What is this ?

[Cranfield]

My computer has been quite slow this evening and I decided to run SpyBot.

 

It found no cookies but it gave me two lines described as "Error during check".

The symbol at the beginning of the line was a circle with a diagonal red cross and an exclamation mark in the middle.

 

Line one read;

602ProPCSUITE[602Tabv2001][zugriffsverletzung bei Adresse 77F57EB2 in Modul 'ntdll'.Lessen von Adresse....I think some numbers followed, but it went off page.

 

Line two read;

RSE721[zugriffsvertletzung bei Adresse 7757EB2 in Modul 'ntdll.dll'.Lessen von Addrese 00790070]

 

Anyone know what these are ?

[Newt]

Yup. Access error to a memory address which usually means a problem with the file named.

 

File ntdll.dll is an essential system file and one of two things is happening. Since your system is running but slowed, I'd bet on #2.

 

1. Corrupt ntdll.dll

2. A virus that exploits ntdll.dll has invaded your PC.

 

Check #2 first by doing an online virus scan with RAV since if you are infected, there is a very good chance the virus will have disabled your onboard AV software so that it appears to run normally but never finds a problem.

 

If the scan is clean, do the following in this order:

 

- start~run~cmd followed by chkdsk /r for all your hard drives so chkdsk c: /r and the same for any others. On C: it will tell you it can't run right now so answer Yes to doing it at next reboot then reboot.

 

- start~run~cmd followed by sfc /scannow and have your install CD handy since it will most likely be needed if sfc finds problems.

[Cranfield]

Thanks Newt (as usual) .

 

The RAV scan found nothing and I am "Nortoned" up to the hilt.

Another SpyBot ands AdAware run this morning are both OK.

 

I can,t find my install CD (if I ever had one, the machine came loaded), so I am a bit reluctant to try Phase 2.

 

Is there a safer alternative ?

If I find a problem, can I go back to a restore point to keep running and give myself some thinking time ?

[Cranfield]

OK, I have had a look around and found a file, that I remeber downloading just before the problems started, I think this is causing the trouble.

However, I can,t delete it.

I get a message saying its being used "by another person or programme".

This happens even when no other programmes are running and I,m "offline".

 

How do I delete it, please ?

[Newt]

I can,t find my install CD (if I ever had one, the machine came loaded),

 

Arrrrgg - I hate it when they do that. You really may need it at some point so good if you can locate it. Lots of the OEM systems ship with a 'recovery CD' or something similar that will at least allow you to put the system back as it was shipped. Horrible choice but .....

 

What OS are you running? If XP, home or pro version? What file system, FAT32 or NTFS? What file name for the file that won't go away?

 

Possible ways to make that file gone:

 

- boot up in safe mode (usually tapping the F8 key a couple times every second) may allow deletion.

 

- logging on as a different user may allow deletion.

 

Otherwise, I'll need to answer after getting the additional information.

 

Chkdsk is still a good idea to do and won't need any additional help/files/whatever.

quote:

---

start~run~cmd

followed by

chkdsk /r

for all your hard drives so chkdsk c: /r and the same for any others. On C: it will tell you it can't run right now so answer Yes to doing it at next reboot then reboot.

---

 

[ 06. January 2004, 03:12 PM: Message edited by: Newt ]

[Cranfield]

I am running XP Home.

I don,t know what my file system is.

 

I have tried the "chkdsk/r" option, but nothing happens.

There is an attempt to open a panel on the screen, but it closes immediately.

I have PopUp Blocker turned off.

 

Moving around the computer is very slow and frequently operations (like trying to open "My Documents" ) freezes and I have to "end task", or reboot.

 

I am also getting a "Virtual Memory too low" warning, every time I turn it off.

 

 

How do you reboot in safe mode ?

[Newt]

Chkdsk will tell you the file system when it starts.

 

You need to start it from a cmd prompt so start~run~cmd to get a DOS window.

 

After that, there is a space after chkdsk so chkdsk /r to do the drive you are on and if you have other drives you can specify them with

chkdsk x: /r where x is any drive letter.

 

Most of your drives will run the utility immediately. Your system drive (probably C:) can't be done while the operating system is loaded so it will ask about doing it at next reboot.

[Cranfield]

Thanks Newt.

 

I did that, got a box saying "C:Documents and SettingsBrian>" I then typed "chkdsk C:/r" and nothing happened.

 

I,m sorry to stretch your patience Newt.

It might be easier if I post the computer to you.

[Newt]

Space after chkdsk

Space after C:

No space between /r

 

Tell ya what, copy the entire next line (highlight the line and then press ctrl-c)

 

chkdsk c: /r

 

Now open the DOS window, right-click, and paste in what you've copied then press the ENTER key

 

[ 06. January 2004, 07:38 PM: Message edited by: Newt ]

[Cranfield]

All done as suggested.

I was told it couldn,t run now, etc.

I answered "yes" for run on reboot.

I rebooted and it just restarted as normal and nothing else happened.

 

If I ignore this dodgy file, everything is OK, but if I try to delete it, or highlight it, all the problems start.

 

I will understand if you get fed up, Newt.

I could cart the lot into Town and seek "professional help".

Something my Wife has suggested I do for years.