NTDLL.DLL Errors in Win XP Home Edition [error 1000 application...Explorer.EXE]

Question

For some time now, at least 5,6 or more mos,I've been getting the above error message most read as follows (with some minor changes the following is one of the latest):

eEvent Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 5/20/2004
Time: 6:52:51 AM
User: N/A
Computer: DDTCGQ21
Description:Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x00007ec4.

I have read thro tons and tons of info on the MS KB, Dell info, various forum boards, been in contact with Dell "support", etc. Earlier today I researched the Dell forums for explicite fixes to the problem. I have found one or two which might be helpful. These include postings by Karell in Feb.2004 and others in that time space. However, I still remain confused and frustrated by the multitude of answers and possible fixes. So once again I am on the search to find a fix. I can not believe that there is not a way to fix this problem without re-installing, changing all files or folders,or even reformatting...I have come to the conclusion that one fix does not apply to the variety of errors that can happen at different times for different users. However, that being said, what aboug the following.

But as a different starting point, and related to the possibility that the Win updates are causing at least some of the probs,I searched last nite thro my file and found 3 different ntdll.dll files. One of the three is at least a newer version, here are the three:
5.1.2600.1217 (xpsp2.030429-2131)in :I386\sys32

5.1.2600.1106 (xpsp1.020828-1920)in :I386

5.1.2600.1217 (xpsp2.030429-2131)in :Win/sys32

I note that the first and last are the same. #2 is an "older version". So here is the ques arising out of all my research about that little bugger:

QUESTION: why not delete the #2 ver which is probably causing the error rept and copy #1 into the place of #2?

So does anyone have a solution that has worked with this annoying problem, or what about applying the above deletion and copying of the newer version.

Thanks folks for any and all replies to this prob...and if posted in the wrong forum, pls let me know that too!
ted

lndian · Answer

The I386 folder has nothing to do in this.....Just rename ntdll.dll in the windows/system32 dir to ntdll.bak, search for ntdll.dll in the win xp cd and copy it in to ur c:\windows\system32 folder....If this does not help click on start click on run type in sfc /scannow, hit enter and let windows do its task (u might need the win xp cd during this)

lndian · Answer

1. Goto c:\windows\system32

2. Rename ntdll.dll to ntdll.bak

3. Search for ntdll.dll in win xp cd

4. Copy it and paste in the c:\windows\system32 dir.

5. If this does not work type in sfc /scannow in run box and hit enter. (Win Xp CD req)

spencerdl · Answer

Thanks so very much for your solution...will do it later today (Sat) when I return from work. In the meantime, do I leave the I385 file alone...not delete, change or alter the NTDLL file in that folder?
Your help with this horrible, annoying, frustrating problem is really appreciated!
Spencerdl

spencerdl · Answer

Thanks for the added info...but the search does not show the additional copy in \Windows\system32\dllcache..and I do have all my folder in view mode as you suggested for this very reason...I have to run off to work now, so will search further when get home. But, if the file is not in cache for whatever reason, should I paste it there? Incidentally, the file Win Sys 32 is a newer ver than the one in I386 and on the Win XP CD! That is saying something I think about the conflicting files in the "role up" update (or there abouts) when MS had to put out a fix for the fix! Ck me out on that.

Gotta run, ck back later tonite when home
spencer

Denny Denham · Answer

spencerdl,

You should have one more copy of ntdll.dll on your hard disk, in C:\Windows\system32\dllcache. Dllcache is a hidden folder, so unless you have chosen to display hidden files and folders (in Windows Explorer at Tools|Folder Options|View tab) it will not have appeared in a search. The copy of the file there should be the same as the one in C:\Windows\system32 and if you run sfc /scannow it is the one which will replace the copy in C:\Windows\system32 if it is corrupted. It may be the same as the one on your reinstallation CD (it depends on whether or not that CD included SP1 to Windows XP). There is no need to change the copy in I386 or I386/system32.

Denny Denham · Answer

spencerdl,

I have three versions of the file on my system. 5.1.2600.0 in C:\i386 (copied directly from my reinstallation CD which did not include SP1), 5.1.2600.1106 in C:\Windows\ServicePackFiles\i386 (which was included in SP1), and two copies of 5.1.2600.1217 in C:\Windows\System32 and C:\Windows\System32\dllcache (which was a part of the Critical Update described here).

Because of this, copying the file from anything you have available will do no good whatsoever. If ntdll.dll is causing the problem, you may be able to resolve it by uninstalling the hotfix and reinstalling it. The method for doing this is provided here and in the "Uninstalling a Hotfix" subtopic. After the hotfix is uninstalled you can go to Windows Update and reinstall it and see if that resolves the problem.

spencerdl · Answer

Denny

Thanks for your clarification. After returning from work last night, I manually searched for the cache file and found it (I'll need to go back and ck my folder settings!) So here is what I discovered regarding my NTDLL files:

1.I have 5 places to ck for these files
a. I386 ver 5.1.2600.1106 sp1
b. I386\Sys32 same as above
c. CD Win XP same as above (bought sys in May 03)
d. Win sys 32 ver 5.1.2600.127 sp2
e. Win\Sys32\dll cache same ver as "d"

Thus,"d" and "e" must have been altered by the following:

2. so the above brings me to conclude that indeed it was the "critical update" that MS issued that has been causing the problem. I "sort of knew" that this must be the problem when reading about it a number of times while researching a fix. You might not be surprised at the "very varying" possible solutions found across the internet.

3. I do tho, have one additional ques in clarification of the procedure and that is; why do I need to reinstall the "hot fix" if indeed that has been the culprit creating this awful mess? Or, does the newer hot fix (assuming there is one) remove this problem from the ealier hot fix? Geeish, you'd think MS would be more careful or at least more clear with this problem...ah well, this is not a perfect world.

Thanks so very much for your assistance with this troublesome problem. I look forward to you clarification and will, upon return from work later this evening proceed with the changes you have suggested.

spencerdl

spencerdl · Answer

Denny
thanks again for your thoughtful answer and helpfulness with this issue. Again, let me ask (and I know you attend to a lot of other issues, so you really need not reply to this note if you are busy with other issues) the hotfix then must contain a different or at least no conflicting NTDLL...I mean it must "roll back" to somehow using the ver I386 ver 5.1.2600.1106 sp1?

Spencer

Denny Denham · Answer

spencerdl,

If NTDLL.DLL is causing the problem (as it appears) the most direct way of replacing it with a "good" copy would be to uninstall/reinstall the hot fix. I have that Critical Update installed and it has caused no difficulty on my system.

Denny Denham · Answer

spencerdl, Frankly, I don't know where/how it rolls back to an earlier version of the file.

spencerdl · Answer

Thanks for your clarification on this....I may need this info should I foul up somewhere along the line trying to fix the fix MS tried to fix! spencer LOL

spencerdl · Answer

Denny
Again thanks for your honest replies and assistance in solving this problem. The message from JR above I think clarifies the last question I posed to you. And now armed with what I hope will be the instruments to finally deal once and for all with this little critter, I will off to do so!!

Thanks to JR and Indian for their assistance as well. These forums are indeed the place to find the answers not provided elsewhere!
Spencer

JRosenfeld · Answer

When you uninstall a hotfix, it rolls back the files it updated with the previous versions that it replaced on install. Those previous versions are kept in the $NtUninstallxxxx$ folder, where xxxx is the hotfix number. In this case

C:\WINDOWS\$NtUninstallQ815021$

spencerdl · Answer

Denny
Either I must be dumb,blind or stupid...because I can not find the Q815021 hot fix in my "program add/remove"!! Or else I have completely misinterpreted your's and other's reply to my problem. Let me be sure here, according to the info re the critical update it was issued on May 28th 03? I did have the system up and running by that time and would have, out of total ignorance of WIN XP at that point in my experience, automatically let it download. But I can find no evidence in the "program add/..." nor does a search of the files return any file info re Q815021. But at the same time I do know that I have the differing NTDLL files as per my above post.
I am at a loss to know for sure what to do here. Maybe the following?
....redown load the 815021 (assuming it was indeed dl)
....see what versions of NTDLL are installed by it,
....if there are conflicting versions, and if
the prob reoccurs, then
....delete the 815021

Geeish, this is getting out of hand!

Spencer

PS:I just came across this log file when searching for the above, the properties note that the log file was created on April 20,04! So now I am not even sure it is related to the hotfix 815021!!..it appears to me that 815021 (if indeed that it what this is) was initialized but then stopped, below is the essential notes in the beginning of the log...the remainder of the notes state "drivers" will not be replaced...here are the important sections:
Service Pack started with following command line:
DoInstallation: CleanPFR failed: 0x2
FetchSourceURL: SetupOpenInfFile Failed to open file: c:\7519eab3a5fdfd74bdca2dd4ea1e\sp2\update\update.url
***
DoInstallation: FetchSourceURL for c:\7519eab3a5fdfd74bdca2dd4ea1e\sp2\update\update.inf Failed
***
LoadFileQueues: SetupGetSourceFileLocation for halaacpi.dll failed: 0xe0000102
***
BuildCabinetManifest:SetupOpenInfFile failed with error INVALID_HANDLE_VALUE
***
AnalyzePhaseZero used 0 ticks
***
No c:\windows\INF\updtblk.inf file.
***
SetupFindFirstLine in LoadExclusionList Failed with error: 0xe0000102
***
Message displayed to the user: Are you sure you want to cancel?
***
User Input: YES
***

Message Edited by spencerdl on 05-24-2004 12:26 AM

Denny Denham · Answer

spencerdl, You should have a file $NtUninstallQ815021$ in C:\Windows. You can remove it by using spuninst in command mode as detailed in Method 1 here (substituting 815021 for 811493).

Windows General

NTDLL.DLL Errors in Win XP Home Edition [error 1000 application...Explorer.EXE]

Was this post helpful?