevealer.exe, version 1.71.0.0, time stamp 0x44e255aa, faulting module RootkitRevealer.exe, version 1.71.0.0, time stamp 0x44e255aa, exception code 0xc0000005, fault offset 0x000040cd, process id 0x11b0, application start time 0x01ca2ab8f0adc004.

Answer 1

It seems others have had the same problem, specifically after Windows updates as well. It sounds like a lower level problem and searching has yielded a few possible solutions:

• replace ntoskrnl.exe from your Windows DVD.
• Run a chkdsk on your drive
• Run a Memtest

Personally, rather than doing process of elimination and wasting time, Id prefer to do a fresh install of Windows (after backing up all of your files of course).

Answer 2

This indicates that the debugger (presumably WinDbg) can't load ntoskrnl.exe. While it is certainly possible that some malicious program has replaced your ntoskrnl.exe as Wil suggested, a more likely explanation is that you don't have WinDbg configured to download symbols from Microsoft's public symbol server.

Try running the .symfix and !sym noisy commands and then try running !analyze -v again. If that doesn't help, please post all of the relevant debugger output (with !sym noisy turned on). (Posting the actual minidump could also help.) For example, some of the output you omitted includes the symbol path:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\temp\oops.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Unable to load image \SystemRoot\system32\ntoskrnl.chk, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.chk
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.chk
Windows Server 2008/Windows Vista Kernel Version 6002 MP (2 procs) Checked x64

If your symbol path is set up correctly, memory corruption due to bad hardware would be another possible non-malware explanation. Try running MemTest86+ for a few hours.

Regarding the bug check code info: bug check 0x1000007e is SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M. The associated exception is 0xC0000005, STATUS_ACCESS_VIOLATION. The other three parameters don't offer much insight without further examination in the debugger. This could be due to a driver bug, overclocking, faulty memory, a corrupted/replaced file on disk, a failed attempt at exploiting a buffer overflow in a system service, a cosmic ray striking one of your PC's RAM chips, etc.

Answer 3

Not sure if this helps you and I am no expert but I just had this problem . i sent the report in and microsoft popped up a page that gave answers to this problem . they said it was most likely a hard drive error , windows could not read from the drive and gave a few reasons why . One reason was that I had just transfered a large file to my drive from external media or drive . I had just transfered my win cd to my hd . sorry but I forgot what the other reasons were but they too were just simple things . They said to run chkdsk .

Answer 4

• Have you recently installed any software?
• What is the blue screen stop code?
• Have you tried system restore back to before it was failing?
• Have you tried Windows System Recovery?

I agree with Wil that you should take precautions.

Answer 5

Yes.

This is not a random error and is usually a indecation of something very serious.

It is usually caused by either serious malware (such as rootkit), bad Anti Virus that can currupt the Kernel, or some "hacks" that people sue to edit system files.

Anyway, it is very serious.

You could go to the recovery console / command prompt from the Vista cd, and replace this files over the top as it is not unique to one installation.

You could copy it from someone else's machine as long as it is same service pack level - not 100% sure if general update level affects it, then copy it to the same place and you should be able to boot.

That being said, Personally, I would just get my important files off the system and reinstall from scratch. Again, This error does not appear at random and is generally caused by very serious other problems, so even if you fix it, there may be other surprises in your system that reveal themselves at a later date.

Edit -- For rootkits, there is no real definitive answer, hence my suggestion to reinstall from scratch. Microsoft / Sysinternals make the "Rootkit Revealer", which is a tool for identifying, however it does not really remove them. I suggest you read the product page, as it explains a lot about rootkits.