Uszkodzony plik ntoskrnl.exe


(Hellboy0012) #1

Cześć

Ostatnio pojawił mi się blue screen.

Według debugera problem jest z plikiem ntoskrnl.exe.

Szukałem o tym w necie i znalazłem, że trzeba wpisać w konsoli odzyskiwania

expand X:\i386\ntoskrnl.ex_ C:Windows\system32\ntoskrnl.exe

X-dysk

Wpisałem to w konsoli i pojawiło mi się:

Nie można utworzyć pliku ntoskrnl.exe

zdekompresowano 0 plików

Co mam robić? ;/


#2

Asaver , proszę zapoznaj się z tą stroną oraz tym tematem, a następnie,używając przycisku image.php?album_id=20&image_id=4038


(adam9870) #3

ntoskrnl.exe przy okazji bluescreenów zwykle wskazuje na problemy ze sprzętem, a nie z Windows.

Analiza bluescreenów: blue-screen-windows-bit-t491491.html#p3095248 i minidumpów wylacza-sie-komputer-t477584.html?hilit=minidump Polecam Ci lekturę tych tematów jako pomoc w znalezieniu przyczyny pojawiania się bluescreenów.

Podobny problem: blue-screen-kilka-minut-t496144.html

Ale jeżeli upierasz się na podmianę ntoskrnl.exe, to proszę bardzo:

Możesz podmienić plik ntoskrnl.exe na oryginalny z płyty instalacyjnej systemu. W tym celu uruchom Konsolę Odzyskiwania i wydaj następujące polecenia:

CD C:Windows\system32

ren ntoskrnl.exe ntoskrnl.old

expand X:\i386\ntoskrnl.ex_ C:\Windows\system32\ntoskrnl.exe

exit

Gdyby po wydaniu komendy:

expand X:\i386\ntoskrnl.ex_ C:\Windows\system32\ntoskrnl.exe

pokazał się jakiś błąd, to spróbuj zastąpić ją tą:

expand X:\i386\ntoskrnl.ex_ C:\Windows\system32

W miejscu X podstawiasz literę napędu, z którego uruchamiasz konsolę odzyskiwania.

Jaki w ogóle masz system?

Pozdrawiam.


(Hellboy0012) #4

System xp.

Mowiąc problemy ze sprzętem masz coś konkretnego na myśli? :wink:

Czego to może być wina?


(Pawko86) #5

wrzuc plik minidump a postaramy sie pomóc


(Hellboy0012) #6

Minidumpy:

1.

Microsoft ® Windows Debugger Version 6.11.0001.402 X86

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Machine Name:

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420

Debug session time: Wed Aug 8 22:50:03.895 2012 (GMT+2)

System Uptime: 0 days 0:31:22.011

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Loading Kernel Symbols

...............................................................

...................................................

Loading User Symbols

Loading unloaded module list

..........

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C000021A, {e117f188, c0000005, 7c9106c3, 113f36c}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

unable to get nt!KiCurrentEtwBufferOffset

unable to get nt!KiCurrentEtwBufferBase

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Probably caused by : ntoskrnl.exe ( nt+5c336 )

Followup: MachineOwner


2.

Microsoft ® Windows Debugger Version 6.11.0001.402 X86

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Machine Name:

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420

Debug session time: Tue Jul 31 12:26:00.375 2012 (GMT+2)

System Uptime: 0 days 1:50:01.923

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Loading Kernel Symbols

...............................................................

....................................................

Loading User Symbols

Loading unloaded module list

..........

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C000021A, {e1da1eb0, c0000005, 7c9106c3, 57f36c}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

unable to get nt!KiCurrentEtwBufferOffset

unable to get nt!KiCurrentEtwBufferBase

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Probably caused by : ntoskrnl.exe ( nt+5c336 )

Followup: MachineOwner