Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

ntdll.dll error


  • Please log in to reply

#1
nigs

nigs

    Member

  • Member
  • PipPip
  • 10 posts
Initially i had IE6.0(my OS-XP) and after a spy ware attack, i started getting ntdll.dll error at random whenever i tried to browse web and could not start my yahoo messenger also, so i uninstalled IE6 and installed IE7.0, but still the same issue exists. Now it has become worse, i get 'Internet Explorer has encountered an error and need to close' message for almost all the sites and i am unable to view my yahoo mails also.Please let me know how this issue can be solved.Thanks in advance
  • 0

Advertisements


#2
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,675 posts
Hi nigs,

Can you see if you have the file C:\WINDOWS\ServicePackFiles\i386\ntdll.dll ?
If you do, rightclick it, choose Properties and let me know the Version number.

Regards,
  • 0

#3
nigs

nigs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
Hi Metallica,
Thank you very much for the response. I dont know whether i am missing out something, becuase I followed the path provided by you, but in the Windows folder, i did not see any service pack files, among other folders i saw folders like this
$NtServicePackUninstallIDNMi...
$NtServicePackUninstallNLSD...
$NtUninstallKB873333$ (similar file folders like this with different succeeding numbers)

i tried to locate the ntdll.dll file among these folders but did not find it. Also my windows search is not working after the spyware cleanup as whenever i hit the Search button all the windows get closed and i am returned to a blank screen saver.

Please let me know how to proceed...
Thanks Again for your time!!!
  • 0

#4
nigs

nigs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
I found the information you had asked me.. sorry didn't look closer at the Local Disk files....

The version of NTDLL.DLL file is 5.1.2600.2180.
  • 0

#5
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,675 posts
OK. That should do.

I've written a little script to replace the corrupted version with the one in your ServicePackFiles.

Download Brute Force Uninstaller to your desktop.
  • Right click the BFU folder on your desktop, and choose Extract All
  • Click "Next"
  • In the box to choose where to extract the files to,
  • Click "Browse"
  • Click on the + sign next to "My Computer"
  • Click on "Local Disk (C: ) or whatever your primary drive is
  • Click "Make New Folder"
  • Type in BFU
  • Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".

Then copy the text in the codebox below into notepad and save the file as ntdllrep.bfu
Save it in the same folder you made earlier (c:\BFU).

OptionUnloadShell

FileRename %SYSDIR%\ntdll.dll|%SYSDIR%\ntdll_old.dll

FileMove C:\WINDOWS\ServicePackFiles\i386\ntdll.dll|%SYSDIR%\ntdll.dll

DllRegister %SYSDIR%\ntdll.dll|1


Then, please go to Start > My Computer and navigate to the C:\BFU folder.
  • Start the Brute Force Uninstaller by doubleclicking BFU.exe
  • Behind the scriptline to execute field click the folder icon Posted Image and select ntdllrep.bfu
  • Press Execute and let it do it's job.
  • Do not be scared when your desktop and taskbar disappear for a little while.
  • Wait for the complete script execution box to pop up and press OK.
  • Press exit to terminate the BFU program.
Reboot your computer and check if it worked.

If it did work, please visit the Windows Update site first chance and get any Updates you are missing.

Keep us posted.
  • 0

#6
nigs

nigs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
Thank you for the script and all the detailed steps. I followed them exactly and now i am able to browse web pages, but when i tried to download Windows Update from Microsoft website, i get the error 'Internet Explorer encountered a problem and need to close' and here is the error report...

Error Signature
AppName: iexplore.exe AppVer: 7.0.6000.16640 ModName: ntdll.dll
ModVer: 5.1.2600.2180 Offset: 0000ec8d

Can you also please guide me in restoring the Search Option of my Windows XP?
  • 0

#7
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,675 posts

Can you also please guide me in restoring the Search Option of my Windows XP?


Is it missing or does it crash?

Can you download and install SP3?
select the correct language here:
http://www.microsoft...;displaylang=en
  • 0

#8
nigs

nigs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
When I hit the Search button from the Start Menu, all opened applications get closed and the desktop icons disappear.

I am unable to download anything from Microsoft website.

Thanks Again!!
  • 0

#9
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,675 posts
OK that means that it crashes explorer.exe

I'm afraid I'll have to ask you to follow these instructions first:
http://www.geekstogo...-Log-t2852.html
Post the log in that section.
Let me know when you have posted your log and I'll look at it.
  • 0

#10
nigs

nigs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
Thanks for the reply. I have already followed all the steps in the malware removal forum to clean up a spyware attack on my laptop 10 days ago. I have also installed Spybot S & D, Malware Bytes and have been scanning for spyware every two days.
Do you need me to follow the whole process again or i can just run the Hijackthis and post the log here?

Please let me know.
  • 0

#11
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,675 posts
Post the Hijackthislog, but not in this section please.

They are only allowed in the Malware Removal section of the forums.
  • 0

#12
nigs

nigs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
Thanks for the information. I have started a new topic titled Explorer.Exec Crash under "Malware Removal HijackThis Logs" and posted my Hijackthis as well as Startup List logs.

Please let me know if you need any other details.
  • 0

#13
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,675 posts
Got it. For those that want to follow:
http://www.geekstogo...87#entry1249887

Regards,
  • 0

#14
jimmyv4351

jimmyv4351

    New Member

  • Member
  • Pip
  • 1 posts

I've written a little script to replace the corrupted version with the one in your ServicePackFiles.


I'd like to try this as well, but, my version of ntdll.dll is slightly different: 5.1.2600.5512

Will the same script work or does it need to be altered (and if so would you please)?
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP