Error with ntdll.dll: reasons and solutions

The Windows operating system in its structure has a huge number of different components, directories and files, the functionality of which is directly related to the normal operation of the computer as a whole. The overwhelming popularity of the Windows 7 operating system has long led to the fact that it received the title of not only the “best” version, but also the most “buggy, that is, the one where the largest number of errors manifests itself. Every computer user sooner or later, but is faced with the fact that any software spontaneously and “not sparing anyone” just closes. This situation is primarily characterized by failures in the operation of system components that have the extension “.dll”, which each program addresses without exception. In this article we will discuss the above error with unauthorized shutdown of software, the reasons for its occurrence and solutions.

Methods for correcting errors in the file ntdll.dll.

Ways to fix

Without unnecessary background, it should be said that the essence of the problem lies in the incorrect operation of the dynamic library file called “ntdll.dll”. The considered error can be shown in two variations:

  1. The first is the appearance of a window about the emergency shutdown of the program, sometimes directly "Windows Explorer". In order to view the detailed information, it is enough to click on the “View details” button, where it will be directly stated that the “ntdll.dll” file was the culprit.
  2. The second variation is characterized by the appearance of a “blue screen” (not a BSOD / not a screen of death) with an indication of the error code and a link to the SystemRoot \ System32 \ ntdll.dll file.

So, ntdll.dll is an extremely important module that is vital for processing API and active use of application software. If you simplify the definition as much as possible, the library in question is responsible for such functions as: move, copy, paste / cut, compare, etc. And based on the fact that these functions are used every second, you can make several logical conclusions about the causes of failure module, namely:

  • The user performed any software installation / update manipulations, as a result of which the “ntdll.dll” file was replaced with a deliberately unworkable version or was simply deleted without replacement;
  • The installed software does not have full compatibility with the operating system used. This was clearly seen earlier when Win7 only climbed "on user Olympus" and part of the programs that were released under Windows XP were launched on the "new" version of the operating system.

And taking into account all the above, you should go directly from the words to the case.

Option 1

The first thing that needs to be done is to take advantage of the opportunity to run a program that was previously terminated abnormally, in compatibility mode. And for this you need to do the following:

  • Right-click on the shortcut for the problem program and go to the Compatibility tab;
  • In the "Compatibility Mode" section, check the box "Run the program in compatibility mode";
  • Among the available options, select "Windows XP" (Service Pack 2) or (Service Pack 3);
  • Lower your gaze below and check the box in the “Run this program as administrator” / “Run this program as administrator” box;
  • Click "OK" and check the performance of the selected software.

If necessary, select the number 3 available for use in # 3.

Option 2

Implies disabling Windows account control:

  • Open the "Start" and in the search box, type "UAC" or "Change the parameters of control of user accounts";
  • In the window that opens, move the slider to the bottom of "Never Notify";
  • Click “OK” to save the change and restart the computer;
  • Check the functionality of the desired software.

Option 3

In the structure of the operating system there is a service “PcaSvc”, it is also the “Program Compatibility Assistant Service”, which in this case, to test the theory, you can try to disable:

  • Click "Start" and open the "Tools" and "Control Panel";
  • Next, open the “System and Security” and go to the “Administration” subsection;
  • Scroll through the list to the line "Services" and open it;
  • Or simply execute the "services.msc" command;
  • Sort the list of service by alphabet and find the above service “PcaSvc”;
  • Click on it with the right mouse button and in the “State” block click “Stop”;
  • In the “Startup type” block, select “Disabled”;
  • Save the changes and restart the computer.

Option 4

The fourth and most optimal option of all possible is to roll back the system to a point that preceded the appearance of the problem in question, and, possibly, preceded the installation of the problem software. To implement this option, you will need to do the following:

  • Open the Start menu and expand the Utilities directory;
  • In the list that opens, select "System Restore";
  • Among the available points that were created by the operating system automatically, choose the most suitable option for you;
  • To check what may be lost and affected by restoration to the previous configuration, click on the “Search for affected problems” button;
  • Click “Next” - “Done” and wait for the recovery tool to finish;

It is important to understand that it is categorically not recommended to interrupt this procedure, since it is possible to face more serious problems than the one that is considered in the framework of this article.


The last thing that may be able to help in this situation is to manually download the “ntdll.dll” file and manually place it in the system directory. The consequences of such a download, including the choice of the source, are assigned to each user individually, since quite often attackers “mix” virus software into the module, and what this can all cause is a rhetorical question.