Solved

NTDLL.DLL C0000221 Unknown Hard Error

Posted on 2008-06-24
34
2,975 Views
Last Modified: 2008-06-26
I can't turn on my laptop . I am getting this BSOD with "Stop: c0000221 unknown Hard Error \SystemRoot\System32\ntdll.dll"  I Thought the problem will be fixed because I was able to replace the supposedly corrupted file and put this new ntdll.dll from another pc that runs windows xp professional to this laptop.  but when I run the laptop, the problem is still there.  The same BSOD with the same ntdll.dll error msg.  My laptop description is:

Gateway Model No. MX6440  MA3
Hard Drive Hitachi Travelstar Model No:  HTS541010G9AT00 ATA/IDE
OS: Windows XP Home Edtion
0
Comment
Question by:alopez1104
  • 18
  • 15
34 Comments
 
LVL 7

Expert Comment

by:Christopher Martinez
Comment Utility
This error results from inproper install of device drivers. Attempt to reinstall xp if fixing the .dll replaced still doesnt work. Generally replacing that file should fix this issue. It may be a harddrive problem if its not fixed. If you happen to have a iomega drive plugged in, unplug it. According to microsoft a iomega drive sharing a IDE cable will cause this.
0
 

Author Comment

by:alopez1104
Comment Utility
By the way, when I selected the system recovery during boot up F11, I got an error STOP: 0x00000007B (0xF79FE640, parameter, parameter, parameter).  "A problem has been detected and windows has been shut down to prevent damage to your computer. "  Also, I did not download any software to install or even install any new hardware.  I believe my pc got infected with boot virus because this laptop does not have an antivirus software.  

I removed this HD and was able to read the files from another PC which I was also able to put a new ntdll file on the systems folder.  What is iomega drive ?
0
 

Author Comment

by:alopez1104
Comment Utility
By the way, getting the file ntdll.dll from xp pro to xp home is that okay?
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
I read about 30 articles about this, the common issue is a failing hard drive, or IDE cable. It is pretty much impossible to test the cable, unless you can get an OEM one.

I would recommend installing the hard drive in a desktop computer, and run some diagnostic tests on it. You are going to need a laptop style IDE - normal IDE adapter/cable. There are kits meant for installing a notebook hard drive in a desktop, like this:



http://www.amazon.com/Cables-Go-17705-Laptop-Adapter/dp/B000067RRQ/ref=sr_1_1?ie=UTF8&s=electronics&qid=1214337895&sr=8-1



If you can verify that the drive is going out, just copy over all your data (if you still can) and get a new drive. If it isn't the drive, it could be your motherboard... report back and we'll see!
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
>>>>By the way, getting the file ntdll.dll from xp pro to xp home is that okay?

Not sure, should be ok

>>>What is iomega drive ?

Iomega Zip Drive, comes in 100MB, 250MB. Pretty old, almost never used anymore. Your laptop almost certainly does not have one.

>>>>I believe my pc got infected with boot virus because this laptop does not have an antivirus software.  

In this case you are going to want to copy off all your data, format sector 0, MBR, then re-partition. You will need a utility CD to do this.
0
 

Author Comment

by:alopez1104
Comment Utility
>>>>I would recommend installing the hard drive in a desktop computer, and run some diagnostic tests on it. You are going to need a laptop style IDE - normal IDE adapter/cable. There are kits meant for installing a notebook hard drive in a desktop, like this:<<<<<

Yes, I did this already.  I connected the hard drive to my desktop and was able to read all the files and that was the reason why I was able to copy the ntdll.dll from the xp pro desktop to the Harddrive of the Laptop with XP Home Ed.

 
0
 

Author Comment

by:alopez1104
Comment Utility
I am currenlty running the avast on the desktop to scan this HD and found so many trojans.  I'll let you know once this is done and reconnected the HD to the laptop.  Hopefully, it wil make a difference.
0
 

Author Comment

by:alopez1104
Comment Utility
I was able to remove the viruses on this HD, but the problem is still the same.  I am still getting the NTDLL.DLL error.  Also, I want to save whatever documents I have on the Owner's folder but when I clicked on it, it's restricted, why is that?  Please let me know what should I do next.  Thanks.
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
>>>>>>>I want to save whatever documents I have on the Owner's folder but when I clicked on it, it's restricted, why is that?

I assume you are talking about when the hard drive is hooked into your desktop. You are getting this error because the ownership is set to a security principal that exists on your laptop only. You need to "take ownership" of the folder:
taking ownership:
http://support.microsoft.com/kb/308421

Once you have done that, make a security principal for that folder assigned to "everyone" and add full control. You can now copy off all your data to the desktop, and do a full wipe of that disk (I would recommend a full wipe of the drive, including sector 0 and MBR). Once you have done that you can reintroduce the drive to the laptop, and reinstall windows from scratch, virus-free.
0
 

Author Comment

by:alopez1104
Comment Utility
alikaz3, do you mean reformat the HD? I don't know what you mean about sector 0 or MBR?
0
 

Author Comment

by:alopez1104
Comment Utility
It's weird that this Owner's Folder only has two tabs when I clicked on the properties (General and Customize).  Nothing that says Security?  The All Users folder has this option, but of course, there are no files there?
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
ok let me give some more information about partitions/disk structure. Here's two example disk structures:

[MBR][Partition1---------------------][Partition2----------------------][Partition3------]
[MBR][Partition1------------------------------------------------------------------------------]

Most of the time, a reformat means formatting a partition only, which is not a complete reformat. You mentioned the possibility of a boot sector virus. If I was diagnosing this on one of my machines, because of the amount of time required to do a full reinstall/reconfiguration of the system, I'll take a bit more time before reinstalling to make sure to clear out that MBR. You will NOT be able to do this after you have installed windows, as it will probably mess up your partition structure (and that's assuming the boot sector virus doesn't replicate to your C: partition right away).

You'll delete your partition, and then the MBR using something like FDISK /mbr, outlined here: http://support.microsoft.com/kb/69013. You are going to want to do this from your desktop, and be extra careful to not do it to the desktop's hard drive. You can do this from the xp recovery console (this is the safest way - booted off the laptop with an XP cd). Once this is done, you can reboot off the cd, and proceed with your windows installation. Here's the instructions for fdisk: http://support.microsoft.com/kb/255867

And of course get your drivers on hand before starting. Let me know if you need more help!
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
>>>>>>>>>>>It's weird that this Owner's Folder only has two tabs when I clicked on the properties (General and Customize).  Nothing that says Security?  The All Users folder has this option, but of course, there are no files there?

That is weird.... Try taking ownership of the whole drive, and let it propogate to all subfolders (it will ask you).
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
It could also be that you have simple file sharing enabled:

open a folder>tools> folder options> view tab> scroll to bottom > uncheck "use simple file sharing"
0
 

Author Comment

by:alopez1104
Comment Utility
It seems like if I am connected to our network, and logged on as regular user, I would not be able to change the security settings on this E: drive that has that Owner's folder, it's disabled.  What if I disconnect my ethernet and log on as local user, maybe I can then modify the security setting?
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
>>>It seems like if I am connected to our network, and logged on as regular user.

So you're logged onto a domain as a regular user? You are going to need to be a local administrator to accomplish this; so yes, try that.
0
 

Author Comment

by:alopez1104
Comment Utility
Okay, I was able to backup all the files from the Owner's folder. thank you.  Now, going back to formatting.. since full reinstallation takes longer, you suggested to first clear out the MBR because of the possible boot sector virus.  You said DELETE the partition and then the MBR using the FDISK /mbr, what is FDISK? Where will I get this?  By the way, this laptop HD has two partitions F: (recovery partition) and E: (Local Disk - document and settings, etc. ), do I have to reformat these partitions? Can you please tell me step by step what to do next.  now that the files are all safe and currently the HD is hooked up to the desktop.  I'll be waiting for your instructions, thanks.

0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
Ok this is an issue - you have a recovery partition. You SHOULD use that partition, to get your system recovered to it's initial state. The reason for this is that the recovered install will include all your drivers, plus any useful programs that might have been included (plus all the crapware). Did your system come with a restore CD? Or did it come with a regular XP home disk? Let me know and we will proceed.
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
I forgot to say that the restore partition will also reinstall the XP OEM activation data + Volume License Key that corresponds to the XP Home license that was included with your system. Using a standard XP disk, will require a CD-Key, which could cause a problem. I await your answers
0
 

Author Comment

by:alopez1104
Comment Utility
by the way this is my sister's laptop and I asked her about those cds, unfortunately, she could not find any of those.  the only cd I have is the xp pro which I can provide the cd key.

>>Did your system come with a restore CD? Or did it come with a regular XP home disk? Let me know and we will proceed.<<< as of this time, my sister said she could not find any of these? can we still proceed?How?
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
Ok here's the issues:

1. You could use your XP Pro CD and key, but unless that is a new unused key that you want to assign to this machine, you won't be able to use it. Once you go to do windows update it will ask you to activate, and if the key is already activated, you cannot proceed.

2. You could try "FIXMBR"
>>Fixmbr repairs the startup partition's master boot code. The variable device is an optional name that specifies the device that requires a new Master Boot Record. Omit this variable when the target is the startup device.
But I'm not sure if this will take care of the possible boot sector virus. Also, it may "break" your restore option. I know DELL system use a proprietary MBR structure that is required for the system to be able to restore. If you were to FIXMBR on a dell, it can't restore.

Basically - with this system, you are a slave to the restore partition. Lets rethink our approach here, what makes you think you have a boot sector virus?
0
 

Author Comment

by:alopez1104
Comment Utility
I think, when I said boot sector virus is when I tried to reinstall the windows xp, I got the stop msg. STOP: 0x00000007B (0xF79FE640, parameter, parameter, parameter).  "A problem has been detected and windows has been shut down to prevent damage to your computer with many suggestions why I rec'd the stop error including the possibility of having a virus.  so i am not definitely sure if that is the case.  But you know, I run the AVAST and scanned this HD and found so many trojans and was able to delete it.  

Regarding the XP Pro CD, I think I can still use it because I did use this before and basically installed this to two of my pcs with no problem.  I don't know.  Please let me know the next step, thank you.
0
 

Author Comment

by:alopez1104
Comment Utility
I spoke to the Gateway technician and he suggested for me to do the sfc scannow method.  He first asked me if I still have the recovery partition, and I said yes, and it is on the F: drive.   He said that using this method will scan the corrupt file and will be replaced.  He said to do this, go to the RUN box and type in sfc /scannow...this window will immediately initiate the Windows File Protection Service to scan all protected files and verify their integrity, replacing any files with which it finds a problem.   He also said to disconnect any third party software that is connected to the system.

The question is how will I start this sfc scannow.  My Network Administrator disabled the RUN function.  I have to do this run on the DOS CMD screen but don't know exactly how.  Another thing is the HD is currently hooked up to the desktop, will I then run that sfc scan from the desktop, obviously, I can't do this on the laptop.

He said that worst comes to worst I can order the recovery cd.  

Please help, thanks.
0
 

Author Comment

by:alopez1104
Comment Utility
If I have the recovery partition on the F: then how can I tell the laptop to boot on the F: drive? should I reformat the E: drive?
0
 
LVL 12

Accepted Solution

by:
alikaz3 earned 500 total points
Comment Utility
>>>>>>>>I think, when I said boot sector virus is when I tried to reinstall the windows xp, I got the stop msg. STOP: 0x00000007B (0xF79FE640, parameter, parameter, parameter).

The 7B stop message means inaccessible boot device. And you stated that you were doing the F11 to restore, which invokes your restore partition.

>>>>>>The question is how will I start this sfc scannow.

I don't think you can do it with the XP Pro CD, as you have XP Home. Can you boot into safe mode? If you can get into safe mode, you just need to get to a command prompt, and type sfc /scannow.

>>>>My Network Administrator disabled the RUN function.  I have to do this run on the DOS CMD screen but don't know exactly how

You should be able to right click the desktop > new > shortcut. When it asks for the "location" just type in cmd, name it whatever, and hit ok. double click the new icon now, and you are at your command prompt.


>>>> Another thing is the HD is currently hooked up to the desktop, will I then run that sfc scan from the desktop, obviously, I can't do this on the laptop.

Unfortunately you have to run this on the laptop (it is running SFC on the boot drive). If you can't get into safe mode, or find an XP Home disk, then I don't think it is possible.


>>>>Regarding the XP Pro CD, I think I can still use it because I did use this before and basically installed this to two of my pcs with no problem.

Even if it does work, it is not legal. One CD key per computer, unless it is a special Volume License Key that you purchased through a Microsoft Rep (I'm pretty sure this isn't what you have).

>>>>>>He said that worst comes to worst I can order the recovery cd.  

Unfortunately, that is the only legitimate way to reinstall windows using the license that was included with your laptop. You could always buy another license and put it on there... but with the cost being around $140 for XP pro, and brand new laptops as low as $399, I would say that's crazy.


Let me know your status and we can keep working on this, sorry for my late reply!
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
>>>>>If I have the recovery partition on the F: then how can I tell the laptop to boot on the F: drive? should I reformat the E: drive?

You had it boot off the F: drive before when you hit F11 and got your error. No you shouldn't reformat the E: drive.


I have another question, has windows ever been reinstalled on this machine before, with a CD? If so, that could have broken your recovery functionality. There are ways to "fix" it, but the only easy way is to order that recovery CD. This is a last resort, lets make sure we try everything before paying more :D
0
 

Author Comment

by:alopez1104
Comment Utility
>>>I have another question, has windows ever been reinstalled on this machine before, with a CD? If so, that could have broken your recovery functionality. There are ways to "fix" it, but the only easy way is to order that recovery CD. This is a last resort, lets make sure we try everything before paying more :D<<<<<<

Basically, before I discover about the PF11, I was trying to install the XP Pro, but then in the middle of the installation, I got the same error as I hit the PF11 and unable to install it.
0
 

Author Comment

by:alopez1104
Comment Utility
>>>>My Network Administrator disabled the RUN function.  I have to do this run on the DOS CMD screen but don't know exactly how

You should be able to right click the desktop > new > shortcut. When it asks for the "location" just type in cmd, name it whatever, and hit ok. double click the new icon now, and you are at your command prompt.<<<<<<<<<

I was able to create a DOS CMD short cut, what is the convention name or script to do the RUN cmd?

Also, what will be our last resort regarding this NTDLL.DLL?
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
>>>>Basically, before I discover about the PF11, I was trying to install the XP Pro, but then in the middle of the installation, I got the same error as I hit the PF11 and unable to install it.

When you did this, it may have broken the restore functionality.

>>>I was able to create a DOS CMD short cut, what is the convention name or script to do the RUN cmd?

The run command is only used to get to your Command Prompt. Since you made the shortcut, you are already there. once it is open, type: SFC /SCANNOW    and let it proceed through the whole operation. Reboot and see if it fixed it

>>>>>Also, what will be our last resort regarding this NTDLL.DLL?

I was talking about ordering the restore CD. If we can't get anything to work, your best solution will be to order that disk, totally wipe out the drive (deleting all partitions), and have the CD reconfigure your system (it will restore the HDD to the exact state it was in when you first bought the laptop).
0
 

Author Comment

by:alopez1104
Comment Utility
I was able to test the run command, it's all good.  I ordered the recovery cd and I should get the within 10 days.  so I guess we cannot proceed anymore until I install the cd.  i will just wipe out all the partitions by reformatting it.
0
 

Author Comment

by:alopez1104
Comment Utility
By the way, I am just curious, can i do the sfc scannow from the desktop?  I mean, run the cmd screen, change the C: promt to F: and then sfcscan?

0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
I don't think you can. From what I understand, SFC fixes the current active windows directory - which means you can't do f:

I may be wrong though...
0
 
LVL 12

Expert Comment

by:alikaz3
Comment Utility
That's good you got the restore disk coming, It should just work. If it doesn't, you will probably need to wipe out the MBR like we discussed before, then run the restore disk. I would say close this question up, 10 days is a really long time to leave it open. If you still have issues after it is closed, my email is in my profile. Good luck!
0
 

Author Comment

by:alopez1104
Comment Utility
Hi alikaz3,

I was wondering if you could help me again because I have the recovery cd and about to reinstall it but I got a bsod.  The msg says,

"A problem has been detected and windows has been shut down to prevent damage to your computer.  If this is the first time you've seen this stop error screen, restart your computer.  If this screen appears again , follow these steps:  Check to be sure you have adequate disk space.  If a driver is identified in the stop message, disable the driver or check with the manufacturer for driver updates, Try changing video adapters.  Check with you hardware vendor for any BIOS updates.  Disable BIOS memory options such as caching or shadowing.  If yo need to use safe mode to remove or disable components, restart your computer, press F8 to select advanced startup options, and then select safe mode.  Technical Information: ****STOP: 0xc0000005, 0x0000000, 0xF79FE140, 0xF79FDE40).

Please let me know if I should open a new ticket.  thanks.
 
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

As the title indicates, I have done this before. It chills me everytime I update the OS on my phone, (http://www.experts-exchange.com/articles/18084/Upgrading-to-Android-5-0-Lollipop.html) because one time I did this and I essentially had a bricked …
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now