APPCRASH - fault module NTDLL.DLL!

civ2ru · 17-08-2008

Hello,

First off, I run Vista Home Premium 32-bit. In the past several months I've
started receiving error messages when my computer recovers from Sleep Mode. I
don't remember when it started and I can't roll back that far. Various
programs - explorer.exe, wmplayer.exe, outlook.exe and others - "stop
working" and most of them indicate ntdll.dll as the faulting module (see
event viewer logs included below). Please help!
----------
Log Name: Application
Source: Application Error
Date: 7/22/2008 11:20:48 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: ...
Description:
Faulting application Explorer.EXE, version 6.0.6000.16549, time stamp
0x46d230c5, faulting module ntdll.dll, version 6.0.6000.16386, time stamp
0x4549bdc9, exception code 0xc0000374, fault offset 0x000af1c9, process id
0x824, application start time 0x01c8eb384724f9be.
----------
Log Name: Application
Source: Application Error
Date: 8/16/2008 12:27:11 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: ...
Description:
Faulting application wmplayer.exe, version 11.0.6001.7000, time stamp
0x47919356, faulting module ntdll.dll, version 6.0.6001.18000, time stamp
0x4791a7a6, exception code 0xc0000005, fault offset 0x0003d13a, process id
0x1510, application start time 0x01c8ffc54e67ba00.
----------
Log Name: Application
Source: Application Error
Date: 8/9/2008 8:49:01 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: ...
Description:
Faulting application OUTLOOK.EXE, version 11.0.5510.0, time stamp
0x3f1380f0, faulting module ntdll.dll, version 6.0.6001.18000, time stamp
0x4791a7a6, exception code 0xc0000005, fault offset 0x000658c8, process id
0x1538, application start time 0x01c8fa26a95e4d10.

meerkat · 17-08-2008

You need to try a System file Check.
Go to the start button.
In the Search Panel type... CMD.
At the top of that column CMD.exe will appear.
Right click on it, and select Run as Administrator.
The Command window will appear.

In the command window type...SFC /scannow
(note the space between C and /, and the 2 letters n)
This will perform a system file test, to ensure all your system files
are OK.
Then Restart your machine.

bw..

zachd [MSFT] · 18-08-2008

Event Viewer notes are slightly inferior to the Problem Reports and
Solutions Center control panel's View Problem History for those crashes.

The first crash is from your old system pre-upgrade to SP1, likely
indicating that memory corruption has occurred. There's a variety of
potential suspects, but since you've upgraded, that's not 100% relevant any
longer.

The second crash: are palmusbdirect.dll or slacker.shared.dll on your
system?

The third crash: if you use the Problem Reports and Solutions Center to
check for solutions, you should already be getting a notification here that
your Office is out of date. Does updating per that help?

All of the crashes are a little too generic to be analyzed just based upon
that data. The actual crash DMP files might be interesting to look at, but
the below data likely could not lead to any direct solution by itself.

civ2ru · 18-08-2008

Zach - thank you so much for taking the time to answer!

Funny you should ask about palmusbdirect.dll - yes, I have that file and
been getting some crashes on its account as well. Should I try removing it or
moving to a different folder?

As for ntdll.dll and Problem Reports and Solutions logs, how about this one?
Does it shed any more light?
----------
Product
Windows Media Player

Problem
Stopped working

Date
8/15/2008 12:10 PM

Status
Report Sent

Problem signature
Problem Event Name: APPCRASH
Application Name: wmplayer.exe
Application Version: 11.0.6001.7000
Application Timestamp: 47919356
Fault Module Name: ntdll.dll
Fault Module Version: 6.0.6001.18000
Fault Module Timestamp: 4791a7a6
Exception Code: c0000005
Exception Offset: 0003d02b
OS Version: 6.0.6001.2.1.0.768.3
Locale ID: 1033
Additional Information 1: bfef
Additional Information 2: e8adce1c2b9e7be834b4063ac3c53863
Additional Information 3: bfef
Additional Information 4: e8adce1c2b9e7be834b4063ac3c53863

Extra information about the problem
Bucket ID: 649592584

Meerkat - thank you for the reply!
Already tried system scan yesterday and it seemed to have found corrupt
files it couldn't fix. Ran it again just now and the verdict was "did not
find any integrity violations". Go figure... Will keep my fingers crossed.

"meerkat" wrote:

zachd [MSFT] · 18-08-2008

I would suspect that either updating or uninstalling that DLL would indeed
have a positive effect here. Does it?

How does one UNINSTALL the DLL?

I don't have it on my system so I don't know what software it came with. By
the file name, "Palm" may be the relevant software provider. If you check
the File Properties on the DLL, that may indicate why provided it to you,
which may lead you to people who know how to better trouble-shoot it or know
what install package was installed to your system that included it. Since I
never installed that file, you would unfortunately be in a better position
to know how it got there which directly correlates to what install package
you might at this time want to try temporarily uninstalling.

Of course, you could also just rename or remove the DLL, but that's an
inferior plan.

Paul Montgomery · 18-08-2008

Check this before you go doing anything else:

This second crash bucket also is most correlated to palmusbdirect.dll. What
are the file properties of that file?
Is oehook.dll on your system?

civ2ru · 19-08-2008

Paul - thank you for your input! I have checked out the link. I haven't got
the ntdll.dll error in the last few days, so I'm hopeful than SFC/scannow
fixed the corrupted memory module...

Zach - thank you so much for your help!

Palmusbdirect.dll has very odd properties, "Product Name: Softick Direct USB
SDK". I have no idea what that is, but it was originally in the Palm folder
so I assume it got installed with the Palm software. I'll try uninstalling
that and reinstalling the latest version of Palm.

BTW, moving the file to a different folder does seem to do the trick as
well, so sounds like palmusbdirect.dll is more of a culprit than ntdll.dll (I
haven't had any of those errors in several days). But I agree that simply
moving it (or renaming it) is an inferior solution, so I'll try reinstalling
Palm. I'll keep you posted!

And no, I don't have oehook.dll on my system.

**drashish** · 22-04-2009

Need help urgently

Problem signature:
Problem Event Name: APPCRASH
Application Name: pes2009.exe
Application Version: 1.0.0.0
Application Timestamp: 48b91ef2
Fault Module Name: ntdll.dll
Fault Module Version: 6.0.6001.18000
Fault Module Timestamp: 4791a7a6
Exception Code: c0000005
Exception Offset: 0004d84c
OS Version: 6.0.6001.2.1.0.768.2
Locale ID: 16393
Additional Information 1: fd00
Additional Information 2: ea6f5fe8924aaa756324d57f87834160
Additional Information 3: fd00
Additional Information 4: ea6f5fe8924aaa756324d57f87834160

plz post reply here
or mail me
thanks

zachd [MSFT] · 25-04-2009

What video card/adapter do you have? I had a friend who had a similar
problem by having an outdated driver for his video card... does getting
updated drivers from your video card vendor help here?