Link to home
Start Free TrialLog in
Avatar of Marshall Kass
Marshall KassFlag for United States of America

asked on

Windows 7 Pro - NTDLL.DLL error on NEW Installation

Hi all:
I have a DELL Studio XPS 435T/9000 (Early 2009).  It has 12GB RAM, (1) 480GB SSD & (1) 750GB SATA HDD, (1) BD RW + (1) DVD R/W.  It is running a I7-920 CPU.  There is also an ATI Radeon HD 570 and StarTech USB 3.0 7 port card (with nothing attached).

I was running into NTDLL.DLL errors whenever I launched certain programs, including IExplore, Chrome, and some other, non-internet related programs.  I never had an issue with FireFox.  I was using that PC as my secondary PC so I was OK with being limited as I never really needed it to be 100%.  I was waiting for a lull to be able to troubleshoot it.  

I recently ran a software program and it trashed my OS.  
I reinstalled, from scratch, WIN7 Pro on this machine and added around 10 programs including MS Security Essentials, Malwarebytes, Games (Homework and Lux), Roxio 2012, DVD Fab 10, VPN unlimited and MS Office 2016.  

Now the PC is generating ntdll.dll errors again when I try to launch most of these programs, including opening explorer, IE, DVD Fab, Touchcopy and a few others.

I am at a loss as I expected the fresh installation to remedy this issue but it keeps popping up.  As an adjunct to my tale, I never reformatted the SSD "C:" drive or the "D:" drive when I did the reinstallation.  I used the custom install option and installed fresh into the new Windows folder.   I used the "D:" drive to store the windows.old folder after I was up and running.

I am not sure if this has to do with remnants of the previous OS left on the drive or if this is an issue with hardware.  I ran a few different MEM tests and scandisks but no issues were found.  I also ran full scans using both Security essentials and Malwarebytes, no issues.

Any suggestions?  I am prepared to completely wipe the system and reinstall again, but I want to make sure it is not a hardware issue before spending all that time.
dll-errors.txt
Avatar of John
John
Flag of Canada image

When you reinstall a modern OS without the manufacturer's recovery DVD, you can remove the Chipset Driver.

Go to the manufacturer's web site, and download / install the most recent BIOS, Chipset and Video drivers. These 3 will likely fix your error.
Avatar of Vadim Rapp
Try in safe mode - does it still crash?
Avatar of Marshall Kass

ASKER

I will give that a try in a few minutes. ATI driver is current, bios is current but I will install the chipset drivers again
Also, I would uninstall or disable malwarebytes and security essentials, just to try.

If you install fresh again, add your applications one by one and check every time if the problem has emerged, so you know the one that is causing the trouble.
Avatar of skullnobrains
skullnobrains

ntdll is used by  native windows programs. actually i'm unsure chrome or iexplore are even supposed to use it. there is no relation with any driver as far as i know. my best bet is that one of the programs you installed on top of the os or the os cd itself installed a corrupt ntdll.dll or possibly a piece of code that runs as an extension and misuses a pristine version of the dll. if any of the installed programs or the OS is not pristine or hacked, all the more likely. you probably want a fresh reinstallation, test iexplore works and install other programs one by one until it breaks again. you'll need to reboot between tests because ntdll.dll will always stay loaded in memory while the system is running even if you close/kill whatever program you used for testing. you cannot unload the dll manually either as it is used by a bunch of startup process such as csrss.
Use the video driver from Dell and not the manufacturer.
Dell tweaks their drivers for those video cards.
The video card is not OEM, it is a pull from different unit.  BTW - this PC had been working without incident for over a year before the original NTDLL.DLL errors started on the older install.  Immediately after the new installation.
the culprit is probably whatever software you installed between the second last reboot and the last reboot before the error occured on your last installation. most likely you reinstalled that same software this time shortly after installing the os so you did not have time to experience a "working" OS.
I would not doubt that.  My only "issue" with this theory is I am actually loading the same software that is installed on my primary PC, where I do not have these issues.  It too is an I7 (HP) and has not thrown off any problems since it was rebuilt.  It also has 10 programs to every 1 on the newer rebuild.
@john and @pgm : not saying you're wrong in any way but why would you think this could be driver-related ? does not seem impossible to me but i'm interested into what kind of api calls in ntdll.dll would manage to act on the hardware in a way that would produce an error and no blue screen. do you happen to know ? or did you suggest this based on experience ? maybe googling ?

---

hmm... maybe you got a corrupted dll while browsing ( through some malware ) or possibly have different updates installed on both computers and got a bad one on the one that has the problem. ( since the problem lies within multiple programs, i'm currently assuming faulty dll rather than misuse of the dll ). unfortunately i have no idea which win7 updates contain a newer ntdll.dll just to make sure

btw the exact error would be useful. if different ones occur depending on the app or moment, that's useful information as well.
apparently ( a little googling ) this is also quite frequent with disk controller failures and possibly poor disk controller drivers as well. might be a bunch of other things as well.
Try running System File Checker.

Open cmd.exe with Run as Administrator and run SFC /SCANNOW.
Allow to complete, restart or, preferably, shut down the computer and then start up again.
Test to see if the problem has been corrected.

If that does not help, new or not, try a Windows 7 Repair Install. Here is a Seven Forums link to assist.

http://www.sevenforums.com/tutorials/3413-repair-install.html
Ran the SFC - no problems until it tried to exit.  I've attached the screen shot and the error log info.

User generated imageEvent-log-after-sfc.txt
I am running off to quote someone, I'll be back later this afternoon.  Thank you all for your assistance.
That should not be (SFC) so you need to try the repair install I suggested.
There might be a problem in SSD. Erase it before Installing new Windows to correct SSD problems.

Parted Magic is easy to use and compatible with most modern SSD drives. Here's how to use Parted Magic to securely erase SSD drives:

https://www.cnet.com/how-to/how-to-securely-erase-an-ssd-drive/

Disable Bit defender/Malware bytes and check if problem still persists.
John, not sure what you mean in your last post.  If you are just mentioning that the SFC should not have thrown an error, I think it was the log it was trying to open when it generated the error.  I am not going to try the repair because that is exactly what I did a short while ago when I was trying to repair the issue on the previous install.  Did not help.

Ramin - I will be sure to run the Parted magic (The secure erase does not resolve to any links) before I re-create my machine this weekend.  

Vadim & skullnobrain:  I will reinstall WIN7 after preparing the drives for a new OS.  I will install programs 1 at a time and test as I go.  As you can imagine, this might take a while.

Thank you all for your insights and I will return with the results as soon as I can.  If you think of something, do not hesitate to let me know, I am all ears.
SFC should not throw up these errors and that is why I suggested a repair install.
i would start from the basics - test ram and disk first - and Ensure they have the latest firmware
hook the SSD to a working system, and run the manufacturer's tool, eg the toolbox for intel or kingston drives :
https://www.kingston.com/us/support/technical/kingston-ssd-toolbox
https://downloadcenter.intel.com/download/26574/Intel-Solid-State-Drive-Toolbox

then  test your ram, you can remove half and test then - later do the same with the other half

also - when installing - i would DISCONNECT all drives , devices and external devices not needed during setup
just one : scanning and erasing drives is not a good idea : disks have limited lifetimes. SSDS in particular can only handle so many writes.
even defrag should be used cautiously and not at all on SSDs.
when the disk has failed clusters, you have other ways to know. actually installing an OS will write a lot and efficiently detect most issues.
SMART can also be used and reports such conditions accurately.

can we see the ntdll error string at some point ?
Mobus:  I have run the memtest 386+ and the DELL diagnostic memory tests recently in the past when the problem first started occurring, I have NOT run it recently - I can do that again once I get this monster onto my workbench.  I purchased Parted Magic to refresh the SSD before the next go around.

skullnobrains:  I know there is a write limit on the SSDs, but I am willing to lose a little life to get a working PC.  Do you NOT recommend using the Parted-Magic to erase the SSD prior to reinstalling?  Also I have been attaching error logs for some of the NTDLL.DLL errors I have been getting - what do you mean by the ntdll error string?  Let me know and I will gladly share it.

Thanks all
what do you mean by the ntdll error string

you mentioned ntdll errors : which ones ? ntdll produces different errors depending on the error condition.

Do you NOT recommend using the Parted-Magic to erase the SSD prior to reinstalling

honestly, i don't see the point. you can make a complete format which will do pretty much the same and is quite useless anyway : the filesystem does not care about what is written on the parts of the drive it does not use so a regular format is good enough.

reusing the same filesystem is not ideal. wiping the drive is overkill.

what actually will happen by doing so is forcing the drive to identify any bad clusters and map them to replacement clusters. when there is not replacement cluster left, the drive is dead. the same thing happens on the fly anyway. but grabbing smart attributes before and after such an operation gives good indication on the drive's health.

btw this can be done without a paying tool. booting on any livecd such as knoppix and typing "dd if=/dev/zero of=/dev/sda" does exactly the same as what partition magic does ( you may need to replace "sda" with the proper drive )
Did you turn off your antiviruses?
Rarshark - i did not ask to run Dell diags; the tool i use - and is considered best for me is memtest86+ you can download it, or run it from the UBCD
Hardware diagnostic CD    UBCD
---------------------------------------------------
go to the download page, scroll down to the mirror section, and  click on a mirror to start the download
Download the UBCD and make the cd   <<==on a WORKING PC, and boot the problem PC from it
Here 2 links, one to the general site, and a direct link to the download

since the downloaded file is an ISO file, eg ubcd527.iso - so you need to use an ISO burning tool
if you don't have that software, install cdburnerXP : http://cdburnerxp.se/

If you want also the Ram tested - run memtest86+ at least 1 full pass,  - you should have NO errors!
 
For disk Diagnostics run the disk diag for your disk brand (eg seagate diag for seagate drive)  from the HDD section -  long or advanced diag !  (runs at least for30 minutes)

http://www.ultimatebootcd.com/      

**  you can make a bootable cd - or bootable usb stick
*** note *** for SSD drives  use the tool from the manufacturer, like intel 's toolbox :
https://downloadcenter.intel.com/download/18455/Intel-Solid-State-Drive-Toolbox

for completeness -here's how i handle disk problems : https://www.experts-exchange.com/Storage/Hard_Drives/A_3000-The-bad-hard-disk-problem.html

==>>****in order to be able to  boot from CD or usb - you may have to disable secure boot in the bios

regarding the limited lifetime of ssd's - i doubt you'll reach that with a normal use
Vadim:  Yes, I tried without Security Essentials or Malwarebytes active, same problems.

Mobus: Sorry for my misprint above.  I did run Memtest86+ (I called it memtest 386+) when this happened to this PC before I reinstalled the OS last week.  Full run, came back 100%.  I ran the DELL diags to make sure the MBD was OK, more then for memory testing.

I, BTW, have 27+ years under my belt as an IT professional.  I am posting this because I am trying to see if anyone can help determine WHY this happened so when I re-re-reinstall Windows 7, I won't have this issue again.  As we all know, who has time to work on their own PCs :-) ?
You said initially: "I recently ran a software program and it trashed my OS.".  So, the computer was running OK before, and this started happening after you ran this program? what was the program?

Then you said "I reinstalled, from scratch, WIN7 Pro". "from scratch" - does it mean that it was clean install, not repair?

Finally - did you try running Windows in safe mode?

Also, I would go into BIOS and reset it to "optimal settings" or whatever the standard setting is called there.
> re-re-reinstall Windows 7, I won't have this issue again.

When (and if) you reinstall, try if the issue is happening right away, without any security essentials or malwarebytes. Download standalone benchmark and try it. Make sure to save restore point. By the way, speaking of the latter, perhaps you might try to restore the system to the state when you just re-installed, it, before you installed the applications.
yopu can Always remove half of the ram to test -as i suggested above

there is no 100% foolproof test, or software - sometimes you have to switch or replace them
you previously did a side by side install. if there is something wrong with the filesystem, performing a regular install on a new partition will help. actually, it might also help if there is something wrong with a part of the disk itself. then i do not really see why such issues would cause ntdll errors but given other comments, let's assume that's possible.

do you remember if iexplore produced errors right away after the last install ? if not, the issue is likely on the software side ; if yes, it is either hardware or OS. since you probably used the same cd on other computers, i'd assume we can rule out the OS. if you don't remember, it will be difficult to know without actually reinstalling.
skullnobrains:  I cannot say for sure when I started noticing the crashes as there were no indications that something went wrong other than the program seemingly not opening.  It took me a little while to discover it because I was loading the PC at the time.  Yes it was a side-by-side and I too do not know why the windows.old files would have any effect on the new windows installation.  Actually one of the very first things I did when I booted was to move the windows.old folder to the 2nd, larger drive, to make sure I had access to all of my settings and stuff.

All:  I hope to be able to attend to this issue this weekend, but I might have to put it off to next weekend.  I will keep this updated and let you all know my progress.  Please do not abandon me if I cannot do the reinstallation this weekend.  I value all the insights and advice you are providing.

When I do get this opportunity, my intention, at this time, is to reformat and reinstall Windows onto the SSD drive and not connect the second SATA drive until after I feel it is stable.  I will run the memtest again, individually, to make sure all is good on the RAM.  Once I get this installed with 7 Pro, I might virtualize another WIN7, my primary, working system, within it.  This will allow me to install software and test , using the checkpoint features of the host manager to allow me to reset more easily than if I was using the windows restore feature.  I haven't fully worked out the pros and cons of this approach.  This PC is not Windows 8 or 10 compatible, so hyper-v is not an option.  Probably VMware or VirtualBox.

Any thoughts on this approach?  Does anyone have experience running a domain connected PC in a Virtual environment?  Good / bad
i think you first have to look at the state of the SSD - firmware + diag
running a diag won't hurt - you can also consider starting with the first half of the ram too -you can Always add the rest
Yes it was a side-by-side and I too do not know why the windows.old files would have any effect on the new windows installation

they would not but a forgotten autorun might reinstall some idiotic stuff without your knowlege.
and a broken filesystem definitely would impact the newer install.

there were no indications that something went wrong other than the program seemingly not opening

how the hell did you determine the problem was ntdll related, then ? is this why you don't have an error message ? providing actual symptoms is helpful.

Does anyone have experience running a domain connected PC in a Virtual environment?  Good / bad

plenty. works fine. use bridge mode networking rather than NAT if possible. make sure the host's dns server is the dc otherwise.

i prefer virtualbox. even in virtualbox, you may consider using .vhd disk format because the win7 loader can boot from those so it can be unvirtualised later on easily. raw drives are even better in this respect but would not allow snapshotting.
Skullforbrains:
how the hell did you determine the problem was ntdll related, then ? is this why you don't have an error message ? providing actual symptoms is helpful.

As I said it took a few times but after the programs stopped opening I finally looked at the error logs.  I will include some of them.  The common connection between all these errors is the "Faulting module path: C:\Windows\SYSTEM32\ntdll.dll"
I assumed, perhaps incorrectly, that this is where the error is stemming from.
Application-Error-1.txt
Application-Error-2.txt
Application-Error-3.txt
Uninstall Protector Suite and retest.
Same error for Iexplore.exe and taskhost.exe - before I start playing with the system. please let me know WHY I am doing something.
Check if you have Microsoft Update KB3097877 . If you do, uninstall it. Source: http://borncity.com/win/2015/11/11/kb3097877-outlook-crashes-with-error-c0000374-fix-and-other-issues/

If it does not help:  try in safe mode, and in clean boot mode. Also, try to change your printer to Microsoft XPS. Source:  There were reports that exception 0xc0000374 (which is the very root of the problem) was fixed following the steps at https://answers.microsoft.com/en-us/office/forum/office_2010-office_install/office-products-crashed-upon-launch-0xc0000374/9eb1251f-5a7d-4401-a955-155ac432e6ea
...and I will explain why uninstalling security suite makes sense (or trying in safe mode). It's because different applications are crashing, which means that it's something that runs whenever every application runs, and #1 candidate is your antivirus. You previously said that you tried to disable it, but even when you disable, it still works, although differently. You need to try it with antivirus completely disabled, which can be achieved either by safe or clean boot mode , or by uninstalling it.
of the 3 errors, one is related to protector suite, one to IE, and the 3rd is the builtin taskhost.

the obvious first move is to reinstall the apps, though i'm unsure it will make a difference but reinstalling IE is quite trivial and should give a hint ( untick the box in windows features/components and reboot + retick and reboot again )

the errors relate to heap corruption which usually means allocating space to store data and overflowing that space. it is unlikely but not entirely impossible that a memory/disk/filesystem corruption would produce such issues ( not because you'd hit the problem at runtime but rather because the location ntdll is loaded/stored in would be corrupted ). that could break a specific api call that is fortunately not used often enough to break too many things. if you suspect such an issue, exchanging your ram sticks ( if you have multiple ones ) is a good way to determine if the ram is fine. see below for the disk.

i'd probably also grab the checksum of ntdll.dll and compare it to the ones published by ms just to make sure it is pristine. do not replace it with an online version. but you can reinstall whichever update or fix contains the last version of the dll if needed. if the dll is actually corrupt, and if there is no reason to suspect the filesystem or hardware or install media are responsible for the corruption, trash the system and make sure system file protection is enabled after the next install ( and take the regular extra steps before plugin the network ).

the above 3 seems sensible actions to me and can be performed in no specific order. the list is far from exhaustive but if none of the above gives a hint, i'm unsure it's worth spending more time trying to solve the problem because reinstalling cleanly will be faster.
"i'd probably also grab the checksum of ntdll.dll and compare it to the ones published by ms just to make sure it is pristine

That's what the digital signature is for. If one bit changed, it no longer would be signed, which would raise quite a hell.
My intention is to test the RAM first, run a diag recommended to me by Mushkin (SSD HDD Manufacturer) and re-install WIN7 on this PC.  As this is my 2nd installation (albeit  a side-by-side),  If the RAM and SSD check out, I will wipe my HDD and after a successful install, I will load the required programs one-by-one to see if I have issues.  The two last steps I will take are to reconnect the 2nd SATA HDD, which passed all tests and the last program I will install is the protector suite, which is my biometric software.

This should take place BY next Sunday afternoon as I will not have the ability to work on this PC during the week, unless I am very lucky.

I will keep everyone updated on my results.  Again, than you for all the excellent advice and insights.
Vadim:  I WILL check that, but shouldn't the SFC have done that when I ran it recently?
You don't need to check that, and there's no need to run sfc either. Continuous checking of integrity of the core system files is part of Windows, It happens all the time automatically. What you do need is to try in safe mode.
Will do.  On next reboot
Marshalk, we are interested to know, if after all the effort anything has helped. If you were able to fix the problem, or even if you gave up, kindly post some closure.
Did you Uninstall Protector Suite ?
I did uninstall protector suite - did not help.  I lost power and phones this last week and therefore have not been able to rip it down and reinstall.  Hopefully this weekend.

Thank you all for staying with me on this.  I will keep you updated.

M
Thank you all for staying with me on this.  I will keep you updated.

Can you please come back and close the question?
I am not actually finished with this question.  I was out of town this weekend and I need to address the issue over this coming weekend.  I would like to keep it open until at least next Tuesday.
You keep saying you will come back and the question is now abandoned. Please come back and close the question.
I have reinstalled WINDOWS completely and the issue is resolved.  The question was not abandoned, I just needed time to reinstall and test the system and life got in the way.
ASKER CERTIFIED SOLUTION
Avatar of Marshall Kass
Marshall Kass
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I think it's important to keep this question in the KB, if only to show the futility of everything that was suggested and only resulted in wasting the time. So someone else won't.
Reinstalling WINDOWS was the only solution that had any results.  It is now working.