ntdll.dll & shell errors shutting down Windows Explorer

[Anonymous]

Windows explorer shuts down frequently. From the Management/System
Tools/Event/Application log file, the 2 errors most common are:
"Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Description:
Faulting application explorer.exe, version 6.0.2800.1221, faulting module
ntdll.dll, version 5.1.2600.1217, fault address 0x00033905. (When I searched
my computer I found 2 versions of ntdll.dll. One is version 5.1.2600.1106
from xpsp1 and the other is 5.1.2600.1217 from xpsp2.)

Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 38 e 6.0.28
0028: 30 30 2e 31 32 32 31 20 00.1221
0030: 69 6e 20 6e 74 64 6c 6c in ntdll
0038: 2e 64 6c 6c 20 35 2e 31 .dll 5.1
0040: 2e 32 36 30 30 2e 31 32 .2600.12
0048: 31 37 20 61 74 20 6f 66 17 at of
0050: 66 73 65 74 20 30 30 30 fset 000
0058: 33 33 39 30 35 0d 0a 33905..

and the other error:
"The shell stopped unexpectedly and explorer.exe was restarted.

Should I have 2 versions of ntdll.dll? Could that be the problem?

Thanks for any help.

 

[Shain Wray [MSFT]]

Hello,

It depends on the location of each ntdll.dll, the liklihood is that version
5.1.2600.1217 is in your Windows\System32 directory and the other one is in
a backup directory.

Version 5.1.2600.1217 is from the following update -

815021 MS03-007: Unchecked Buffer in Windows Component May Cause Web Server
http://support.microsoft.com/?id=815021

You may be running into the following problem described in this KB -

824136 Error Message Occurs When File is Right-Clicked, or Problems Occur
When
http://support.microsoft.com/?id=824136

You will need to call into Microsoft Support to obtain this update.

Before doing this, try clean booting your system and see if it is simply
some other software on your system causing a problem -

A) Go to Start\Run and type
MSCONFIG <OK>
B) In MSConfig, choose "Selective Startup"
C) Remove all check boxes and click "OK" and "Yes" to reboot.
Then test our issue.
D) If you don’t see the problem at this point, check all except "System
Services" and "Startup Items", click "OK" and "Yes".
Reboot then test our issue.
E) If you don’t see the problem at this point, check all except "System
Services", click "OK" and "Yes".
Reboot and then test our issue.
F) If the problem returns, it is due to a Startup Item. If not, it is a
Service.

For Services:
G) Click the Services tab and check the box for “Hide all Microsoft
Services.”
H) Enable SOME of the disabled items, click "OK" and "Yes".
Reboot, then test our issue.

For Startup Items:
I) Click the Startup tab and enable SOME of the disabled items, click "OK"
and "Yes".
Reboot, then test our issue.

J) Repeat until you track down the offending component.


Best regards,
--
Shain Wray
Microsoft PSS Security Team

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!
--------------------