Tag Archives: ntdll!

Ntdll.dll – Pre Service Pack 1 Revision History for Windows 8 RTM and Windows Server 2012 RTM

Ntdll.dll – Pre Service Pack 1 Revision History for Windows 8 RTM and Windows Server 2012 RTM

12-Oct-2012 – 6.2.9200.20535 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2770397 – Slow system performance when defense against heap spraying is enabled in Windows 8 and Windows Server 2012

Ntdll.dll – Pre Service Pack 2 Revision History for Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Small Business Server 2011 (SBS 2011)

Ntdll.dll – Pre Service Pack 2 Revision History for Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Small Business Server 2011 (SBS 2011)

02-Oct-2013 – 6.1.7601.22470 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2878068 – Application crashes after the ConvertSecurityDescriptorToStringSecurityDescriptor function fails in Windows 7 SP1 or Windows Server 2008 R2 SP1

01-Oct-13 – 6.1.7601.22469 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2894252 – Process that runs in Untrusted integrity level is reported as an AppContainer after you install KB2532445 in Windows 7 SP1 and Windows Server 2008 R2 SP1

12-Aug-2013 – 6.1.7601.22418 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2878436 – NTFS virtual volume driver remains in memory in Windows 7 SP1 or Windows Server 2008 R2 SP1

10-Aug-2013 – 6.1.7601.18234 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2878436 – NTFS virtual volume driver remains in memory in Windows 7 SP1 or Windows Server 2008 R2 SP1

07-Aug-2013 – 6.1.7601.22415 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2875501 – FIX: The ExitProcess() function may not return the correct value in Windows 7 or in Windows Server 2008 R2

25-Jun-2013 – 6.1.7601.22368 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2864432 – Call stack is corrupted when a native code application crashes on a Windows 7 SP1-based computer that has the AVX feature enabled

25-Jun-2013 – 6.1.7601.18192 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2864432 – Call stack is corrupted when a native code application crashes on a Windows 7 SP1-based computer that has the AVX feature enabled

07-Jun-2013 – 6.1.7601.22351 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2857782 – “Stop 0x000000C9” error when you disconnect a device from a Windows 7 SP1 or Windows Server 2008 R2 SP1-based computer

07-Jun-2013 – 6.1.7601.18178 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2857782 – “Stop 0x000000C9” error when you disconnect a device from a Windows 7 SP1 or Windows Server 2008 R2 SP1-based computer

05-Mar-2013 – 6.1.7601.22273 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2821049 – COM-based application freezes on a computer that is running Windows 7 or Windows Server 2008 R2

04-Jul-2012 – 6.1.7601.22044 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2719306 – SSIS stops responding when a scheduled job starts in SQL Server 2008 R2 on a computer that is running Windows 7 or Windows Server 2008 R2

06-Jan-2012 – 6.1.7601.21892 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2582203 – A process that is being terminated stops responding in Windows 7 or in Windows Server 2008 R2

17-Nov-2011 – 6.1.7601.21861 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2644615 – MS12-001: Vulnerability in Windows Kernel could allow security Feature bypass: January 10, 2012

17-Nov-2011 – 6.1.7601.17725 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2644615 – MS12-001: Vulnerability in Windows Kernel could allow security Feature bypass: January 10, 2012

16-Jul-2011 – 6.1.7601.21772 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2583244 – You cannot use Event Viewer to create more than 1024 active event providers in Windows Server 2008 R2 or Windows 7

23-May-2011 – 6.1.7601.21732 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2545627 – A multithreaded application might crash in Windows 7 or in Windows Server 2008 R2

Ntdll.dll – Revision History for Windows Vista SP2, Windows Server 2008 SP2 and Windows Small Business Server 2008 (SBS 2008)

Ntdll.dll – Revision History for Windows Vista SP2, Windows Server 2008 SP2 and Windows Small Business Server 2008 (SBS 2008)

05-Sep-2012 – 6.0.6002.22926 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2752711 – A process that is being terminated crashes in Windows Vista or in Windows Server 2008

18-Nov-2011 – 6.0.6002.22742 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2644615 – MS12-001: Vulnerability in Windows Kernel could allow security Feature bypass: January 10, 2012

18-Nov-2011 – 6.0.6002.18541 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2644615 – MS12-001: Vulnerability in Windows Kernel could allow security Feature bypass: January 10, 2012

15-Oct-2010 – 6.0.6002.22505 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2393802 – MS11-011: Vulnerabilities in Windows Kernel could allow elevation of privilege

15-Oct-2010 – 6.0.6002.18327 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2393802 – MS11-011: Vulnerabilities in Windows Kernel could allow elevation of privilege

30-Jun-2010 – 6.0.6002.22435 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2264107 – A new CWDIllegalInDllSearch registry entry is available to control the DLL search path algorithm

30-Jun-2010 – 6.0.6002.18279 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/2264107 – A new CWDIllegalInDllSearch registry entry is available to control the DLL search path algorithm

16-Nov-2009 – 6.0.6002.22268 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/975007 – FIX: A custom application that uses a bitmap data structure may crash in Windows Vista or in Windows Server 2008

12-Nov-2009 – 6.0.6002.22267 – Ntdll.dll – x86/x64 – http://support.microsoft.com/kb/976038 – Exceptions that are thrown from an application that runs in a 64-bit version of Windows are ignored

[RESOLVED] A process that is being terminated stops responding in Windows 7 or Windows Server 2008 R2 or Small Business Server 2011

You may find that when you try to terminate a process on Windows 7, Windows Server 2008 R2, Windows Small Business Server 2011 SBS 2011 that the termination process stops responding.  The main thread of the process becomes blocked and if you analyse the call stack of the process you will see that a thread is blocked in the ntdll!NtReleaseKeyedEvent() function.  This occurs because of a race condition whereby the main thread that is trying to terminate the process also tries to reactivate another thread when the thread released an SRW lock.

This issue can be resolved by installing a hotfix containing an updated Ntdll.dll driver.  You can find the hotfix download link in Microsoft KB 2582203 http://support.microsoft.com/kb/2582203