Reinstall ntoskrnl.exe

Are you by any chance using a program or utility to modify your boot screen? Some of these modify ntoskrnl and others replace it with their own version.

At least having a verified copy in the dllcache should stop these corruption problems, unless, and it would be smart on their part, the people who designed the boot screen also replace that copy, too.

Unfortunately, SFC can sometimes be a real pain. It can replace updated system files with older versions, and you are correct that a scan at Windows Update does not detect these old versions since the updates have already been cataloged as completed.

While installing some updates the other day, I noticed ntoskrnl fly by in one of the installations. That was no doubt a new version. If you then ran SFC, you may have replaced it with an older version that is not completely compatible with the other updated files. (I think it was one of the rollups, but not sure.)

If you have the inclination or interest, you might try checking the actual version numbers of the copies of ntoskrnl you have floating around to see if that shows anything interesting.

I know that an sfc I ran replaced explorer with an older version (the original on the CD) and I had some crashing problems until I discovered it. Luckily, I had yet another backup of the updated explorer in an image of the system.

SFC can be a real mess. A last resort for me, with a total repair installation preferable to using it.

 

Abraxas
When Windows Update scans my system, it checks to see what updates are currently installed, not what I have downloaded in the past. My experience with SFC is that Windows Updates are usually intact- they have a protection built in for SFC, maybe? I have a corp edition XP Pro cd, so I don't have to do WPA. Maybe that explains why I get a real scan from WU?

I would rather do SFC before a repair install. My repair installs have not always gone well, and I can't be certain everything will be intact when I'm done! An SFC will usually at least get me to where I can start fixing whatever I broke. I'll have to try it your way next time.

Johanna

 

Yes, WU scans your machine. But I don't believe it scans every single file for version information. It scans the catalog created on your machine of what updates have been applied in the past.

In an effort to solve an explorer crashing problem, I replaced explorer.exe, ntdll.dll, and ntoskrnl.exe with older versions. These have all been updated by WU. When I went to WU later, no new updates were found.

The crashing problem began after running an sfc. I'm not sure if it was related or not, but I noticed that the version of explorer in the Recovery Console files was newer than the one in System32. The RC had been installed on my drive before the sfc was performed.

At least with the repair, I know for a fact that all the system files are dated the same when complete and that all updates need to be reapplied.

There seems to me to be a certain incompatibility between system file protection and sfc. That is probably why the sfc does not seem to be MS' favorite tool. If sfc is replacing system files with different version numbers, the OS has lost a point of reference about which file is the "real" one and that therefore needs to be protected.