NTDLL.dll crashes

[UCSBphy]

Everytime I start the Windows 2003 STD server, 3 programs crash: beremote (Backupexec), dns.exe and firefox.exe. Under the event viewer it says:

faulting module NTDLL.DLL, version 5.2.3790.0, fault address 0x00003847.

It is the same error for all programs. I ran sfc /scannow and manually replaced NTDLL.dll with one from the CD and nothing works.

Thanks,
Alex

 

[aftertaf]

bad.

remove the dns service,firefox browser and your backup program.

what roles does your server have? is it a DC?
how long has it been installed?
would it be feasible to try system resore?

my bet is something else is at the root of the problem and is making this dll crash, but it is not the dll that is at fault.

Aftertaf
if its not broken, fix it anyway - with luck you might break it and have an excuse

 

[UCSBphy]

It is everything, a DC, AD, print, file, web etc. I tried reinstalling Windows 2k3 and restoring the system state data. The problem resurfaced. So it looks like I have to manully go and reinstall everything from scratch. Is there a way to just backup the users and passwords? We have about 100 and manually entering them is a pain. Backing up the system state doesnt help.

Alex

 

[aftertaf]

if you have to do that, you can temporarily add a 2nd DC and get it to replicate...


but all the same, it might not be necessary to reinstall completely here...

try removing your backup program (beremote), searching on google for your error message came up that some backup progs are not 100%compat with 2003 yet.
and are you sure all your drivers are up to date, including for the motherboard?
check all these things too....

in the meantime check this thread...

http://www.softwaretipsandtricks.com/forum/showthread.php?s=bbe8b8746a8ceaf11ce3afb2c27168b8&t=12469

may be some things you havent tried on there.....

and while we're at it, post us a log of hijackthis on your pc, there could be something nasty lurking in the processes (apart from windows )

Aftertaf
if its not broken, fix it anyway - with luck you might break it and have an excuse

 

[UCSBphy]

I will do the Hijack when I get in. I do have to say that everything was working flawlessly until one day when everything went down hill. I have searched everything on the error messages, nothing comes up. I also have to add that any java based programs (Bittorrent programs) crash with NTDLL.dll listed as the cause as well.

Thanks,
Alex

 

[aftertaf]

are there a lot of other third party progs installed?
cos it being a server and all, its not really recommended...


Aftertaf
if its not broken, fix it anyway - with luck you might break it and have an excuse

 

[UCSBphy]

There are no extra programs installed. I installed a few trying to diagnose my problem (Port Explorer, Process Explorer etc)

Alex

 

[UCSBphy]

Here is my HiJackThis log:
Logfile of HijackThis v1.99.0
Scan saved at 2:48:24 PM, on 2/1/2005
Platform: Unknown Windows (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 (6.00.3790.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\SAV\DefWatch.exe
C:\WINDOWS\system32\Dfssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cba\pds.exe
C:\WINDOWS\System32\ismserv.exe
C:\PROGRA~1\SAV\Rtvscan.exe
C:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE
C:\WINDOWS\system32\ntfrs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ams_ii\hndlrsvc.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\ams_ii\iao.exe
C:\Program Files\VERITAS\Backup Exec\NT\beserver.exe
C:\WINDOWS\system32\rsmsink.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SAV\vptray.exe
C:\Program Files\VERITAS\VxUpdate\VxTaskbarMgr.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\VERITAS\Backup Exec\NT\beremote.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\dns.exe
C:\Documents and Settings\alau\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/softAdmin.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdoclc.dll/softAdmin.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =

http://softwareupdate.veritas.com/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SAV\vptray.exe
O4 - HKLM\..\Run: [VxTaskbarMgr] C:\Program Files\VERITAS\VxUpdate\VxTaskbarMgr.exe
O4 - HKLM\..\Run: [AtomTime] "C:\Program Files\AtomTime Pro\AtomTime.EXE"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = hansma.physics.ucsb.edu
O17 - HKLM\Software\..\Telephony: DomainName = hansma.physics.ucsb.edu
O17 - HKLM\System\CCS\Services\Tcpip\..\{3191B642-A43F-4395-BCF4-DB58562CCC7D}: NameServer = 127.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{4BC58126-4A98-4047-AFC4-DB47951C127D}: NameServer = 128.111.8.187,128.111.8.45
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = hansma.physics.ucsb.edu
O17 - HKLM\System\CS1\Services\Tcpip\..\{3191B642-A43F-4395-BCF4-DB58562CCC7D}: NameServer = 127.0.0.1
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = hansma.physics.ucsb.edu
O17 - HKLM\System\CS2\Services\Tcpip\..\{3191B642-A43F-4395-BCF4-DB58562CCC7D}: NameServer = 127.0.0.1
O23 - Service: Backup Exec Remote Agent for Windows Servers - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\beremote.exe
O23 - Service: Backup Exec Agent Browser - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\benetns.exe
O23 - Service: Backup Exec Device & Media Service - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\pvlsvr.exe
O23 - Service: Backup Exec Job Engine - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\bengine.exe
O23 - Service: Backup Exec Naming Service - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\benser.exe
O23 - Service: Backup Exec Server - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\beserver.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SAV\DefWatch.exe
O23 - Service: ExecView Communication Module (ECM) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\NT\ECM\ECM.exe
O23 - Service: Intel Alert Handler - Intel® Corporation - C:\WINDOWS\system32\ams_ii\hndlrsvc.exe
O23 - Service: Intel Alert Originator - Intel® Corporation - C:\WINDOWS\system32\ams_ii\iao.exe
O23 - Service: Intel File Transfer - Intel® Corporation - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: Symantec AntiVirus Server - Symantec Corporation - C:\PROGRA~1\SAV\Rtvscan.exe
O23 - Service: Symantec System Center Discovery Service - Symantec Corporation - C:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE