BSOD ntkrnlpa.exe in windows 7 RRS feed

  • Question

  • Sorry if this is a repeat. I looked hard all over the internet for a solution but none seemed to match my problem. I have attached the minidump. This seems to happen as users browse to a network drive to look at pictures. I don't know what would be wrong. It wouldn't let my post links so you will have to put https:// in front of these.




    Wednesday, October 3, 2012 3:15 PM


  • Hi,

    You may go to C:\windows\winsxs\ folder and search “ntkrnlpa”.  You will get some results. Please try to copy this file into C:\Windows\system32\ folder.

    Please note, you may need to test the search results one by one.

    Kim Zhou

    TechNet Community Support

    • Marked as answer by Kim Zhou Tuesday, October 9, 2012 8:44 AM
    Friday, October 5, 2012 12:06 PM

All replies

  • Do you have System Mechanic Pro installed? If so remove it and see if that helps.
    Wednesday, October 3, 2012 9:23 PM
  • No, We do not have that installed. Thanks for your reply.
    Thursday, October 4, 2012 2:46 AM
  • What is your computer make and model? If not a branded computer what is your motherboard make and model?

    Please download and run Driver View and upload a copy of the report it produces to your Sky Drive.


    Type System Information in the Search Box above the start Button and press the ENTER key. Select File, Export and give the file a name noting where it is located. Please upload to your Sky Drive, share and post a link here.

    Run the Windows 7 Memory diagnostic Tool

    Hope this helps, Gerry

    Thursday, October 4, 2012 8:05 AM
  • They are Dell Vostro 330's. It is a previous model of their all in one machines. I will download that and get back to you.

    Thursday, October 4, 2012 7:55 PM
  • Hi,

    You may go to C:\windows\winsxs\ folder and search “ntkrnlpa”.  You will get some results. Please try to copy this file into C:\Windows\system32\ folder.

    Please note, you may need to test the search results one by one.

    Kim Zhou

    TechNet Community Support

    • Marked as answer by Kim Zhou Tuesday, October 9, 2012 8:44 AM
    Friday, October 5, 2012 12:06 PM
  • I believe I am experiencing the same problem as the original poster (dflansy).  Here is a SkyDrive folder with my most recent mini dumps: Mini Dump Files

    Note that all DMP files except one identify ntkrnlpa.exe as the culprit.

    In the current discussion, I got up to Kim Zhou's direction, "You may go to C:\windows\winsxs\ folder and search “ntkrnlpa”.  You will get some results. Please try to copy this file into C:\Windows\system32\ folder."

    I did the search and found 33 files with that name with varying files sizes (i.e., 3880 KB, 3879, 3876, 3875, 3874, 3872, 3866, 3865, and 3863).  The file dates range from 7/13/2009 (3863 KB) to 4/1/2012 (3866 KB).  Which file should I use to overwrite the ntkrnlpa file already in the C:\Windows\system32\ folder, which is 3876 KB (3/30/2012)?

    Also, is the purpose of this instruction to overwrite a possible corrupt ntkrnlpa file with a possible good file?

    Thank you for having this discussion!  I'm learning a heck of a lot about how to debug my computer with this experience.

    Sunday, October 7, 2012 6:12 PM
  • Hi,

    Please understand that the version number will be different in everyone’s system. Generally, we use the older version to replace the ntkrnlpa file which under C:\windows\winsxs\ folder.

    In addition, we can copy this file from the another worked PC.

    Kim Zhou

    TechNet Community Support

    • Edited by Kim Zhou Monday, October 8, 2012 3:30 AM
    Monday, October 8, 2012 3:29 AM
  • Thank you Kim.  I replaced my ntkrnlpa.exe file as you suggested.  Since I was experiencing a BSOD at least every 2-3 days, I'll wait a week and report back.

    For anyone that's interested in how to overwrite files in the System32 folder, I found this URL helpful:  http://www.tech-recipes.com/rx/7168/how-to-overwrite-system-files-in-windows-7/

    Mark @ Ape Software

    Monday, October 8, 2012 4:17 PM
  • I looked at the latest dump for TQM Doctor, a couple of things to try,

    Check the hardware for issues,


    If no issues with the RAM, enable verifier and we should look at verifier enabled dumps.


    More info about 0x1A:


    0: kd> !analyze -v
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

        # Any other values for parameter 1 must be individually examined.
    Arg1: 00041790, The subtype of the bugcheck.
    Arg2: c0802070
    Arg3: 0000ffff
    Arg4: 00000000

    Debugging Details:

    BUGCHECK_STR:  0x1a_41790



    PROCESS_NAME:  rundll32.exe


    LAST_CONTROL_TRANSFER:  from 83cb628c to 83cb5cba

    a1f5bba8 83cb628c 02920002 02d03fff 8bf93030 nt!MiDeleteVirtualAddresses+0x41a
    a1f5bc78 83cb5f41 8bf93030 8bd8e9c8 868d9c80 nt!MiRemoveMappedView+0x325
    a1f5bca0 83e5d417 868d9c80 00000000 ffffffff nt!MiRemoveVadAndView+0xe5
    a1f5bd04 83e7b8af 8bf93030 02920000 00000000 nt!MiUnmapViewOfSection+0x265
    a1f5bd24 83c5427a ffffffff 02920000 001cd680 nt!NtUnmapViewOfSection+0x55
    a1f5bd24 77697094 ffffffff 02920000 001cd680 nt!KiFastCallEntry+0x12a
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    001cd680 00000000 00000000 00000000 00000000 0x77697094


    83cb5cba cc              int     3


    SYMBOL_NAME:  nt!MiDeleteVirtualAddresses+41a

    FOLLOWUP_NAME:  MachineOwner



    IMAGE_NAME:  memory_corruption

    FAILURE_BUCKET_ID:  0x1a_41790_nt!MiDeleteVirtualAddresses+41a

    BUCKET_ID:  0x1a_41790_nt!MiDeleteVirtualAddresses+41a

    Followup: MachineOwner

    Monday, October 8, 2012 7:22 PM
  • Hi Kim,

    Sorry Kim but your idea did not work.  I experienced another crash yesterday with a very similar minidump (if not same).  Thank you anyway!  :-)

    I am trying Mike's solutions right now.

    Mark @ Ape Software

    Tuesday, October 9, 2012 2:20 PM
  • Hi Mike,

    Thank you so much for all the helpful blogs!

    I experienced another crash last night and added it to my MiniDump Files in a SkyDrive Folder.  Unfortunately, this means that Kim's suggestion did not work for me.

    In following your directions, I performed an extended memory test last night with no issues found.  This morning I setup my Windows Driver Verifier as you suggested and am now waiting for the next crash.  If I read your blog posts correctly, I will receive some extended driver information during the next crash.  Good idea!

    Also, in reading your blog post on 0x1A BSOD errors, I did recently have the McAfee Total Protection product installed but uninstalled it because it was a massive memory hog and am now using MS Security Essentials, which is soooo much lighter.  The crashes I am experiencing did begin several months ago while I still had McAfee installed.

    Mark @ Ape Software

    Tuesday, October 9, 2012 2:32 PM
  • I haven't had time to try anything yet. I will soon and get back to everyone.

    Tuesday, October 9, 2012 8:16 PM
  • I think I'm going to "GIVE" on this one and say that MS and/or Dell kicked my butt this time.

    I wasn't able to make any of the suggestions work (although great troubleshooting direction from Mike).  If anyone reads this far down, you really need to check out Mike's blogs.

    Since it looked like memory management was the ultimate culprit, even though the memory checked good and I could find no external device errors, I decided to ditch my 3-year-old computer (Win 7 x32) and move into a new Win 7 x64.  This gives me more usable RAM and a quad core processor that can do mucho mas at one time.  So far it's working very well.

    It's funny too because my old computer was nearly $4K top of the line and this new computer was a Costco off-the-shelf $650 with lower specified CPU speed.  Looks like those quads in an i7 make a difference!

    Thursday, October 25, 2012 3:44 PM