Solved

NTDLL.DLL C0000221 Unknown Hard Error

Posted on 2008-06-24
34
2,977 Views
Last Modified: 2008-06-26
I can't turn on my laptop . I am getting this BSOD with "Stop: c0000221 unknown Hard Error \SystemRoot\System32\ntdll.dll"  I Thought the problem will be fixed because I was able to replace the supposedly corrupted file and put this new ntdll.dll from another pc that runs windows xp professional to this laptop.  but when I run the laptop, the problem is still there.  The same BSOD with the same ntdll.dll error msg.  My laptop description is:

Gateway Model No. MX6440  MA3
Hard Drive Hitachi Travelstar Model No:  HTS541010G9AT00 ATA/IDE
OS: Windows XP Home Edtion
0
Comment
Question by:alopez1104
  • 18
  • 15
34 Comments
 
LVL 7

Expert Comment

by:Christopher Martinez
ID: 21859734
This error results from inproper install of device drivers. Attempt to reinstall xp if fixing the .dll replaced still doesnt work. Generally replacing that file should fix this issue. It may be a harddrive problem if its not fixed. If you happen to have a iomega drive plugged in, unplug it. According to microsoft a iomega drive sharing a IDE cable will cause this.
0
 

Author Comment

by:alopez1104
ID: 21859813
By the way, when I selected the system recovery during boot up F11, I got an error STOP: 0x00000007B (0xF79FE640, parameter, parameter, parameter).  "A problem has been detected and windows has been shut down to prevent damage to your computer. "  Also, I did not download any software to install or even install any new hardware.  I believe my pc got infected with boot virus because this laptop does not have an antivirus software.  

I removed this HD and was able to read the files from another PC which I was also able to put a new ntdll file on the systems folder.  What is iomega drive ?
0
 

Author Comment

by:alopez1104
ID: 21859823
By the way, getting the file ntdll.dll from xp pro to xp home is that okay?
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21859868
I read about 30 articles about this, the common issue is a failing hard drive, or IDE cable. It is pretty much impossible to test the cable, unless you can get an OEM one.

I would recommend installing the hard drive in a desktop computer, and run some diagnostic tests on it. You are going to need a laptop style IDE - normal IDE adapter/cable. There are kits meant for installing a notebook hard drive in a desktop, like this:



http://www.amazon.com/Cables-Go-17705-Laptop-Adapter/dp/B000067RRQ/ref=sr_1_1?ie=UTF8&s=electronics&qid=1214337895&sr=8-1



If you can verify that the drive is going out, just copy over all your data (if you still can) and get a new drive. If it isn't the drive, it could be your motherboard... report back and we'll see!
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21859905
>>>>By the way, getting the file ntdll.dll from xp pro to xp home is that okay?

Not sure, should be ok

>>>What is iomega drive ?

Iomega Zip Drive, comes in 100MB, 250MB. Pretty old, almost never used anymore. Your laptop almost certainly does not have one.

>>>>I believe my pc got infected with boot virus because this laptop does not have an antivirus software.  

In this case you are going to want to copy off all your data, format sector 0, MBR, then re-partition. You will need a utility CD to do this.
0
 

Author Comment

by:alopez1104
ID: 21860525
>>>>I would recommend installing the hard drive in a desktop computer, and run some diagnostic tests on it. You are going to need a laptop style IDE - normal IDE adapter/cable. There are kits meant for installing a notebook hard drive in a desktop, like this:<<<<<

Yes, I did this already.  I connected the hard drive to my desktop and was able to read all the files and that was the reason why I was able to copy the ntdll.dll from the xp pro desktop to the Harddrive of the Laptop with XP Home Ed.

 
0
 

Author Comment

by:alopez1104
ID: 21861404
I am currenlty running the avast on the desktop to scan this HD and found so many trojans.  I'll let you know once this is done and reconnected the HD to the laptop.  Hopefully, it wil make a difference.
0
 

Author Comment

by:alopez1104
ID: 21866808
I was able to remove the viruses on this HD, but the problem is still the same.  I am still getting the NTDLL.DLL error.  Also, I want to save whatever documents I have on the Owner's folder but when I clicked on it, it's restricted, why is that?  Please let me know what should I do next.  Thanks.
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21867266
>>>>>>>I want to save whatever documents I have on the Owner's folder but when I clicked on it, it's restricted, why is that?

I assume you are talking about when the hard drive is hooked into your desktop. You are getting this error because the ownership is set to a security principal that exists on your laptop only. You need to "take ownership" of the folder:
taking ownership:
http://support.microsoft.com/kb/308421

Once you have done that, make a security principal for that folder assigned to "everyone" and add full control. You can now copy off all your data to the desktop, and do a full wipe of that disk (I would recommend a full wipe of the drive, including sector 0 and MBR). Once you have done that you can reintroduce the drive to the laptop, and reinstall windows from scratch, virus-free.
0
 

Author Comment

by:alopez1104
ID: 21867588
alikaz3, do you mean reformat the HD? I don't know what you mean about sector 0 or MBR?
0
 

Author Comment

by:alopez1104
ID: 21867670
It's weird that this Owner's Folder only has two tabs when I clicked on the properties (General and Customize).  Nothing that says Security?  The All Users folder has this option, but of course, there are no files there?
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21867747
ok let me give some more information about partitions/disk structure. Here's two example disk structures:

[MBR][Partition1---------------------][Partition2----------------------][Partition3------]
[MBR][Partition1------------------------------------------------------------------------------]

Most of the time, a reformat means formatting a partition only, which is not a complete reformat. You mentioned the possibility of a boot sector virus. If I was diagnosing this on one of my machines, because of the amount of time required to do a full reinstall/reconfiguration of the system, I'll take a bit more time before reinstalling to make sure to clear out that MBR. You will NOT be able to do this after you have installed windows, as it will probably mess up your partition structure (and that's assuming the boot sector virus doesn't replicate to your C: partition right away).

You'll delete your partition, and then the MBR using something like FDISK /mbr, outlined here: http://support.microsoft.com/kb/69013. You are going to want to do this from your desktop, and be extra careful to not do it to the desktop's hard drive. You can do this from the xp recovery console (this is the safest way - booted off the laptop with an XP cd). Once this is done, you can reboot off the cd, and proceed with your windows installation. Here's the instructions for fdisk: http://support.microsoft.com/kb/255867

And of course get your drivers on hand before starting. Let me know if you need more help!
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21867763
>>>>>>>>>>>It's weird that this Owner's Folder only has two tabs when I clicked on the properties (General and Customize).  Nothing that says Security?  The All Users folder has this option, but of course, there are no files there?

That is weird.... Try taking ownership of the whole drive, and let it propogate to all subfolders (it will ask you).
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21867776
It could also be that you have simple file sharing enabled:

open a folder>tools> folder options> view tab> scroll to bottom > uncheck "use simple file sharing"
0
 

Author Comment

by:alopez1104
ID: 21867922
It seems like if I am connected to our network, and logged on as regular user, I would not be able to change the security settings on this E: drive that has that Owner's folder, it's disabled.  What if I disconnect my ethernet and log on as local user, maybe I can then modify the security setting?
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21868130
>>>It seems like if I am connected to our network, and logged on as regular user.

So you're logged onto a domain as a regular user? You are going to need to be a local administrator to accomplish this; so yes, try that.
0
 

Author Comment

by:alopez1104
ID: 21868401
Okay, I was able to backup all the files from the Owner's folder. thank you.  Now, going back to formatting.. since full reinstallation takes longer, you suggested to first clear out the MBR because of the possible boot sector virus.  You said DELETE the partition and then the MBR using the FDISK /mbr, what is FDISK? Where will I get this?  By the way, this laptop HD has two partitions F: (recovery partition) and E: (Local Disk - document and settings, etc. ), do I have to reformat these partitions? Can you please tell me step by step what to do next.  now that the files are all safe and currently the HD is hooked up to the desktop.  I'll be waiting for your instructions, thanks.

0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 
LVL 12

Expert Comment

by:alikaz3
ID: 21868498
Ok this is an issue - you have a recovery partition. You SHOULD use that partition, to get your system recovered to it's initial state. The reason for this is that the recovered install will include all your drivers, plus any useful programs that might have been included (plus all the crapware). Did your system come with a restore CD? Or did it come with a regular XP home disk? Let me know and we will proceed.
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21868532
I forgot to say that the restore partition will also reinstall the XP OEM activation data + Volume License Key that corresponds to the XP Home license that was included with your system. Using a standard XP disk, will require a CD-Key, which could cause a problem. I await your answers
0
 

Author Comment

by:alopez1104
ID: 21868904
by the way this is my sister's laptop and I asked her about those cds, unfortunately, she could not find any of those.  the only cd I have is the xp pro which I can provide the cd key.

>>Did your system come with a restore CD? Or did it come with a regular XP home disk? Let me know and we will proceed.<<< as of this time, my sister said she could not find any of these? can we still proceed?How?
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21869150
Ok here's the issues:

1. You could use your XP Pro CD and key, but unless that is a new unused key that you want to assign to this machine, you won't be able to use it. Once you go to do windows update it will ask you to activate, and if the key is already activated, you cannot proceed.

2. You could try "FIXMBR"
>>Fixmbr repairs the startup partition's master boot code. The variable device is an optional name that specifies the device that requires a new Master Boot Record. Omit this variable when the target is the startup device.
But I'm not sure if this will take care of the possible boot sector virus. Also, it may "break" your restore option. I know DELL system use a proprietary MBR structure that is required for the system to be able to restore. If you were to FIXMBR on a dell, it can't restore.

Basically - with this system, you are a slave to the restore partition. Lets rethink our approach here, what makes you think you have a boot sector virus?
0
 

Author Comment

by:alopez1104
ID: 21870036
I think, when I said boot sector virus is when I tried to reinstall the windows xp, I got the stop msg. STOP: 0x00000007B (0xF79FE640, parameter, parameter, parameter).  "A problem has been detected and windows has been shut down to prevent damage to your computer with many suggestions why I rec'd the stop error including the possibility of having a virus.  so i am not definitely sure if that is the case.  But you know, I run the AVAST and scanned this HD and found so many trojans and was able to delete it.  

Regarding the XP Pro CD, I think I can still use it because I did use this before and basically installed this to two of my pcs with no problem.  I don't know.  Please let me know the next step, thank you.
0
 

Author Comment

by:alopez1104
ID: 21870585
I spoke to the Gateway technician and he suggested for me to do the sfc scannow method.  He first asked me if I still have the recovery partition, and I said yes, and it is on the F: drive.   He said that using this method will scan the corrupt file and will be replaced.  He said to do this, go to the RUN box and type in sfc /scannow...this window will immediately initiate the Windows File Protection Service to scan all protected files and verify their integrity, replacing any files with which it finds a problem.   He also said to disconnect any third party software that is connected to the system.

The question is how will I start this sfc scannow.  My Network Administrator disabled the RUN function.  I have to do this run on the DOS CMD screen but don't know exactly how.  Another thing is the HD is currently hooked up to the desktop, will I then run that sfc scan from the desktop, obviously, I can't do this on the laptop.

He said that worst comes to worst I can order the recovery cd.  

Please help, thanks.
0
 

Author Comment

by:alopez1104
ID: 21870622
If I have the recovery partition on the F: then how can I tell the laptop to boot on the F: drive? should I reformat the E: drive?
0
 
LVL 12

Accepted Solution

by:
alikaz3 earned 500 total points
ID: 21875715
>>>>>>>>I think, when I said boot sector virus is when I tried to reinstall the windows xp, I got the stop msg. STOP: 0x00000007B (0xF79FE640, parameter, parameter, parameter).

The 7B stop message means inaccessible boot device. And you stated that you were doing the F11 to restore, which invokes your restore partition.

>>>>>>The question is how will I start this sfc scannow.

I don't think you can do it with the XP Pro CD, as you have XP Home. Can you boot into safe mode? If you can get into safe mode, you just need to get to a command prompt, and type sfc /scannow.

>>>>My Network Administrator disabled the RUN function.  I have to do this run on the DOS CMD screen but don't know exactly how

You should be able to right click the desktop > new > shortcut. When it asks for the "location" just type in cmd, name it whatever, and hit ok. double click the new icon now, and you are at your command prompt.


>>>> Another thing is the HD is currently hooked up to the desktop, will I then run that sfc scan from the desktop, obviously, I can't do this on the laptop.

Unfortunately you have to run this on the laptop (it is running SFC on the boot drive). If you can't get into safe mode, or find an XP Home disk, then I don't think it is possible.


>>>>Regarding the XP Pro CD, I think I can still use it because I did use this before and basically installed this to two of my pcs with no problem.

Even if it does work, it is not legal. One CD key per computer, unless it is a special Volume License Key that you purchased through a Microsoft Rep (I'm pretty sure this isn't what you have).

>>>>>>He said that worst comes to worst I can order the recovery cd.  

Unfortunately, that is the only legitimate way to reinstall windows using the license that was included with your laptop. You could always buy another license and put it on there... but with the cost being around $140 for XP pro, and brand new laptops as low as $399, I would say that's crazy.


Let me know your status and we can keep working on this, sorry for my late reply!
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21875755
>>>>>If I have the recovery partition on the F: then how can I tell the laptop to boot on the F: drive? should I reformat the E: drive?

You had it boot off the F: drive before when you hit F11 and got your error. No you shouldn't reformat the E: drive.


I have another question, has windows ever been reinstalled on this machine before, with a CD? If so, that could have broken your recovery functionality. There are ways to "fix" it, but the only easy way is to order that recovery CD. This is a last resort, lets make sure we try everything before paying more :D
0
 

Author Comment

by:alopez1104
ID: 21875992
>>>I have another question, has windows ever been reinstalled on this machine before, with a CD? If so, that could have broken your recovery functionality. There are ways to "fix" it, but the only easy way is to order that recovery CD. This is a last resort, lets make sure we try everything before paying more :D<<<<<<

Basically, before I discover about the PF11, I was trying to install the XP Pro, but then in the middle of the installation, I got the same error as I hit the PF11 and unable to install it.
0
 

Author Comment

by:alopez1104
ID: 21876047
>>>>My Network Administrator disabled the RUN function.  I have to do this run on the DOS CMD screen but don't know exactly how

You should be able to right click the desktop > new > shortcut. When it asks for the "location" just type in cmd, name it whatever, and hit ok. double click the new icon now, and you are at your command prompt.<<<<<<<<<

I was able to create a DOS CMD short cut, what is the convention name or script to do the RUN cmd?

Also, what will be our last resort regarding this NTDLL.DLL?
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21876655
>>>>Basically, before I discover about the PF11, I was trying to install the XP Pro, but then in the middle of the installation, I got the same error as I hit the PF11 and unable to install it.

When you did this, it may have broken the restore functionality.

>>>I was able to create a DOS CMD short cut, what is the convention name or script to do the RUN cmd?

The run command is only used to get to your Command Prompt. Since you made the shortcut, you are already there. once it is open, type: SFC /SCANNOW    and let it proceed through the whole operation. Reboot and see if it fixed it

>>>>>Also, what will be our last resort regarding this NTDLL.DLL?

I was talking about ordering the restore CD. If we can't get anything to work, your best solution will be to order that disk, totally wipe out the drive (deleting all partitions), and have the CD reconfigure your system (it will restore the HDD to the exact state it was in when you first bought the laptop).
0
 

Author Comment

by:alopez1104
ID: 21877369
I was able to test the run command, it's all good.  I ordered the recovery cd and I should get the within 10 days.  so I guess we cannot proceed anymore until I install the cd.  i will just wipe out all the partitions by reformatting it.
0
 

Author Comment

by:alopez1104
ID: 21877411
By the way, I am just curious, can i do the sfc scannow from the desktop?  I mean, run the cmd screen, change the C: promt to F: and then sfcscan?

0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21877918
I don't think you can. From what I understand, SFC fixes the current active windows directory - which means you can't do f:

I may be wrong though...
0
 
LVL 12

Expert Comment

by:alikaz3
ID: 21877933
That's good you got the restore disk coming, It should just work. If it doesn't, you will probably need to wipe out the MBR like we discussed before, then run the restore disk. I would say close this question up, 10 days is a really long time to leave it open. If you still have issues after it is closed, my email is in my profile. Good luck!
0
 

Author Comment

by:alopez1104
ID: 22008897
Hi alikaz3,

I was wondering if you could help me again because I have the recovery cd and about to reinstall it but I got a bsod.  The msg says,

"A problem has been detected and windows has been shut down to prevent damage to your computer.  If this is the first time you've seen this stop error screen, restart your computer.  If this screen appears again , follow these steps:  Check to be sure you have adequate disk space.  If a driver is identified in the stop message, disable the driver or check with the manufacturer for driver updates, Try changing video adapters.  Check with you hardware vendor for any BIOS updates.  Disable BIOS memory options such as caching or shadowing.  If yo need to use safe mode to remove or disable components, restart your computer, press F8 to select advanced startup options, and then select safe mode.  Technical Information: ****STOP: 0xc0000005, 0x0000000, 0xF79FE140, 0xF79FDE40).

Please let me know if I should open a new ticket.  thanks.
 
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Issue: Unstable cursor in Windows XP and Windows runs extremely slow in that any click will bring up the Hour glass (sometimes for several seconds before giving you what you want) . Troubleshooting Process and the FINAL FIX: This issue see…
If you have done a reformat of your hard drive and proceeded to do a successful Windows XP installation, you may notice that a choice between two operating systems when you start up the machine. Here is how to get rid of this: Click Start Clic…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now