Cześć
Ostatnio pojawił mi się blue screen.
Według debugera problem jest z plikiem ntoskrnl.exe.
Szukałem o tym w necie i znalazłem, że trzeba wpisać w konsoli odzyskiwania
expand X:\i386\ntoskrnl.ex_ C:Windows\system32\ntoskrnl.exe
X-dysk
Wpisałem to w konsoli i pojawiło mi się:
Nie można utworzyć pliku ntoskrnl.exe
zdekompresowano 0 plików
Co mam robić? ;/
ntoskrnl.exe przy okazji bluescreenów zwykle wskazuje na problemy ze sprzętem, a nie z Windows.
Analiza bluescreenów: blue-screen-windows-bit-t491491.html#p3095248 i minidumpów wylacza-sie-komputer-t477584.html?hilit=minidump Polecam Ci lekturę tych tematów jako pomoc w znalezieniu przyczyny pojawiania się bluescreenów.
Podobny problem: blue-screen-kilka-minut-t496144.html
Ale jeżeli upierasz się na podmianę ntoskrnl.exe, to proszę bardzo:
Możesz podmienić plik ntoskrnl.exe na oryginalny z płyty instalacyjnej systemu. W tym celu uruchom Konsolę Odzyskiwania i wydaj następujące polecenia:
CD C:Windows\system32
ren ntoskrnl.exe ntoskrnl.old
expand X:\i386\ntoskrnl.ex_ C:\Windows\system32\ntoskrnl.exe
exit
Gdyby po wydaniu komendy:
expand X:\i386\ntoskrnl.ex_ C:\Windows\system32\ntoskrnl.exe
pokazał się jakiś błąd, to spróbuj zastąpić ją tą:
expand X:\i386\ntoskrnl.ex_ C:\Windows\system32
W miejscu X podstawiasz literę napędu, z którego uruchamiasz konsolę odzyskiwania.
Jaki w ogóle masz system?
Pozdrawiam.
System xp.
Mowiąc problemy ze sprzętem masz coś konkretnego na myśli? 
Czego to może być wina?
wrzuc plik minidump a postaramy sie pomóc
Minidumpy:
Microsoft ® Windows Debugger Version 6.11.0001.402 X86
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Wed Aug 8 22:50:03.895 2012 (GMT+2)
System Uptime: 0 days 0:31:22.011
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
…
…
Loading User Symbols
Loading unloaded module list
…
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C000021A, {e117f188, c0000005, 7c9106c3, 113f36c}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : ntoskrnl.exe ( nt+5c336 )
Followup: MachineOwner
Microsoft ® Windows Debugger Version 6.11.0001.402 X86
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Jul 31 12:26:00.375 2012 (GMT+2)
System Uptime: 0 days 1:50:01.923
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
…
…
Loading User Symbols
Loading unloaded module list
…
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C000021A, {e1da1eb0, c0000005, 7c9106c3, 57f36c}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : ntoskrnl.exe ( nt+5c336 )
Followup: MachineOwner