Explorer crashing with error in NTDLL.DLL

[Frank D. Nicodem, Jr.]

I am running Windows XP Home Edition, and am experiencing crashes in
Explorer with increasing frequency. The symptom usually takes one of two
forms. Most commonly, I have a Windows Explorer window open, and I may (or
may not) be doing anything in it. Perhaps I've just clicked (or even
right-clicked) on a folder or file; or (occasionally) I'm doing nothing at
all at the moment, but the window is just open. Suddenly, an error message
pops up that there is an "Application Error" in the file ntdll.dll -- and
most commonly there is additional information about an inability to write to
memory. Then, when I click on "OK", the Windows Explorer window closes,
along with all other icons on my desktop (and on my Task Bar). There is a
brief (!) pause, after which all of the icons on my desktop are refreshed,
and I can (usually) re-open Windows Explorer and continue.

While this is the most common symptom, a secondary symptom is that, instead
of the "Application Error" message coming up, I get only the "Windows
Explorer has caused an error..." message, with the "Send..." and "Don't
Send..." buttons on it. (I almost always click "Send", although I have no
idea what Microsoft does with this information! Apparently very little.)

On *rare* occasions, after Explorer has crashed, my desktop icons do NOT get
refreshed. And I CANNOT re-open Windows Explorer (or, for that matter, do
much of anything else, except in windows that are already open). I can't
get to the Start button, or the Task Bar; and my only recourse at these
times is to shut the system down and re-boot (which I usually try to do via
the Task Manager -- if it will come up; sometimes I have to actually power
down, because NOTHING is working).

The problem used to occur once or twice a day; it is now occurring with
increasing frequency. I've been running my system for just over a year, and
during that time I am *extremely* careful to install all Windows Updates --
so I should be totally current. Likewise, I run various anti-virus and
anti-spyware programs (including rootkit revealers), so I can almost always
guarantee that my system is "clean". At the same time, as a software
developer, I have installed literally hundreds of applications on my system
(and uninstalled many of these, as well); so I'm sure that the Registry is
in terrible shape. (I do use several different Registry "cleaners", though.
I'm extremely anal about maintaining my system!)

I've run several different Scan/Check programs on my disk; and just
yesterday I used the System File Checker (sfc/scannow), to see if that would
help. I can't say for sure that it did. It *seemed* that the number of
crashes was reduced, but there were still several. (I was up to over a
dozen per day. Sometimes the system will crash only minutes after I've
re-booted it!)

I do have Visual Studio installed (as I'm an application developer), as well
as many other programming, utility, and maintenance tools -- many of which
"drill down" pretty deeply into the system. What could be causing this
repeated problem with "Application Errors" in ntdll.dll, and errors writing
to memory? And what (if any) solution might there be? I really don't want
to "scrub" the entire system, and re-install everything; it would take me
literally weeks, based on all of the software installations, configurations,
and modifications I've made over the last year or so.

Upon "Googling" anything about ntdll.dll errors, I find that it seems to be
a fairly common topic on the Internet. Any suggestions on what to do????

 

[Gerry Cornell]

Frank

Disable automatic restart on system failure. This
should help by allowing time to write down the STOP code properly.
Right click on the My Computer icon on the Desktop and select
Properties, Advanced, StartUp and Recovery, System Failure
and uncheck box before Automatically Restart.

Enable automatic restart on system failure after you have captured /
copied and pasted the message in a further post here.

There will also be Error Reports in Event Viewer. Please post copies.

You can access Event Viewer by selecting Start, Administrative Tools,
Event Viewer. When researching the meaning of the error, information
regarding Event ID, Source and Description are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427&Product=winxp

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Double click the button and close Event
Viewer. Now start your message (email) and do a paste into the body of
the message. This will paste the info from the Event Viewer Error Report
complete with links into the message. Make sure this is the first paste
after exiting from Event Viewer.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[WTC]

I am running Windows XP Home Edition, and am experiencing crashes in
Explorer with increasing frequency. The symptom usually takes one of two
forms. Most commonly, I have a Windows Explorer window open, and I may (or
may not) be doing anything in it. Perhaps I've just clicked (or even
right-clicked) on a folder or file;

May be a context menu problem.

Right-click is slow or weird behavior caused by context menu handlers
http://windowsxp.mvps.org/slowrightclick.htm

Also do you have any add on toolbars installed such as Google or MSN Desktop
Search.

On *rare* occasions, after Explorer has crashed, my desktop icons do NOT
get refreshed. And I CANNOT re-open Windows Explorer (or, for that
matter, do much of anything else, except in windows that are already
open). I can't get to the Start button, or the Task Bar; and my only
recourse at these times is to shut the system down and re-boot (which I
usually try to do via the Task Manager -- if it will come up; sometimes I
have to actually power down, because NOTHING is working).

If Task Manager does open select New Task and type "explorer" to regain your
dekstop and taskbar.

At the same time, as a software developer, I have installed literally
hundreds of applications on my system (and uninstalled many of these, as
well); so I'm sure that the Registry is in terrible shape. (I do use
several different Registry "cleaners", though. I'm extremely anal about
maintaining my system!)

I am against Registry Cleaners, they are more harmful than good.

 

[Frank D. Nicodem, Jr.]

Gerry,

Thanks so much for the prompt reply. You gave me a lot to check on!

Enable automatic restart on system failure after you have captured /
copied and pasted the message in a further post here.

I'll try to get a capture of one of the messages, as soon as I can. In the
mean time...

There will also be Error Reports in Event Viewer. Please post copies.

I'm almost embarrassed to say that I didn't know about the Event Viewer! I
had no idea that information was in there. But to the point, it seems as
though, every single time I had one of the crashes in Explorer, two Error
Events were generated. For the first one, the "Source:" would always be
"Application Error", The "Event ID:" is 1000. And under "Description:", it
would say:

Faulting application explorer.exe, version 6.0.2900.2180, faulting
module
unknown, version 0.0.0.0, fault address 0x01c0c1c5

(Hex address would vary with each error.) Or it might actually list a
"faulting module", as in:

Faulting application explorer.exe, version 6.0.2900.2180, faulting
module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

(Again, hex address would differ with each.) More often than not, I got the
"unknown" faulting module; however, if one did happen to be listed, it seems
to always have been ntdll.dll.

Now, in each of those cases, within a few seconds there would be another
Error Event logged. Again, the "Source:" would be "Application Error", and
this time the Event ID would be 1001. But the only thing in the Description
field would be:

Fault bucket 127786104

(Again, the actual numeric value would differ.)

But that's what I'm getting in the "Application" section of the Event
Viewer. There is nothing outstanding in the "Security" section. But there
are other errors in the "System" section. However, I don't believe they
relate to this problem. (And these seemed to come from everywhere -- my
browser, MySQL, PDF Creator, all sorts of what I would call "normal"
errors.)

I don't know if that helps at all... but it's what I was able to find.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Double click the button and close Event
Viewer. Now start your message (email) and do a paste into the body of
the message. This will paste the info from the Event Viewer Error Report
complete with links into the message. Make sure this is the first paste
after exiting from Event Viewer.

If you need the info at that detail level, I'll be glad to do it. However,
I was finding such a consistency (i.e., the same thing in each pair of Error
Events), that I figured the above might be enough explanation.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427&Product=winxp

Thanks again for any help you can provide.

 

[Frank D. Nicodem, Jr.]

Right-click is slow or weird behavior caused by context menu handlers

http://windowsxp.mvps.org/slowrightclick.htm

I'm working on this one right now. This article looks quite interesting,
and I want to pore over it a bit more. I especially like the Shell
Extension Viewer application, and have downloaded it to my system. However,
upon initial observation, I see that I have over 300 Shell Extensions on my
system!!! So it's going to take some time to sort through them, and see if
I can find out anything additional. I'll post here, if I find anything
useful.

Also do you have any add on toolbars installed such as Google or MSN
Desktop Search.

Absolutely. Included in my BHO's (according to BHO Demon) are the Google
Toolbar, SpyBot Search & Destroy Helper, RoboForm Browser Helper, Browster,
the FolderBox utility, SnagIt (screen capture), AcroIEHelper (the Adobe
Acrobat Reader), Star Downloader, and several others.

If Task Manager does open select New Task and type "explorer" to regain
your dekstop and taskbar.

Thanks! I don't know why I didn't figure that out! I just couldn't see how
to get to a "Run" menu. Even the Windows-R key combination didn't work.
I'll try that next time.

 

[Gerry Cornell]

Frank

Have you installed the Windows XP SP2 update?

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Double click the button and close Event
Viewer. Now start your message (email) and do a paste into the body of
the message. This will paste the info from the Event Viewer Error Report
complete with links into the message. Make sure this is the first paste
after exiting from Event Viewer.

The reports from the System log can be equally important or more so.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Frank D. Nicodem, Jr.]

Have you installed the Windows XP SP2 update?

Yes. In fact, when I bought my system (a Dell Inspiron 9200), it already
had SP2 installed. And as I mentioned, ever since that time, I have
automatic updates turned on, and am constantly insuring that all of my
patches, etc., are up to date.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Double click the button and close Event
Viewer. Now start your message (email) and do a paste into the body of
the message. This will paste the info from the Event Viewer Error Report
complete with links into the message. Make sure this is the first paste
after exiting from Event Viewer.

That's how I got the information I posted. But I'll give you an example of
a full cut-and-paste here:

------------------------------
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 1/17/2006
Time: 8:46:19 PM
User: N/A
Computer: INSPIRON9200
Description:
Faulting application explorer.exe, version 6.0.2900.2180, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x000106c3.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 32 31 38 30 20 00.2180
0030: 69 6e 20 6e 74 64 6c 6c in ntdll
0038: 2e 64 6c 6c 20 35 2e 31 .dll 5.1
0040: 2e 32 36 30 30 2e 32 31 .2600.21
0048: 38 30 20 61 74 20 6f 66 80 at of
0050: 66 73 65 74 20 30 30 30 fset 000
0058: 31 30 36 63 33 0d 0a 106c3..
--------------------------

This kind of error would then be followed, only seconds later, by a second
error, similar to the following:

--------------------------
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1001
Date: 1/17/2006
Time: 8:46:28 PM
User: N/A
Computer: INSPIRON9200
Description:
Fault bucket 127154752.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 31 32 37 31 35 34 37 35 12715475
0010: 32 0d 0a 2..
------------------------------

And as I said, althouigh this particular one that I chose showed the
faulting module to be ntdll.dll, more often it said "unknown".

The reports from the System log can be equally important or more so.

One of the reasons that I hadn't included any System logs is that the
Application errors were consistent -- again and again and again, the same
thing (other than with different hex addresses). But the System logs varied
quite a bit -- covering a lot of ground. I will, however, mention one
particular group of System errors that, I now see, appear to be repeated --
in fact, they account for most of the "red X" Error marks under the System
section. They may have *nothing whatsoever* to do with my Explorer
crashes... but they're certainly puzzling, in their own right.

What will happen is that it will start with the following:

-----------------------------------
Event Type: Error
Event Source: Print
Event Category: None
Event ID: 23
Date: 1/18/2006
Time: 9:30:41 AM
User: NT AUTHORITY\SYSTEM
Computer: INSPIRON9200
Description:
Printer Easy PDF Creator failed to initialize because a suitable Easy PDF
Creator driver could not be found.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
------------------------------------

Then, about 15 seconds later, I'll get two more System errors
simultaneously. The first of these will be:

------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 1/17/2006
Time: 5:45:49 PM
User: N/A
Computer: INSPIRON9200
Description:
The MySQL service failed to start due to the following error:
The system cannot find the path specified.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
--------------------------------------

And the second will say:

--------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 1/17/2006
Time: 5:45:49 PM
User: N/A
Computer: INSPIRON9200
Description:
The Windows Firewall/Internet Connection Sharing (ICS) service terminated
with the following error:
An address incompatible with the requested protocol was used.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
---------------------------------------

Now, what is so odd about *these* errors is that 1) I am NOT doing any PDF
creation (which would invoke the PDF Creator driver, shown in the first of
the three errors); 2) I have NO IDEA of what "MySQL" is being referenced
here. I do have MySQL installed on my system, but I am not currently using
ANY application that invokes MySQL. And 3) I have NO IDEA of what that
third error is related to. But as I said, periodically I'll see all 3 of
those, and they'll all come right together. They're the only "consistent
error" I can see under the System Event log.

Because I don't want to get sidetracked, I'm not sure that these System
errors are related to the Explorer crashes. They may be a totally separate
thing that I have to address. So for now, I'd like to do whatever I can to
gather more information on the Explorer crashes (which are so *clearly*
indicated under the Application section of the Event Logger), and find out
what I can do to fix the problem.

 

[Gerry Cornell]

Frank

The reason I asked about SP2 is that there seemed to be a Hotfix
for your ntdll.dll. However, this hotfix was included in the SP2 update.

BTW you should not assume because Automatic Updates is enabled
that you have all available updates. You should have all Critical Security
Updates but there are others.

Try Start, Help and Support, Keep your computer up-to-date with
Windows Update. Opt for a Custom install.

There is an option to look at a History of Updates installed there. Check
for Failures.

The position is similar with regard to Office and Internet Explorer updates.

I will post again when I have carried out some further research.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Gerry Cornell]

Frank

I did find one other user with identical explorer
error reports.

Is your computer standalone or networked?

Any McAfee products been or are uninstalled?

Have you looked in Device Manager for yellow
question marks and Device Error codes?

You might try testing your memory

Memtest86 - Memory Diagnostic Page:
http://www.memtest86.com/

What is the make and model of your printer?

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[WTC]

I'm working on this one right now. This article looks quite interesting,
and I want to pore over it a bit more. I especially like the Shell
Extension Viewer application, and have downloaded it to my system.
However,
upon initial observation, I see that I have over 300 Shell Extensions on
my
system!!! So it's going to take some time to sort through them, and see
if
I can find out anything additional. I'll post here, if I find anything
useful.

I would disable all third party shells and only use the Microsoft shells. If
the Explorer crashes stop then I would enable one shell at a time until
Explorer crashes.

Absolutely. Included in my BHO's (according to BHO Demon) are the Google
Toolbar, SpyBot Search & Destroy Helper, RoboForm Browser Helper,
Browster, the FolderBox utility, SnagIt (screen capture), AcroIEHelper
(the Adobe Acrobat Reader), Star Downloader, and several others.

The Google toolbar is known to cause problems, I would uninstall temporarily
and see if problem is corrected. The FolderBox utility may be another I
would try.

Thanks! I don't know why I didn't figure that out! I just couldn't see
how to get to a "Run" menu. Even the Windows-R key combination didn't
work. I'll try that next time.

You're welcome.

 

[Frank D. Nicodem, Jr.]

I did find one other user with identical explorer
error reports.

Is your computer standalone or networked?

It's a laptop -- and so it varies, depending on where I am, and what I am
doing at the time. When I am home, I'm connected into my home LAN (and
through a router to a cable modem). At work, I'm networked to the company
network, and connected to the Internet on a T1 all day long.

Any McAfee products been or are uninstalled?

The only McAfee produce I use (and only rarely) is their Stinger application
to scan for the more dangerous viruses. My anti-virus is Trend Micro's
PC-Cillin Security Suite, which also is my firewall, and a few other things.

Have you looked in Device Manager for yellow question marks and Device
Error codes?

Yes, I do that fairly regularly. No problems there.

You might try testing your memory

Memtest86 - Memory Diagnostic Page:
http://www.memtest86.com/

I just downloaded the latest version of MemTest. However, I see that it
only runs from a floppy, and I have none on my system. Is there a way to
run it from a USB memory stick, or would I have to create a boot CD-ROM?

What is the make and model of your printer?

At work, I only use networked printers; there are no local printers on my
system. At home, while I do have a printer available, it's never connected
(unless I have an immediate need to print something there -- otherwise, I
just use the printers at work). However, I do have printer *drivers*
installed -- for each and any printer that I may have to use (most of which
are HP or Epson models of some kind).

 

[Frank D. Nicodem, Jr.]

I would disable all third party shells and only use the Microsoft shells.
If the Explorer crashes stop then I would enable one shell at a time until
Explorer crashes.

The Google toolbar is known to cause problems, I would uninstall
temporarily and see if problem is corrected. The FolderBox utility may be
another I would try.

Those are certainly things I will try. It's going to take a while, though,
since -- as I mentioned earlier -- I have 300 shell extensions. And while a
lot of them *are* Microsoft extensions, there's a whole lot that aren't.
What would make this testing easier is if I could tell you that the problem
is reproducible at will -- i.e., I can do something to "make it happen".
Then all I'd have to do is to disable a shell extension, do "the thing" that
causes the crash, and know whether that fixed it or not.

But that's not the case. The crashes are never predictable. I can do the
same thing that I just did 25 times in a row, and the 26th time it will
crash. There are times when Explorer crashes 3 or 4 times within an hour;
there are times when I work away on my system for 5 or 6 hours without a
crash! I just never know. These are the most insidious types of errors to
find.

In any case, thanks for the suggestions -- and especially the Web URL. I
always like to acquire additional tools to maintain my system, and Shell
Extension Viewer looks like one I'll be using a lot.

 

[WTC]

Those are certainly things I will try. It's going to take a while,
though, since -- as I mentioned earlier -- I have 300 shell extensions.
And while a lot of them *are* Microsoft extensions, there's a whole lot
that aren't. What would make this testing easier is if I could tell you
that the problem is reproducible at will -- i.e., I can do something to
"make it happen". Then all I'd have to do is to disable a shell extension,
do "the thing" that causes the crash, and know whether that fixed it or
not.

But that's not the case. The crashes are never predictable. I can do the
same thing that I just did 25 times in a row, and the 26th time it will
crash. There are times when Explorer crashes 3 or 4 times within an hour;
there are times when I work away on my system for 5 or 6 hours without a
crash! I just never know. These are the most insidious types of errors
to find.

In any case, thanks for the suggestions -- and especially the Web URL. I
always like to acquire additional tools to maintain my system, and Shell
Extension Viewer looks like one I'll be using a lot.

You're welcome and good luck. Hopefully you and Gerry will be able to fix
the explorer crashes.

 

[WTC]

I just downloaded the latest version of MemTest. However, I see that it
only runs from a floppy, and I have none on my system. Is there a way to
run it from a USB memory stick, or would I have to create a boot CD-ROM?

MemTest does have an available ISO download which you can burn to CD.
http://www.memtest86.com/#download0

 

[DSG]

This topic was very interesting to say the least. Gerry Cornell and WTC
took enough time to give enough detail that the reader would be able to go
back to his computer and have confidence in trying to learn how to fix a
problem.

Most people would agree that most questions are asked because the 'asker' is
trying to find out how to fix it.

For instance, if this is the question: "I want to use the Help and Support
function of Windows XP, but I can't figure out how to turn it on."

A terse directive such as, "You may have to try a "repair" install" is
probably not going to help unless he knows how to run a repair install.

However, here is a helpful answer that helps one actually learn to help
himself:
"Help and Support Error" - Service not started:
http://windowsxp.mvps.org/helpsvc.htm

Thanks to all you great MVPs and others who help us in such a way that we
are encouraged to learn how to fix it outselves
DSG
...............................................

 

[WTC]

This topic was very interesting to say the least. Gerry Cornell and WTC
took enough time to give enough detail that the reader would be able to go
back to his computer and have confidence in trying to learn how to fix a
problem.

Most people would agree that most questions are asked because the 'asker'
is trying to find out how to fix it.

For instance, if this is the question: "I want to use the Help and Support
function of Windows XP, but I can't figure out how to turn it on."

A terse directive such as, "You may have to try a "repair" install" is
probably not going to help unless he knows how to run a repair install.

However, here is a helpful answer that helps one actually learn to help
himself:
"Help and Support Error" - Service not started:
http://windowsxp.mvps.org/helpsvc.htm

Thanks to all you great MVPs and others who help us in such a way that we
are encouraged to learn how to fix it outselves
DSG

Well thank you very much DSG. I am glad to hear MVPs and other fine poster
such as Gerry are appreciated

 

[Frank D. Nicodem, Jr.]

MemTest does have an available ISO download which you can burn to CD.
http://www.memtest86.com/#download0

I did download, and run, the latest version of MemTest32. I let it run
through an entire Pass of all tests. It took just over 40 minutes, to
process through all tests with 1GB of RAM. No errors were reported, and
everything looked good. I am not suspecting any kind of hardware problem at
this point (memory, CPU, hard drive, etc.) My inclination is a software
conflict/error of some kind. I just can't figure out where!

I'm posting a sample error dialogue box in another reply within this thread.
It doesn't show the ntdll.dll error, but it does exemplify one of the ways
in which Explorer is crashing.

 

[Gerry Cornell]

Frank

My only thought is try Filemon
http://www.sysinternals.com/Utilities/Filemon.html

You can filter.


--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~