October 7, 2010

ntdll.dll crash

So I started having a problem where nearly every time I opened an explorer window, Windows Explorer crashed and restarted. For some reason it happened even more often when my laptop was running on battery. Quite the severe (and frustrating) issue to be having.

(Side note: For those interested, I am running 32-bit Windows 7 Professional.)

According to the Application Event Log, the error was coming from ntdll.dll. The message ran something like this:

Faulting application name: Explorer.EXE, ...
Faulting module name: ntdll.dll, ...
...
Faulting application path: C:\Windows\Explorer.EXE
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
...

Turns out ntdll is a Microsoft library, located in C:\Windows\System32 (or equivalently, C:\WinNT\System32), that contains NT kernel functions. Pretty essential file, if you ask me. A failure in that file could mean anything from a corrupt Windows installation to hardware failure. Naturally, my initial reaction was "Oh GOD, NO! WHY GOD WHY?!?!"

As a developer, I have loads and loads of applications and configuration on my machine, and having to reinstall Windows would really suck. I try to avoid it at all costs. Which is why I avoid taking my laptop to get fixed at Future Shop, since I've learned the hard way that their go-to response is just to wipe your hard drive.

Anyway, if it was a hardware failure then that would be just as bad, if not worse. However, usually a hardware failure seems to come in the form of a BSOD. Or, maybe the ntdll error was just related to out-of-date drivers.

Repairing my Windows installation, checking for hardware malfunctions and updating all my drivers seemed to be more like 'last resorts', so I started looking at what else might be causing the problem.

Eventually I came to this:

EIDE / IDE cable[1] issues. One possibility is that there could be a physically defective cable in my hardware somewhere ("WHY GOD, WHY?!"), or....

Another device could be using the same IDE cable as the hard drive. Maybe a zip drive, CD / DVD drive, burner, etc.

Bingo. Recently I installed Mozy[2]. Mozy has an option to put a virtual drive on your machine.



Apparently this drive uses the same cable as the hard drive. Or something. Whatever it was doing, it was interfering with my hard drive itself. Disabling it then rebooting my machine solved my problem, and I've now been able to close and reboot Windows Explorer on my own terms, thank you very much.

So, if you are having a problem where your Windows Explorer is continually crashing and you don't know why, check if you have some extra mysterious drive kicking around that might be interfering with your hard drive. If that doesn't work... maybe try following the troubleshooting guide listed here.

------
Footnotes

[1] EIDE / IDE cables are the cables / ports that connect various hard drives / optical drives and the motherboard together.
[2] Mozy is a great tool that remotely backs up your files, allowing me to be stress-free and not have to worry about plugging in my 100-year old external hard drive every couple weeks to save all my precious pictures and documents. It also makes me worry less about the aforementioned Future Shop "repairs".