ntdll.dll error in explorer.exe just by closing a window/doing a simple task
Got this error http://www.mydomain.com/error1.jpg and I viewed the details of the explorer.exe error and I see this http://www.mydomain.com/error2.jpg .
I got the error simply by closing a window on my computer :| pretty pathetic, i have asked this question before and the problem wasnt solved... i am not too sure what this is, ive formated my computer and everything.. it didnt fix the problem... any ideas ?
Chris
I got the error simply by closing a window on my computer :| pretty pathetic, i have asked this question before and the problem wasnt solved... i am not too sure what this is, ive formated my computer and everything.. it didnt fix the problem... any ideas ?
Chris
ASKER
how does this program work, i have it running now.. but dont understand it
Chris
Chris
ASKER
Here is a list of apps that are using the ntdll.dll file. http://www.mydomain.com/ntdll.jpg
I am gettin the error on the explorer.exe according to http://www.mydomain.com/error1.jpg
Chris
I am gettin the error on the explorer.exe according to http://www.mydomain.com/error1.jpg
Chris
My first instinct when I see the list of running processes using ntdll.dll, is that Norton AntiVirus may well be involved. I am wondering whether the "Script Blocking" function is stepping in here and causing this error.
Read the following pages and see whether this could be associated with your problem:
http://www.mail-archive.com/bugtraq@securityfocus.com/msg11671.html
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.hackdefender.html
http://enterprisesecurity.symantec.com/PublicSectorCA/content.cfm?articleid=2419&EID=0
I think you should run a full virus scan to eliminate this possibility.
Read the following pages and see whether this could be associated with your problem:
http://www.mail-archive.com/bugtraq@securityfocus.com/msg11671.html
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.hackdefender.html
http://enterprisesecurity.symantec.com/PublicSectorCA/content.cfm?articleid=2419&EID=0
I think you should run a full virus scan to eliminate this possibility.
Check my solution here
http://oldlook-search.experts-exchange.com/questions/20751772/ntdll-dll-explorer-exe-signature-id-error.html
Sunray
http://oldlook-search.experts-exchange.com/questions/20751772/ntdll-dll-explorer-exe-signature-id-error.html
Sunray
ASKER
Ive looked at your solutions BillDL and Nothing applies to my issue however, I downgraded my Norton Anti-Virus. I'm not sure how this problem relates to the ntdll.dll file but I'm going to see if it fixes the problem. I ran a full sys virus scan and found nothing. In previous questions, ive mentioned that I got this issue directly after formating my computer so I highly doubt its a virus.
Any other ideas?
Chris
Any other ideas?
Chris
dj_ludachris
My suggestion wasn't really intended as a "solution", but it was really just an instinct that there could be a connection.
Windows Explorer is so tightly integrated with Internet Explorer components that I was merely wondering if Norton AntiVirus "Script Blocking" was misinterpreting some action as an unwelcome action and killing the action just in case.
The page I directed you to at http://www.mail-archive.com/bugtraq@securityfocus.com/msg11671.html speaks of a "security vulnerability". Although it is a bit technical, where discussed under the "7. TECHNICAL DETAILS" paragraph heding, what it is referring to is this:
The file NTDLL.DLL (which is also present in Win98) contains "functions" that are "called" by other processes, eg:
NtCreateFile
NtGetDevnodeFromFileHandle
RtlAnsiStringToUnicodeStri
RtlConvertLongToLargeInteg
RtlConvertUlongToLargeInte
RtlMultiByteToUnicodeN
RtlUnicodeStringToAnsiStri
RtlUnicodeToMultiByteN
NtCreateFile
You may notice, if you read some of the names, that a lot of the functions are concerned with handling "strings" of data and processing them in some way. The function "Unicode String To Ansi String" is fairly self explanatory.
Now, the function within ntdll.dll that causes a vulnerability is "Get Full Path Name". In other words, it handles a fairly long data string. What happens is that, if something forces it to try and handle a string longer than a given size in characters, then it begins to fail.
AntiVirus programs use what is referred to as "heuristics", where they look for some classic signs of some suspicious activity, like ocating certain data in memory or carrying out certain other actions recognised as suspicious.
For this reason, I was wondering if your AntiVirus software is clever enough to interpret an overflow of data if ntdll.dll was passed an unusually long string. I had noticed in your other question ( http://oldlook-search.experts-exchange.com/questions/20751772/ntdll-dll-explorer-exe-signature-id-error.html ) you asked: "how do i create more registry space, it's asking me to increase it cause it doesn't have enough space?". Was this an Error Message?
You will be aware that the position and size of many windows are saved on your system when you close that window. It is either saved in one of the text-based system files or in the Registry. My thoughts were that perhaps you have excessively long directory names (ie. paths to a file) and this could be what is starting the buffer overflow being recognised by Norton.
Of course, this is all just a hypothesis, but in the absence of any other convincing possibilities, try turning OFF the "heuristics" method of virus detection in Norton AntiVirus, and also disabling "Script Blocking" just as a test. In fact, turn off the Resident Shield, and reboot. You can always enable it again if there is no difference.
Although not directly concerned with your current problem (I hope), you mentioned above: "I got this issue directly after formating my computer so I highly doubt its a virus". Just to clarify something, it IS still possible to have a virus residing in the Boot Sector of your system that wouldn't necessarily be eliminated with a format, and wouldn't be detected unless NAV is set to scan the boot sector at startup. Anyway, that's incidental.
Look again at your running processes SMSS.EXE and CSRSS.EXE :
http://www.viruslist.com/eng/viruslist.html?id=51071
http://www.symantec.com/avcenter/venc/data/w32.dalbug.worm.html
Do me a favour and do a file search for these 2 files. If they exist ONLY in C:\windows\system, then OK. If there are also copies in C:\windows, then I would be suspicious.
Another thing you might like to try is disabling the Indexing Service (cidaemon.exe) and also your MSN Messenger.
My suggestion wasn't really intended as a "solution", but it was really just an instinct that there could be a connection.
Windows Explorer is so tightly integrated with Internet Explorer components that I was merely wondering if Norton AntiVirus "Script Blocking" was misinterpreting some action as an unwelcome action and killing the action just in case.
The page I directed you to at http://www.mail-archive.com/bugtraq@securityfocus.com/msg11671.html speaks of a "security vulnerability". Although it is a bit technical, where discussed under the "7. TECHNICAL DETAILS" paragraph heding, what it is referring to is this:
The file NTDLL.DLL (which is also present in Win98) contains "functions" that are "called" by other processes, eg:
NtCreateFile
NtGetDevnodeFromFileHandle
RtlAnsiStringToUnicodeStri
RtlConvertLongToLargeInteg
RtlConvertUlongToLargeInte
RtlMultiByteToUnicodeN
RtlUnicodeStringToAnsiStri
RtlUnicodeToMultiByteN
NtCreateFile
You may notice, if you read some of the names, that a lot of the functions are concerned with handling "strings" of data and processing them in some way. The function "Unicode String To Ansi String" is fairly self explanatory.
Now, the function within ntdll.dll that causes a vulnerability is "Get Full Path Name". In other words, it handles a fairly long data string. What happens is that, if something forces it to try and handle a string longer than a given size in characters, then it begins to fail.
AntiVirus programs use what is referred to as "heuristics", where they look for some classic signs of some suspicious activity, like ocating certain data in memory or carrying out certain other actions recognised as suspicious.
For this reason, I was wondering if your AntiVirus software is clever enough to interpret an overflow of data if ntdll.dll was passed an unusually long string. I had noticed in your other question ( http://oldlook-search.experts-exchange.com/questions/20751772/ntdll-dll-explorer-exe-signature-id-error.html ) you asked: "how do i create more registry space, it's asking me to increase it cause it doesn't have enough space?". Was this an Error Message?
You will be aware that the position and size of many windows are saved on your system when you close that window. It is either saved in one of the text-based system files or in the Registry. My thoughts were that perhaps you have excessively long directory names (ie. paths to a file) and this could be what is starting the buffer overflow being recognised by Norton.
Of course, this is all just a hypothesis, but in the absence of any other convincing possibilities, try turning OFF the "heuristics" method of virus detection in Norton AntiVirus, and also disabling "Script Blocking" just as a test. In fact, turn off the Resident Shield, and reboot. You can always enable it again if there is no difference.
Although not directly concerned with your current problem (I hope), you mentioned above: "I got this issue directly after formating my computer so I highly doubt its a virus". Just to clarify something, it IS still possible to have a virus residing in the Boot Sector of your system that wouldn't necessarily be eliminated with a format, and wouldn't be detected unless NAV is set to scan the boot sector at startup. Anyway, that's incidental.
Look again at your running processes SMSS.EXE and CSRSS.EXE :
http://www.viruslist.com/eng/viruslist.html?id=51071
http://www.symantec.com/avcenter/venc/data/w32.dalbug.worm.html
Do me a favour and do a file search for these 2 files. If they exist ONLY in C:\windows\system, then OK. If there are also copies in C:\windows, then I would be suspicious.
Another thing you might like to try is disabling the Indexing Service (cidaemon.exe) and also your MSN Messenger.
Sorry to dig up an old question, but I've been searching Google, and this is the only relevant result that came up for me. I'm getting the EXACT same problem as dj_ludachris. Explorer.exe will randomly crash (or close) and re-open by itself. What I'm wondering is if anyone has encountered this error and was able to fix it? And if dj_ludachris is reading, perhaps you could post your e-mail address so we could "compare notes" and maybe we can find a common thread that would cause this problem. If anyone does reply, I'll post more detailed info about the error and my system.
thanks
vellox
thanks
vellox
ASKER
I still have yet to find a solution belive it or not, I don't know whats going on. Its like my pc is falling appart.
Since you didn't respond any further, I thought your problem was resolved.
Download this program. www.aida32.hu/aida32.php
After opening the program, look under operating system, then processes
Copy the processes here.
One of your programs is conflicting with explorer. The ntdll.dll is being used by more than one application, you have to determine which application is causing the problem.
Download this program. www.aida32.hu/aida32.php
After opening the program, look under operating system, then processes
Copy the processes here.
One of your programs is conflicting with explorer. The ntdll.dll is being used by more than one application, you have to determine which application is causing the problem.
ASKER
http://www.mydomain.com/report.html - that is the report i did.. i dont get it though...
Can you please start posting the information in the posts. This thread is not going to be helpful to others because your links to the info won't be there when they want to review them.
aida32.bin C:\Documents and Settings\Chris\Desktop\ha\
ccApp.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe 12688 KB 7352 KB
ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 3648 KB 3312 KB
ccPxySvc.exe C:\Program Files\Norton Personal Firewall\ccPxySvc.exe 7728 KB 7344 KB
devldr32.exe C:\WINDOWS\System32\devldr
Explorer.EXE C:\WINDOWS\Explorer.EXE 25180 KB 16056 KB
Icq.exe C:\Program Files\ICQ\Icq.exe 4744 KB 6908 KB
iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe 3336 KB 10176 KB
lsass.exe C:\WINDOWS\system32\lsass.
mirc.exe C:\Program Files\mIRC\mirc.exe 4840 KB 5536 KB
msimn.exe C:\Program Files\Outlook Express\msimn.exe 14056 KB 5620 KB
msnmsgr.exe C:\Program Files\MSN Messenger\msnmsgr.exe 7316 KB 18976 KB
navapsvc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe 4216 KB 3536 KB
navapw32.exe C:\PROGRA~1\NORTON~2\navap
NISUM.EXE C:\Program Files\Norton Personal Firewall\NISUM.EXE 3884 KB 1236 KB
POPUPS~1.EXE C:\PROGRA~1\PANICW~1\POP-U
services.exe C:\WINDOWS\system32\servic
smss.exe C:\WINDOWS\System32\smss.e
spoolsv.exe C:\WINDOWS\system32\spools
svchost.exe C:\WINDOWS\System32\svchos
svchost.exe C:\WINDOWS\system32\svchos
svchost.exe C:\WINDOWS\System32\svchos
winlogon.exe C:\WINDOWS\system32\winlog
YPager.exe C:\Program Files\Yahoo!\Messenger\YPa
I'll have to get back to later on this. Maybe someone will post some input in the mean time.
ccApp.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe 12688 KB 7352 KB
ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 3648 KB 3312 KB
ccPxySvc.exe C:\Program Files\Norton Personal Firewall\ccPxySvc.exe 7728 KB 7344 KB
devldr32.exe C:\WINDOWS\System32\devldr
Explorer.EXE C:\WINDOWS\Explorer.EXE 25180 KB 16056 KB
Icq.exe C:\Program Files\ICQ\Icq.exe 4744 KB 6908 KB
iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe 3336 KB 10176 KB
lsass.exe C:\WINDOWS\system32\lsass.
mirc.exe C:\Program Files\mIRC\mirc.exe 4840 KB 5536 KB
msimn.exe C:\Program Files\Outlook Express\msimn.exe 14056 KB 5620 KB
msnmsgr.exe C:\Program Files\MSN Messenger\msnmsgr.exe 7316 KB 18976 KB
navapsvc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe 4216 KB 3536 KB
navapw32.exe C:\PROGRA~1\NORTON~2\navap
NISUM.EXE C:\Program Files\Norton Personal Firewall\NISUM.EXE 3884 KB 1236 KB
POPUPS~1.EXE C:\PROGRA~1\PANICW~1\POP-U
services.exe C:\WINDOWS\system32\servic
smss.exe C:\WINDOWS\System32\smss.e
spoolsv.exe C:\WINDOWS\system32\spools
svchost.exe C:\WINDOWS\System32\svchos
svchost.exe C:\WINDOWS\system32\svchos
svchost.exe C:\WINDOWS\System32\svchos
winlogon.exe C:\WINDOWS\system32\winlog
YPager.exe C:\Program Files\Yahoo!\Messenger\YPa
I'll have to get back to later on this. Maybe someone will post some input in the mean time.
ASKER
aida32.bin C:\Documents and Settings\Chris\Desktop\Aid
ccApp.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe 12920 KB 7372 KB
ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 3652 KB 3312 KB
ccPxySvc.exe C:\Program Files\Norton Personal Firewall\ccPxySvc.exe 6716 KB 5400 KB
cftppro.exe C:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe 2692 KB 4688 KB
devldr32.exe C:\WINDOWS\System32\devldr
Explorer.EXE C:\WINDOWS\Explorer.EXE 25668 KB 16144 KB
ftpte.exe C:\Program Files\GlobalSCAPE\CuteFTP Pro\TE\ftpte.exe 1904 KB 2536 KB
Icq.exe C:\Program Files\ICQ\Icq.exe 10708 KB 7740 KB
iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe 20564 KB 10164 KB
lsass.exe C:\WINDOWS\system32\lsass.
mirc.exe C:\Program Files\mIRC\mirc.exe 4480 KB 5584 KB
msimn.exe C:\Program Files\Outlook Express\msimn.exe 13952 KB 5608 KB
msnmsgr.exe C:\Program Files\MSN Messenger\msnmsgr.exe 6520 KB 15968 KB
navapsvc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe 4232 KB 3536 KB
navapw32.exe C:\PROGRA~1\NORTON~2\navap
NISUM.EXE C:\Program Files\Norton Personal Firewall\NISUM.EXE 3884 KB 1236 KB
POPUPS~1.EXE C:\PROGRA~1\PANICW~1\POP-U
services.exe C:\WINDOWS\system32\servic
smss.exe C:\WINDOWS\System32\smss.e
spoolsv.exe C:\WINDOWS\system32\spools
svchost.exe C:\WINDOWS\System32\svchos
svchost.exe C:\WINDOWS\system32\svchos
svchost.exe C:\WINDOWS\System32\svchos
winlogon.exe C:\WINDOWS\system32\winlog
YPager.exe C:\Program Files\Yahoo!\Messenger\YPa
Yea there we go.. ok thanks.
ccApp.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe 12920 KB 7372 KB
ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 3652 KB 3312 KB
ccPxySvc.exe C:\Program Files\Norton Personal Firewall\ccPxySvc.exe 6716 KB 5400 KB
cftppro.exe C:\Program Files\GlobalSCAPE\CuteFTP Pro\cftppro.exe 2692 KB 4688 KB
devldr32.exe C:\WINDOWS\System32\devldr
Explorer.EXE C:\WINDOWS\Explorer.EXE 25668 KB 16144 KB
ftpte.exe C:\Program Files\GlobalSCAPE\CuteFTP Pro\TE\ftpte.exe 1904 KB 2536 KB
Icq.exe C:\Program Files\ICQ\Icq.exe 10708 KB 7740 KB
iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe 20564 KB 10164 KB
lsass.exe C:\WINDOWS\system32\lsass.
mirc.exe C:\Program Files\mIRC\mirc.exe 4480 KB 5584 KB
msimn.exe C:\Program Files\Outlook Express\msimn.exe 13952 KB 5608 KB
msnmsgr.exe C:\Program Files\MSN Messenger\msnmsgr.exe 6520 KB 15968 KB
navapsvc.exe C:\Program Files\Norton AntiVirus\navapsvc.exe 4232 KB 3536 KB
navapw32.exe C:\PROGRA~1\NORTON~2\navap
NISUM.EXE C:\Program Files\Norton Personal Firewall\NISUM.EXE 3884 KB 1236 KB
POPUPS~1.EXE C:\PROGRA~1\PANICW~1\POP-U
services.exe C:\WINDOWS\system32\servic
smss.exe C:\WINDOWS\System32\smss.e
spoolsv.exe C:\WINDOWS\system32\spools
svchost.exe C:\WINDOWS\System32\svchos
svchost.exe C:\WINDOWS\system32\svchos
svchost.exe C:\WINDOWS\System32\svchos
winlogon.exe C:\WINDOWS\system32\winlog
YPager.exe C:\Program Files\Yahoo!\Messenger\YPa
Yea there we go.. ok thanks.
Ok, well the only common thread I can see is that we both have Norton Antivirus installed (2003 for me, same for you chris?). I have since disabled heuristics and ScriptBlocking as per Charles instructions, and havn't had explorer.exe crash, though it's only been a couple of hours. I find it odd though that Norton would start acting up now, as I have been using the program since it first came out without any problems. Maybe there was a program update that I and chris downloaded through LiveUpdate that is causing the problem?
ASKER
Thats what i thought it was, i havnt been receiving the error since, i downgraded to 2002 now.. but i have had just explorer.exe errors from doing simple tasks still.. im debating weather its the graphics card or not..
vellox and dj_ludachris
If you look back up 10 comments from this one, you will see that I had an "instinct" about this:
>>> "Windows Explorer is so tightly integrated with Internet Explorer components that I was merely wondering if Norton AntiVirus "Script Blocking" was misinterpreting some action as an unwelcome action and killing the action just in case. <<<
My suggestion then was:
>>> try turning OFF the "heuristics" method of virus detection in Norton AntiVirus, and also disabling "Script Blocking" just as a test. In fact, turn off the Resident Shield, and reboot. You can always enable it again if there is no difference. <<<
I too, like CharlesBukowski, assumed that you had either found a solution or had simply forgotten to return.
Let's see now. You have the following processes all running concurrently to cloud the issue:
(This is ignoring IE, OE, and AIDA32)
CuteFTP Pro
Norton AntiVirus
Norton Personal Firewall
ICQ
mIRC
MSN Messenger
Yahoo Messenger
Popup Stopper
Out of curiosity, do you still have Windows XP Firewall running in addition to Norton Personal Firewall?
If so, disable one or both. Also stop mIRC, ICQ, MSN Messneger, Yahoo Messenger, and CuteFTP from running.
You will have to start from the ground up. I'm not sure if you are aware of how to disable "Services" in Windows XP, but that's where you should begin.
You just aren't going to find the solution by disabling one thing at a time. Try disabling as many non-essential processes as you can, and then reboot.
As CharlesBukowski has said, post results here. This question is already now flawed because the url's to your initial error messages are dead.
If you look back up 10 comments from this one, you will see that I had an "instinct" about this:
>>> "Windows Explorer is so tightly integrated with Internet Explorer components that I was merely wondering if Norton AntiVirus "Script Blocking" was misinterpreting some action as an unwelcome action and killing the action just in case. <<<
My suggestion then was:
>>> try turning OFF the "heuristics" method of virus detection in Norton AntiVirus, and also disabling "Script Blocking" just as a test. In fact, turn off the Resident Shield, and reboot. You can always enable it again if there is no difference. <<<
I too, like CharlesBukowski, assumed that you had either found a solution or had simply forgotten to return.
Let's see now. You have the following processes all running concurrently to cloud the issue:
(This is ignoring IE, OE, and AIDA32)
CuteFTP Pro
Norton AntiVirus
Norton Personal Firewall
ICQ
mIRC
MSN Messenger
Yahoo Messenger
Popup Stopper
Out of curiosity, do you still have Windows XP Firewall running in addition to Norton Personal Firewall?
If so, disable one or both. Also stop mIRC, ICQ, MSN Messneger, Yahoo Messenger, and CuteFTP from running.
You will have to start from the ground up. I'm not sure if you are aware of how to disable "Services" in Windows XP, but that's where you should begin.
You just aren't going to find the solution by disabling one thing at a time. Try disabling as many non-essential processes as you can, and then reboot.
As CharlesBukowski has said, post results here. This question is already now flawed because the url's to your initial error messages are dead.
ASKER
Hey, I didnt disable scripting when I did have norton anti virus 2003 on my pc but just downgraded. All those applications you mentioned such as Yahoo Messenger and ICQ and so on Do not effect this issue, I have ran these programs after receiving the error at thet ime when I got the error. I had received the error with minimal services running and immediatly after reboot. So far I havn't received an error besides my memory error which I received a couple days ago. But I think i resolved that issue by increasing the page file size.
Well I'm stumped. I uninstalled Norton 2003 and ran my system without it for about 6 hours and the error finally reared its ugly head, this time when I went to open a program through the start menu. I did a quick look in the Task Manager and noticed that imapi.exe was running when explorer.exe and disapeared when explorer.exe came back. Nothing non-essential was running the background. I am curious, chris do you have a wireless connection?
ASKER
I have a wireless home network yea, what are you pondering?
I'm having a very similiar problem. I just formatted my drive and installed Windows XP Professional and everything worked fine at first. I then applied all updates for windows, my video card, and norton systemworks. Sometime after this, explorer.exe began to crash periodically, always faulting ntdll.dll.
I believe the last things I did, before the periodic crashes began, was to install Spybot S&D and windows update "Cumulative Security Update for Internet Explorer 6 SP1 (KB824145)." Spybot S&D has an additional component called "browser helper", which I think is supposed to block nasty BHO's and block access to "internet options" from within IE. Browser helper is not installed by default and I had just installed it, along with applying the last windows update patch, when the crashes began. Norton Systemworks "One Button Checkup" had also just run and I had applied all the fixes it suggested.
After the crashes began, I used the "undo" button in Norton Systemworks to undo the One Button Checkup fixes and Spybot S&D has a button to uninstall the "Browser Helper" component, which I used. Now explorer.exe doesn't seem to crash often, but various other executeables still do, usually faulting ntdll.dll.
So far all of the suggestions I've found by searching google and google news do not work, including the ones in this discussion. However, it seems as if I've noticed a lot of recent discussions for crashes faulting ntdll.dll. This is my first time to post here and I'm doing it because our problems seem pretty similiar. I am using Windows XP Professional and have Norton Systemworks Professional 2003 installed, with NAV 2003 running. I'm unsure why this would matter, but I also have a wireless network. However, the computer I'm having trouble with has a standard ethernet adapter and isn't connected directly to my WAP. I have an ATI Radeon All-In-Wonder video adapter, with the CAT 3.8 drivers, if that means anything. I'll try to post more info later.
P.S. I should also add that immediately after installing Norton Systemworks, I created a Ghost image. I probably installed some windows update patches after creating this image. I used the Ghost image to restore my computer a couple of times, after doing some risky software evaluations, which I didn't want remnants of on my new install. The crashes didn't begin until after the last time I restored the image, so I doubt if this has anything to do with my problem, but I'm wondering if I'm missing an important update from restoring to a previous state.
I believe the last things I did, before the periodic crashes began, was to install Spybot S&D and windows update "Cumulative Security Update for Internet Explorer 6 SP1 (KB824145)." Spybot S&D has an additional component called "browser helper", which I think is supposed to block nasty BHO's and block access to "internet options" from within IE. Browser helper is not installed by default and I had just installed it, along with applying the last windows update patch, when the crashes began. Norton Systemworks "One Button Checkup" had also just run and I had applied all the fixes it suggested.
After the crashes began, I used the "undo" button in Norton Systemworks to undo the One Button Checkup fixes and Spybot S&D has a button to uninstall the "Browser Helper" component, which I used. Now explorer.exe doesn't seem to crash often, but various other executeables still do, usually faulting ntdll.dll.
So far all of the suggestions I've found by searching google and google news do not work, including the ones in this discussion. However, it seems as if I've noticed a lot of recent discussions for crashes faulting ntdll.dll. This is my first time to post here and I'm doing it because our problems seem pretty similiar. I am using Windows XP Professional and have Norton Systemworks Professional 2003 installed, with NAV 2003 running. I'm unsure why this would matter, but I also have a wireless network. However, the computer I'm having trouble with has a standard ethernet adapter and isn't connected directly to my WAP. I have an ATI Radeon All-In-Wonder video adapter, with the CAT 3.8 drivers, if that means anything. I'll try to post more info later.
P.S. I should also add that immediately after installing Norton Systemworks, I created a Ghost image. I probably installed some windows update patches after creating this image. I used the Ghost image to restore my computer a couple of times, after doing some risky software evaluations, which I didn't want remnants of on my new install. The crashes didn't begin until after the last time I restored the image, so I doubt if this has anything to do with my problem, but I'm wondering if I'm missing an important update from restoring to a previous state.
Here are my processes:
aida32.bin C:\Documents and Settings\rogun\Desktop\aid
AsusProb.exe D:\Program Files\ASUS\Probe\AsusProb.
Ati2evxx.exe C:\WINDOWS\system32\Ati2ev
Ati2evxx.exe C:\WINDOWS\System32\Ati2ev
atiptaxx.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe 4264 KB 2100 KB
ccApp.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe 13580 KB 5860 KB
ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 2856 KB 2468 KB
Explorer.EXE C:\WINDOWS\Explorer.EXE 28056 KB 20044 KB
GHOSTS~2.EXE D:\PROGRA~1\NORTON~1\NORTO
iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe 1360 KB 17788 KB
iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe 1708 KB 14672 KB
jusched.exe C:\Program Files\Java\j2re1.4.2_01\bi
kpf4gui.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe 6080 KB 1816 KB
kpf4gui.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe 4524 KB 1468 KB
kpf4ss.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe 7796 KB 3992 KB
lsass.exe C:\WINDOWS\system32\lsass.
MAILWA~1.EXE D:\PROGRA~1\MAILWA~2\MAILW
msmsgs.exe C:\Program Files\Messenger\msmsgs.exe
navapsvc.exe D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe 1836 KB 1232 KB
nopdb.exe D:\PROGRA~1\NORTON~1\SPEED
NPROTECT.EXE D:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE 6916 KB 1664 KB
services.exe C:\WINDOWS\system32\servic
smss.exe C:\WINDOWS\System32\smss.e
spoolsv.exe C:\WINDOWS\system32\spools
sstray.exe C:\WINDOWS\System32\sstray
svchost.exe C:\WINDOWS\system32\svchos
svchost.exe C:\WINDOWS\System32\svchos
taskswitch.exe C:\WINDOWS\System32\tasksw
type32.exe C:\Program Files\Microsoft IntelliType Pro\type32.exe 4568 KB 2196 KB
winlogon.exe C:\WINDOWS\system32\winlog
aida32.bin C:\Documents and Settings\rogun\Desktop\aid
AsusProb.exe D:\Program Files\ASUS\Probe\AsusProb.
Ati2evxx.exe C:\WINDOWS\system32\Ati2ev
Ati2evxx.exe C:\WINDOWS\System32\Ati2ev
atiptaxx.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe 4264 KB 2100 KB
ccApp.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe 13580 KB 5860 KB
ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 2856 KB 2468 KB
Explorer.EXE C:\WINDOWS\Explorer.EXE 28056 KB 20044 KB
GHOSTS~2.EXE D:\PROGRA~1\NORTON~1\NORTO
iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe 1360 KB 17788 KB
iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe 1708 KB 14672 KB
jusched.exe C:\Program Files\Java\j2re1.4.2_01\bi
kpf4gui.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe 6080 KB 1816 KB
kpf4gui.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe 4524 KB 1468 KB
kpf4ss.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe 7796 KB 3992 KB
lsass.exe C:\WINDOWS\system32\lsass.
MAILWA~1.EXE D:\PROGRA~1\MAILWA~2\MAILW
msmsgs.exe C:\Program Files\Messenger\msmsgs.exe
navapsvc.exe D:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe 1836 KB 1232 KB
nopdb.exe D:\PROGRA~1\NORTON~1\SPEED
NPROTECT.EXE D:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE 6916 KB 1664 KB
services.exe C:\WINDOWS\system32\servic
smss.exe C:\WINDOWS\System32\smss.e
spoolsv.exe C:\WINDOWS\system32\spools
sstray.exe C:\WINDOWS\System32\sstray
svchost.exe C:\WINDOWS\system32\svchos
svchost.exe C:\WINDOWS\System32\svchos
taskswitch.exe C:\WINDOWS\System32\tasksw
type32.exe C:\Program Files\Microsoft IntelliType Pro\type32.exe 4568 KB 2196 KB
winlogon.exe C:\WINDOWS\system32\winlog
ASKER
Well you know what, i havnt been receiving this explorer.exe error with ntdll.dll error any more, i did however upgrade to norton internet security 2004 and havn't really been noticing any more problems other then my computer sometimes freezing explorer.exe and not being able to refresh once it crashes leaving me to restart my computer or log off the current user loged onto the machine.
What do you think is going on now? lol
What do you think is going on now? lol
I finally got around to messing with my DVD-ROM drive, since rebuilding my machine, and it wasn't working right. I couldn't enable any DMA modes and it wouldn't work right with my DVD software. The only thing I had changed from before was replacing the 40 pin cable with an 80 pin cable. So, I put the 40 pin cable back in and everything worked fine. It's an old DVD player and I'm not sure if it just doesn't work with 80 pin cables or if I have a bad cable, but since replacing it I haven't had any errors. It's been a couple of days now and I'm hoping that was the problem.
I use Kerio instead of NIS, so that definitely had nothing to do with my problem. I do use NSW with NAV though and have wondered about them.
I'm not sure what to suggest about your lockups, but if it's a newly installed system, I'd make sure all of the hardware was properly installed, without conflicts. Since rebuilding my machine and cleanly installing Windows XP Pro, I've ran into two different hardware problems and neither was detected by Windows. One of them was an IRQ conflict with my video card and a PCI IDE controller. Windows showed no conflicts and I only had a problem when trying to capture video. I simply could not capture video. So, I moved the IDE controller to an unshared slot and the video capture problem went away. Now it appears that using an 80 pin cable with my DVD-ROM may have had something to do with my program crashes.
Good luck and I'll report back if I have anymore crashes faulting ntdll.dll.
I use Kerio instead of NIS, so that definitely had nothing to do with my problem. I do use NSW with NAV though and have wondered about them.
I'm not sure what to suggest about your lockups, but if it's a newly installed system, I'd make sure all of the hardware was properly installed, without conflicts. Since rebuilding my machine and cleanly installing Windows XP Pro, I've ran into two different hardware problems and neither was detected by Windows. One of them was an IRQ conflict with my video card and a PCI IDE controller. Windows showed no conflicts and I only had a problem when trying to capture video. I simply could not capture video. So, I moved the IDE controller to an unshared slot and the video capture problem went away. Now it appears that using an 80 pin cable with my DVD-ROM may have had something to do with my program crashes.
Good luck and I'll report back if I have anymore crashes faulting ntdll.dll.
No comment has been added lately, so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area that this question is:
-=Accept - BillDL=-
Please leave any comments here within the next four days.
PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!
Jay
EE Cleanup Volunteer
jayca. Thanks for that suggestion, but I would prefer it if this question was simply deleted without points refund.
I eventually found it very frustrating attempting to offer suggestions which, through a systematic process of elimination, may have pinpointed the source of the problem. After the question became a discussion board, with very little feedback to address specific suggestions, I felt like making any more was like farting into the wind.
I would rather not be associated with this question, if you don't mind.
Thanks
Bill
I eventually found it very frustrating attempting to offer suggestions which, through a systematic process of elimination, may have pinpointed the source of the problem. After the question became a discussion board, with very little feedback to address specific suggestions, I felt like making any more was like farting into the wind.
I would rather not be associated with this question, if you don't mind.
Thanks
Bill
ASKER
Honestly it wasnt the NAV script blocking that was giving me this error. I still get explorer.exe freezing.
ASKER
Yes, please. -- Chris
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Look for something like this to be causing the problem......
Win32/Winshow.51712.dll.Tr
can possibly be found in found in ..........
iefeatsl.dll
An unneccessary temp file which causes ie to crash. Find the file and just delete it.
C:\DOCUME~1\Owner\LOCALS\~
ASKER
THe problem wasnt in internet explorer, just windows explorer.
-- chris
-- chris
dj_ludachris
The functionality of Windows Explorer in Windows 98 onwards is highly dependent upon the existence of Internet Explorer components and settings. They are so closely entwined that IE, and other updates also alter files and settings that have a knock-on effect in Windows Explorer. Any corruption to, or version conflicts with, these components can cause a variety of problems that can be manifested in IE and/or Windows Explorer.
The functionality of Windows Explorer in Windows 98 onwards is highly dependent upon the existence of Internet Explorer components and settings. They are so closely entwined that IE, and other updates also alter files and settings that have a knock-on effect in Windows Explorer. Any corruption to, or version conflicts with, these components can cause a variety of problems that can be manifested in IE and/or Windows Explorer.
I too was having random explorer.exe crashes when simply right clicking on a folder or closing a window. I read many forums over several months and nobody seemed to have the answer. I finally read something that worked for me. I had installed Spybot Search & Destroy quite awhile back but didn't use the immunize feature until a couple of months later. I "undid" the immunize and I haven't had a crash since. That's been 3 weeks now.
ASKER
hmm so i should unimunize it then?
Yes. Just go onto the immunize section of Spybot and hit the undo button. I also uninstalled the browser helper. I've been tempted to re-immunize to see if the problem comes back...but I don't want to ruin a good thing.
ASKER
THanks alot, ill let u know if it helps the problem i am getting. so far no issues.
Chris
Chris
Anyone get anything definitive on this ntdll.dll?
I've got it coming up on an error message opening OE 6.0.
If I don't send or cancel the error message, I can continue to use OE by dragging the message off to the side.
I started to read this and the previous post but all I got was a headache.
Pete
I've got it coming up on an error message opening OE 6.0.
If I don't send or cancel the error message, I can continue to use OE by dragging the message off to the side.
I started to read this and the previous post but all I got was a headache.
Pete
Hello. I just got through reading this long post and I am having the same issue. I am not sure if my scenario is the same but here is what is happening. Using Group Policy I am using software installation (assign) to particular. This install runs, no problem. When I right-click Outlook icon I get:
The instruction at "0x77f70054" referenced memory at "0x28000a0b". The memory could not be "read".
The exception unknown software exception (0xc015000f) occurred in the application at location 0x77f6fafb. Click Ok to Terminate.
Event ID: 1000 Application Error
Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x0002351d.
Event ID: 4097 Dr Watson
The application, C:\WINDOWS\explorer.exe, generated an application error The error occurred on 04/22/2004 @ 11:54:36.420 The exception generated was c0000005 at address 77F73524 (ntdll!RtlQueryInformation
Event ID: 1001 Application Error
Fault bucket 52885127
All this happen when right-clicking Outlook then opening properties. These same symptoms occur when policy ran on a different computer. I disabled norton, same error. I re-installed with Norton disabled not using the policy, same problem.
Any ideas?
The instruction at "0x77f70054" referenced memory at "0x28000a0b". The memory could not be "read".
The exception unknown software exception (0xc015000f) occurred in the application at location 0x77f6fafb. Click Ok to Terminate.
Event ID: 1000 Application Error
Faulting application explorer.exe, version 6.0.2800.1221, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x0002351d.
Event ID: 4097 Dr Watson
The application, C:\WINDOWS\explorer.exe, generated an application error The error occurred on 04/22/2004 @ 11:54:36.420 The exception generated was c0000005 at address 77F73524 (ntdll!RtlQueryInformation
Event ID: 1001 Application Error
Fault bucket 52885127
All this happen when right-clicking Outlook then opening properties. These same symptoms occur when policy ran on a different computer. I disabled norton, same error. I re-installed with Norton disabled not using the policy, same problem.
Any ideas?
ASKER
Ya man, it has somethign to do with SpyBot Search and Destroy the Immunize Features, if you have tha tapplication on your compuiter, just uninstall and disable the immunize features. I havn't had this problem in a while, it fixed it.
Chris
Chris
That application isnt installed. The computer was not having any problems until O2K3 was pushed to it using group policy. Now the errors indicated above occur. The symptoms are identical to those talked about above this post, however, there doesnt seem to be any resolve. BillDL offered a lot of good insight and I tried and researched much of the information he posted. ...the problem still remains though for me.
ASKER
Weird :| I don't know .. its such a weird error, i have had it for a long time now I don't get it hardly at all anymore.
Chris
Chris
Chris, glad to hear that the unimmunize of Spybot got you out of your error problem as it did mine. Just a thought for gl_3n2k3, if you are running a different spyware software program than Spybot, possibly it would have a similar setting causing the problem.
I am finding more information since I started looking today. Check this link out.
http://forums.viaarena.com/messageview.cfm?catid=13&threadid=52978
They appear to be fighting the same battle. They are thinking the a MS critical update might be the problem. I cant say for certain if this applies to my issue but my SUS server recently has published several updates one of which does change the ntdll.dll file. The update seemed to rev. the dll from .1106 to .1217. I am not sure if its the dll or the application calling it that may be the problem. I know that this computer wasnt having any problems until o2k3 was installed.
..continuing to look at this. please update this if you find something.
http://forums.viaarena.com/messageview.cfm?catid=13&threadid=52978
They appear to be fighting the same battle. They are thinking the a MS critical update might be the problem. I cant say for certain if this applies to my issue but my SUS server recently has published several updates one of which does change the ntdll.dll file. The update seemed to rev. the dll from .1106 to .1217. I am not sure if its the dll or the application calling it that may be the problem. I know that this computer wasnt having any problems until o2k3 was installed.
..continuing to look at this. please update this if you find something.
gl_3n2k3
Not sure if I caught your problem fully but, just for your info, there is a known issue with Office 2000 SR3 whereby specific applications "red-line" and consume all available resources. It MAY relate to your situation.
Paraphrased from an article http://woodyswatch.com/office/index.asp which seems to be gone now (sorry about the formatting, it's pasted from an email):
OFFICE 2000 SERVICE PACK 3
Microsoft fixed the problem with Outlook 2000 Service Pack 3 red-lining, as expected, in late December. Every bit of feedback I've heard has been positive. So I'm strongly
recommending that all of you Office 2000 users upgrade to Service Pack 3.
Before you take the plunge, check out the information at
http://support.microsoft.com/?kbid=811167
Although it may be difficult to wade through the gobbledygook, that Knowledge Base
article tells you about a big bug in Service Pack 3. Most people won't hit it. But if you
install Service Pack 3, then start Outlook 2000, there's a small chance that Outlook will "red line" - run up to 100% processor utilization. Not to worry, though. If you red line, there's a fix.
If you don't already have Office 2000 Service Release 1 installed (it's probably identified as "Outlook 2000 SR-1a" or something similar in Help | About), you need to install SR-1 before you can install SP-3. For info about Service Release 1, see
http://office.microsoft.com/downloads/2000/o2ksr1ddl.aspx
Please note: The installation process for SR-1a will not indicate that SR-1a is installing. The installation dialog remains SR-1.
After SR-1a updates your installation of Office, you will need to restart your computer and reinstall MSI2 (Windows Installer 2.0), or re-insert your SR-1 CD to update Internet Explorer for optimal performance with Office 2000.
The rollback feature of the SR-1/SR-1a Update is designed to restore your system to its pre-SR-1/SR-1a Update state, in case you cancel the update process or the Windows Installer reports a non-fatal error. Rollback will not function if your computer loses power, or if there is a fatal error in the installation process. If your hard disk does not have enough free disk space to support rollback, you will be asked whether you want to continue installation of the SR-1/SR-1a Update without rollback.
Got SR-1 or SR-2? Good. Download Service Pack 3 from
http://download.microsoft.com/download/office2000/sp/3/win98mexp/en-us/o2ksp3.exe
saving the file some place that's convenient. After it's downloaded (13 MB ), get your original Office 2000 CDs handy, and run it.
Immediately after you have it going, flip over to that Knowledge Base article at
http://support.microsoft.com/?kbid=811167
download and install the red-lining patch. That should get you covered.
Don't forget to use Ken Slovak's ATTOPT utility to make Outlook show you all the files
that are attached to inbound email messages
http://www.slovaktech.com/attachmentoptions.htm#downloadenglish
And be sure to install the Word Field Security Manager - Woody's Goody #1 at
http://www.woodyswatch.com/office/archtemplate.asp?v7-n56
--------------------------
Outlook Update Only
http://download.microsoft.com/download/f/1/d/f1d8421a-2b76-4603-808b-39d8dcc74038/Olk0901.exe
Windows Installer 2.0 Update Requirements
The installation of the update that is described in this article requires Windows Installer 2.0 or later. Microsoft Windows 2000 Service Pack 3 (SP-3) includes this version of the Windows Installer. To install the latest version of the Windows Installer, visit one of the following Microsoft Web sites:
Windows Installer for Microsoft Windows 95, Microsoft Windows 98, and Windows Millenium Edition (Me): (Note: There is no uninstall feature with this download).
http://www.microsoft.com/downloads/release.asp?releaseid=32831
http://download.microsoft.com/download/WindowsInstaller/Install/2.0/W9XMe/EN-US/InstMsiA.exe
When you apply a patch for an existing program that was installed with the Windows Installer, you may be prompted for the source files from the original installation. You are prompted to provide the source files from the original disk even if they are not needed for the actual patch.
Being prompted for the source when no files are being reinstalled is due to a bug in the Windows Installer patching algorithm.
RESOLUTION
When you perform the original installation from a network drive, Windows Installer can locate the files needed. However, the network location must be available when you apply the patch so that the source files can be found. Also, if you performed the original installation from a CD-ROM and the disc is still available, insert the CD-ROM disc when prompted.
To configure Outlook 2000 to run in IMO mode, follow these steps:
Start Outlook 2000.
On the Tools menu, click Options.
On the Mail Services tab, click Reconfigure Mail Support.
In the E-Mail Service Options dialog box, click Internet Only, and then click Next.
Read the warning message, and then click Yes. Outlook 2000 quits.
Start Outlook 2000. The Windows Installer starts and installs the required files.
How to Determine Whether the Update is Installed
The update contains updated versions of the following files:
File name Version
-------------------------
Omi9.dll 5.5.3186.0
Omint.dll 5.5.3186.0
To determine the version of Outlook that is installed on your computer, follow these steps.
Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.
Click Start, and then click Search.
In the Search Results pane, click All files and folders under Search Companion.
In the All or part of the file name box, type the following text that is appropriate for your version of Windows, and then click Search.
For Microsoft Windows 98 or Microsoft Windows Millenium Edition (Me):
omi9.dll
In the list of files, right-click omint.dll or omi9.dll, and then click Properties.
On the Version tab, determine the version of Outlook that is installed on your computer.
NOTE: If the update is already installed on your computer, you receive the following message when you try to install the update.
This update has already been applied or is included in an update that has already been applied.
See also http://www.microsoft.com/office/ork/2000/appndx/toolbox.htm#02sr1wrkbk
for individual tools in Resource Kit Toolbox.
Not sure if I caught your problem fully but, just for your info, there is a known issue with Office 2000 SR3 whereby specific applications "red-line" and consume all available resources. It MAY relate to your situation.
Paraphrased from an article http://woodyswatch.com/office/index.asp which seems to be gone now (sorry about the formatting, it's pasted from an email):
OFFICE 2000 SERVICE PACK 3
Microsoft fixed the problem with Outlook 2000 Service Pack 3 red-lining, as expected, in late December. Every bit of feedback I've heard has been positive. So I'm strongly
recommending that all of you Office 2000 users upgrade to Service Pack 3.
Before you take the plunge, check out the information at
http://support.microsoft.com/?kbid=811167
Although it may be difficult to wade through the gobbledygook, that Knowledge Base
article tells you about a big bug in Service Pack 3. Most people won't hit it. But if you
install Service Pack 3, then start Outlook 2000, there's a small chance that Outlook will "red line" - run up to 100% processor utilization. Not to worry, though. If you red line, there's a fix.
If you don't already have Office 2000 Service Release 1 installed (it's probably identified as "Outlook 2000 SR-1a" or something similar in Help | About), you need to install SR-1 before you can install SP-3. For info about Service Release 1, see
http://office.microsoft.com/downloads/2000/o2ksr1ddl.aspx
Please note: The installation process for SR-1a will not indicate that SR-1a is installing. The installation dialog remains SR-1.
After SR-1a updates your installation of Office, you will need to restart your computer and reinstall MSI2 (Windows Installer 2.0), or re-insert your SR-1 CD to update Internet Explorer for optimal performance with Office 2000.
The rollback feature of the SR-1/SR-1a Update is designed to restore your system to its pre-SR-1/SR-1a Update state, in case you cancel the update process or the Windows Installer reports a non-fatal error. Rollback will not function if your computer loses power, or if there is a fatal error in the installation process. If your hard disk does not have enough free disk space to support rollback, you will be asked whether you want to continue installation of the SR-1/SR-1a Update without rollback.
Got SR-1 or SR-2? Good. Download Service Pack 3 from
http://download.microsoft.com/download/office2000/sp/3/win98mexp/en-us/o2ksp3.exe
saving the file some place that's convenient. After it's downloaded (13 MB ), get your original Office 2000 CDs handy, and run it.
Immediately after you have it going, flip over to that Knowledge Base article at
http://support.microsoft.com/?kbid=811167
download and install the red-lining patch. That should get you covered.
Don't forget to use Ken Slovak's ATTOPT utility to make Outlook show you all the files
that are attached to inbound email messages
http://www.slovaktech.com/attachmentoptions.htm#downloadenglish
And be sure to install the Word Field Security Manager - Woody's Goody #1 at
http://www.woodyswatch.com/office/archtemplate.asp?v7-n56
--------------------------
Outlook Update Only
http://download.microsoft.com/download/f/1/d/f1d8421a-2b76-4603-808b-39d8dcc74038/Olk0901.exe
Windows Installer 2.0 Update Requirements
The installation of the update that is described in this article requires Windows Installer 2.0 or later. Microsoft Windows 2000 Service Pack 3 (SP-3) includes this version of the Windows Installer. To install the latest version of the Windows Installer, visit one of the following Microsoft Web sites:
Windows Installer for Microsoft Windows 95, Microsoft Windows 98, and Windows Millenium Edition (Me): (Note: There is no uninstall feature with this download).
http://www.microsoft.com/downloads/release.asp?releaseid=32831
http://download.microsoft.com/download/WindowsInstaller/Install/2.0/W9XMe/EN-US/InstMsiA.exe
When you apply a patch for an existing program that was installed with the Windows Installer, you may be prompted for the source files from the original installation. You are prompted to provide the source files from the original disk even if they are not needed for the actual patch.
Being prompted for the source when no files are being reinstalled is due to a bug in the Windows Installer patching algorithm.
RESOLUTION
When you perform the original installation from a network drive, Windows Installer can locate the files needed. However, the network location must be available when you apply the patch so that the source files can be found. Also, if you performed the original installation from a CD-ROM and the disc is still available, insert the CD-ROM disc when prompted.
To configure Outlook 2000 to run in IMO mode, follow these steps:
Start Outlook 2000.
On the Tools menu, click Options.
On the Mail Services tab, click Reconfigure Mail Support.
In the E-Mail Service Options dialog box, click Internet Only, and then click Next.
Read the warning message, and then click Yes. Outlook 2000 quits.
Start Outlook 2000. The Windows Installer starts and installs the required files.
How to Determine Whether the Update is Installed
The update contains updated versions of the following files:
File name Version
-------------------------
Omi9.dll 5.5.3186.0
Omint.dll 5.5.3186.0
To determine the version of Outlook that is installed on your computer, follow these steps.
Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.
Click Start, and then click Search.
In the Search Results pane, click All files and folders under Search Companion.
In the All or part of the file name box, type the following text that is appropriate for your version of Windows, and then click Search.
For Microsoft Windows 98 or Microsoft Windows Millenium Edition (Me):
omi9.dll
In the list of files, right-click omint.dll or omi9.dll, and then click Properties.
On the Version tab, determine the version of Outlook that is installed on your computer.
NOTE: If the update is already installed on your computer, you receive the following message when you try to install the update.
This update has already been applied or is included in an update that has already been applied.
See also http://www.microsoft.com/office/ork/2000/appndx/toolbox.htm#02sr1wrkbk
for individual tools in Resource Kit Toolbox.
wow. great reply. I read lots of references to o2k sp-x or sr-x. My only problem with that is the machine wasn't using o2k rather oxp. I am finding a lot of people having this very same issue. Some indicating they were able to fix the problem by removing spybot. My problem with that is that spybot isnt installed nor any other spyware program. I have removed O2K3 several times and installed it using group policy, install point, and the CD and all have the same problem. If I right click the outlook icon I get all those explorer.exe application errors. I began to think that maybe it was a critical update that rev'd the ntdll.dll. I uninstalled 826939 which downgraded the rev but my problem remained. I am stumped.
I am going to try using office removal tool to see if that fixes the problem. If I ok the errors everything works fine until i have to right-click properties again on the desktop icon. As many people have indicated my screen flashes (refreshes) and I lose icons out of the system tray. bizarre. i am not going to reformat because I dont think that will fix the problem besides I want to know what is causing it.
....thanks for the information. I will post if I figure something out or find something.
I am going to try using office removal tool to see if that fixes the problem. If I ok the errors everything works fine until i have to right-click properties again on the desktop icon. As many people have indicated my screen flashes (refreshes) and I lose icons out of the system tray. bizarre. i am not going to reformat because I dont think that will fix the problem besides I want to know what is causing it.
....thanks for the information. I will post if I figure something out or find something.
No prob's, gl_3n2k3, hope you resolve it.
I am having the same issue. It mainly happens when I try to do a properties of files on a network share or after I play .avi files. I found a few things that mentioned trying a duser.dll patch (MS) and downgrading the Nvidia drivers. The MS patch didn't seem to help and haven't tried the driver rollback yet. It's more annoying than anything, not really system crashing, yet...
I'll keep you posted if I find any other tricks
I'll keep you posted if I find any other tricks
Hey people. Have anyone of you found a real solution to this problem already? I am having exactly these problems, the error message for e.g. ntdll.dll (and other .dll files), computer freezing. I have also tried to format my harddrive (even bought a new one), but the problem still continues. On my computer I have Antivir v.6 and Adaware SE. Please post some updates if you feel you have found any possible solutions.
-Jim
-Jim
ASKER
Hey jim i still have yet to figure out what the issue was, im thinking it was a driver issue that was making the ntdll.dll crash all the time, do u have a radeon gfx card? Its possible its the drivers for any hardware u have on ur pc.. try updating them possibly? Let me know if that helps..
Chris.
Chris.
Try using this freeware application to determine which program(s) is(are) are associated with this dll, then reinstall the software(s).
http://www.sysinternals.com/ntw2k/freeware/procexp.shtml