I am running Windows 7 64-bit with Office Professional Plus 2010 64-bit. If I have the Windows Search service running then I get repeated entries in the event log (every second) - see below as well as CPU and disk I/O running high. I also read elsewhere that the issue might be related to outlook and as explained below there is some correlation. Stopping the Windows Search Service (and disabling so it doesn't get restarted) resolves the problem - with the obvious major side affect of not being able to use windows search in windows nor office. I have also rebuilt the index and more errors appear for approx 2 minutes then no more. But Indexing Options reports "0 items indexed" and "Indexing complete." Then when Outlook is launched the problem starts again. The event log shows that outlook has detected the index rebuild and re-pushes outlook.ost, archive.pst, SharePoint Lists(2).pst to the indexer. ===== Event 1000, Application Error ===== Faulting application name: SearchProtocolHost.exe, version: 7.0.7600.16385, time stamp: 0x4a5bd1b4 Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b Exception code: 0xc0000005 Fault offset: 0x000000000003dc67 Faulting process id: 0xc4c Faulting application start time: 0x01cc163e2f2b340c Faulting application path: C:\Windows\system32\SearchProtocolHost.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll Report Id: 6cd8b8ec-8231-11e0-ad52-001a6be4bd41 ===== Along with the errors below there are associated info log entries ===== Event 1001, Windows Error Reporting ===== Fault bucket 7720292, type 4 Event Name: APPCRASH Response: Not available Cab Id: 0 Problem signature: P1: SearchProtocolHost.exe P2: 7.0.7600.16385 P3: 4a5bd1b4 P4: ntdll.dll P5: 6.1.7600.16385 P6: 4a5be02b P7: c0000005 P8: 000000000003dc67 P9: P10: Attached files: C:\Users\swakefie\AppData\Local\Temp\WERD0ED.tmp.WERInternalMetadata.xml These files may be available here: C:\Users\swakefie\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_SearchProtocolHo_ee2d876a6195f1886888b3313c8920e21e427dda_0603d2e0 Analysis symbol: Rechecking for solution: 0 Report Id: b7b92ddc-822e-11e0-ad52-001a6be4bd41 Report Status: 0 ===== and .... there are also sporadically events complaining about files/paths not available: ===== Event 3036, Search ===== The content source <file:C:/ProgramData/Microsoft/Windows/Start Menu/> cannot be accessed. Context: Windows Application, SystemIndex Catalog Details: The filtering process has been terminated (HRESULT : 0x80040db4) (0x80040db4) ===== Scotty

Cause of Ntdll.dll Errors The causes of ntdll.dll error messages can vary greatly. However, most ntdll.dll errors result from a corrupt or damaged version of the ntdll.dll file itself, corrupt hardware drivers, or issues between Windows and other programs. Ntdll.dll errors can sometimes mean that a piece of hardware in your computer is malfunctioning, but this is rare. Resolution Restart your computer. The ntdll.dll error you're receiving could be due to a one-time, temporary issue and a simple reboot may resolve the problem completely. Reinstall the program if the ntdll.dll error only displays when you use a specific program. If the software program has any updates or service packs available, install them too. The software's programmers may have identified an issue with the program that caused the ntdll.dll error and then issued a patch for it. Note: Third party software programs that have been installed on your computer are almost always the cause of ntdll.dll errors. The remainder of these troubleshooting steps resolve ntdll.dll issues only rarely. Check the Windows service pack level you're running and then check Microsoft's support site to see if there is a more recent service pack available for installation. Some issues that caused ntdll.dll errors have been corrected in these service packs from Microsoft. Selectively disable Internet Explorer add-ons. If your ntdll.dll error is displaying when you start, run, or close Internet Explorer, an add-on may be causing the problem. Disabling each add-on, one by one, will determine which add-on is the culprit (if any). Note: As a workaround, assuming the ntdll.dll error really is Internet Explorer related, install and use a competing browser like Firefox. Rename the NLSPATH system variable. If your Windows system does not have this environment variable, skip this step. Note: This is a troubleshooting step for this issue only. Be sure to set this path back to its original name if this does not resolve the ntdll.dll issue. Disable Data Execution Prevention for Explorer.exe. As in the previous step, this is for troubleshooting the ntdll.dll issue only. If this doesn't resolve the problem, return the Data Execution Prevention settings to their previous settings. Update drivers for any hardware in your computer where updated drivers are available. Outdated drivers sometimes cause ntdll.dll errors. Test your memory for damage. If you're receiving ntdll.dll messages, one possible cause could be a bad memory module in your system. Testing your memory will either identify a problem or clear your RAM of any responsibility. Replace your memory if it fails any of your tests. Ntdll.dll errors could occur if you have an Iomega Zip drive on the same IDE cable as the hard drive inside your computer. If so, move the Zip drive to a dedicated IDE controller. Replace the IDE cable connecting the hard drive to the motherboard. If this cable is damaged or malfunctioning, one symptom could be the ntdll.dll error you're seeing. Repair your installation of Windows. If individual software reinstallations fail to resolve the problem, a repair installation of Windows will replace the ntdll.dll file. Perform a clean installation of Windows. A clean installation will completely remove Windows from your PC and install it again from scratch. I don't recommend this option unless you've exhausted all previous troubleshooting ideas and you're comfortable that the ntdll.dll error is not caused by a single program (Step #2). Note: If a single program or plugin is causing the ntdll.dll error, reinstalling Windows and then reinstalling all of the same software may lead you right back to the same ntdll.dll error. Startup Repair http://www.sevenforums.com/tutorials/681-startup-repair.html System Restore http://www.sevenforums.com/tutorials/700-system-restore.html Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Cause of Ntdll.dll Errors The causes of ntdll.dll error messages can vary greatly. However, most ntdll.dll errors result from a corrupt or damaged version of the ntdll.dll file itself, corrupt hardware drivers, or issues between Windows and other programs. Ntdll.dll errors can sometimes mean that a piece of hardware in your computer is malfunctioning, but this is rare. Resolution Restart your computer. The ntdll.dll error you're receiving could be due to a one-time, temporary issue and a simple reboot may resolve the problem completely. Reinstall the program if the ntdll.dll error only displays when you use a specific program. If the software program has any updates or service packs available, install them too. The software's programmers may have identified an issue with the program that caused the ntdll.dll error and then issued a patch for it. Note: Third party software programs that have been installed on your computer are almost always the cause of ntdll.dll errors. The remainder of these troubleshooting steps resolve ntdll.dll issues only rarely. Check the Windows service pack level you're running and then check Microsoft's support site to see if there is a more recent service pack available for installation. Some issues that caused ntdll.dll errors have been corrected in these service packs from Microsoft. Selectively disable Internet Explorer add-ons. If your ntdll.dll error is displaying when you start, run, or close Internet Explorer, an add-on may be causing the problem. Disabling each add-on, one by one, will determine which add-on is the culprit (if any). Note: As a workaround, assuming the ntdll.dll error really is Internet Explorer related, install and use a competing browser like Firefox. Rename the NLSPATH system variable. If your Windows system does not have this environment variable, skip this step. Note: This is a troubleshooting step for this issue only. Be sure to set this path back to its original name if this does not resolve the ntdll.dll issue. Disable Data Execution Prevention for Explorer.exe. As in the previous step, this is for troubleshooting the ntdll.dll issue only. If this doesn't resolve the problem, return the Data Execution Prevention settings to their previous settings. Update drivers for any hardware in your computer where updated drivers are available. Outdated drivers sometimes cause ntdll.dll errors. Test your memory for damage. If you're receiving ntdll.dll messages, one possible cause could be a bad memory module in your system. Testing your memory will either identify a problem or clear your RAM of any responsibility. Replace your memory if it fails any of your tests. Ntdll.dll errors could occur if you have an Iomega Zip drive on the same IDE cable as the hard drive inside your computer. If so, move the Zip drive to a dedicated IDE controller. Replace the IDE cable connecting the hard drive to the motherboard. If this cable is damaged or malfunctioning, one symptom could be the ntdll.dll error you're seeing. Repair your installation of Windows. If individual software reinstallations fail to resolve the problem, a repair installation of Windows will replace the ntdll.dll file. Perform a clean installation of Windows. A clean installation will completely remove Windows from your PC and install it again from scratch. I don't recommend this option unless you've exhausted all previous troubleshooting ideas and you're comfortable that the ntdll.dll error is not caused by a single program (Step #2). Note: If a single program or plugin is causing the ntdll.dll error, reinstalling Windows and then reinstalling all of the same software may lead you right back to the same ntdll.dll error. Startup Repair http://www.sevenforums.com/tutorials/681-startup-repair.html System Restore http://www.sevenforums.com/tutorials/700-system-restore.html Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hello, Faulting module path: C:\Windows\SYSTEM32\ntdll.dll I see a problem with ntdll.dll. Please run sfc /scannow and check if this solve your problem. If not, perform an in-place upgrade of your OS. Steps mentioned here: http://www.sevenforums.com/tutorials/3413-repair-install.html This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

I had already tried sfc: sfc /verifyfile=c:\windows\system32\ntdll.dll Windows Resource Protection did not find any integrity violations. I will try the full scan and then if no joy will do the in-place upgrade (well laid out instructions on sevenforums btw). Will let you know result. right now have a doc to write.Scotty

sfc scannow reported corrupt files but was unable to fix some of them. It points to searchprotocolhost.exe being the problem, not ntdll.dll. BTW, the search service was not running during the scan. Unfortunately I've left the Win7 disk at work for the weekend so no progress to be made until Monday at best. Here is the CBS log from running sfc /verifyfile=c:\windows\system32\searchprotocolhost.exe 2011-05-21 00:24:08, Info CSI 00000009 [SR] Verifying 1 components 2011-05-21 00:24:08, Info CSI 0000000a [SR] Beginning Verify and Repair transaction 2011-05-21 00:24:09, Info CSI 0000000b Hashes for file member \SystemRoot\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.7600.16385_none_cf4f145f352676dd\SearchProtocolHost.exe do not match actual file [l:44{22}]"SearchProtocolHost.exe" : Found: {l:32 b:mCjKzvfzITQ/fyctClivtmrUc+rymBGtjiTfxv4LEmo=} Expected: {l:32 b:SsAC6QpSywmY2njymVKU7ne4n7K+cJsOPI4WJyErzNw=} 2011-05-21 00:24:09, Info CSI 0000000c [SR] Cannot repair member file [l:44{22}]"SearchProtocolHost.exe" of WindowsSearchEngine, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch 2011-05-21 00:24:10, Info CSI 0000000d Hashes for file member \SystemRoot\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.7600.16385_none_cf4f145f352676dd\SearchProtocolHost.exe do not match actual file [l:44{22}]"SearchProtocolHost.exe" : Found: {l:32 b:mCjKzvfzITQ/fyctClivtmrUc+rymBGtjiTfxv4LEmo=} Expected: {l:32 b:SsAC6QpSywmY2njymVKU7ne4n7K+cJsOPI4WJyErzNw=} 2011-05-21 00:24:10, Info CSI 0000000e [SR] Cannot repair member file [l:44{22}]"SearchProtocolHost.exe" of WindowsSearchEngine, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch 2011-05-21 00:24:10, Info CSI 0000000f [SR] This component was referenced by [l:224{112}]"Microsoft-Windows-SearchEngine-Client-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.SearchEngine-Client-Package" 2011-05-21 00:24:10, Info CSI 00000010 Hashes for file member \??\C:\Windows\System32\SearchProtocolHost.exe do not match actual file [l:44{22}]"SearchProtocolHost.exe" : Found: {l:32 b:mCjKzvfzITQ/fyctClivtmrUc+rymBGtjiTfxv4LEmo=} Expected: {l:32 b:SsAC6QpSywmY2njymVKU7ne4n7K+cJsOPI4WJyErzNw=} 2011-05-21 00:24:10, Info CSI 00000011 Hashes for file member \SystemRoot\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.7600.16385_none_cf4f145f352676dd\SearchProtocolHost.exe do not match actual file [l:44{22}]"SearchProtocolHost.exe" : Found: {l:32 b:mCjKzvfzITQ/fyctClivtmrUc+rymBGtjiTfxv4LEmo=} Expected: {l:32 b:SsAC6QpSywmY2njymVKU7ne4n7K+cJsOPI4WJyErzNw=} 2011-05-21 00:24:10, Info CSI 00000012 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:44{22}]"SearchProtocolHost.exe"; source file in store is also corrupted 2011-05-21 00:24:11, Info CSI 00000013 Ignoring duplicate ownership for directory [l:54{27}]"\??\C:\Windows\Inf\UGTHRSVC" in component WindowsSearchEngine, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral 2011-05-21 00:24:11, Info CSI 00000014 Ignoring duplicate ownership for directory [l:64{32}]"\??\C:\Windows\Inf\UGTHRSVC\0000" in component WindowsSearchEngine, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral 2011-05-21 00:24:11, Info CSI 00000015 Ignoring duplicate ownership for directory [l:56{28}]"\??\C:\Windows\Inf\UGatherer" in component WindowsSearchEngine, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral 2011-05-21 00:24:11, Info CSI 00000016 Ignoring duplicate ownership for directory [l:66{33}]"\??\C:\Windows\Inf\UGatherer\0000" in component WindowsSearchEngine, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral 2011-05-21 00:24:11, Info CSI 00000017 Ignoring duplicate ownership for directory [l:62{31}]"\??\C:\Windows\Inf\wsearchidxpi" in component WindowsSearchEngine, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral 2011-05-21 00:24:11, Info CSI 00000018 Ignoring duplicate ownership for directory [l:72{36}]"\??\C:\Windows\Inf\wsearchidxpi\0000" in component WindowsSearchEngine, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral 2011-05-21 00:24:11, Info CSI 00000019 Repair results created: POQ 0 starts: 0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\73513c064517cc0103000000b0199416._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms" 1: Move File: Source = [l:162{81}]"\SystemRoot\WinSxS\Temp\PendingRenames\29ff3d064517cc0104000000b0199416.$$.cdf-ms", Destination = [l:74{37}]"\SystemRoot\WinSxS\FileMaps\$$.cdf-ms" 2: Move File: Source = [l:204{102}]"\SystemRoot\WinSxS\Temp\PendingRenames\1a9342064517cc0105000000b0199416.$$_inf_3f581daba4c8c835.cdf-ms", Destination = [l:116{58}]"\SystemRoot\WinSxS\FileMaps\$$_inf_3f581daba4c8c835.cdf-ms" 3: Move File: Source = [l:222{111}]"\SystemRoot\WinSxS\Temp\PendingRenames\60a54c064517cc0106000000b0199416.$$_inf_ugthrsvc_9c5b081f28f83f11.cdf-ms", Destination = [l:134{67}]"\SystemRoot\WinSxS\FileMaps\$$_inf_ugthrsvc_9c5b081f28f83f11.cdf-ms" 4: Move File: Source = [l:232{116}]"\SystemRoot\WinSxS\Temp\PendingRenames\30eb50064517cc0107000000b0199416.$$_inf_ugthrsvc_0000_8451c300df70be5f.cdf-ms", Destination = [l:144{72}]"\SystemRoot\WinSxS\FileMaps\$$_inf_ugthrsvc_0000_8451c300df70be5f.cdf-ms" 5: Move File: Source = [l:224{112}]"\SystemRoot\WinSxS\Temp\PendingRenames\dfe254064517cc0108000000b0199416.$$_inf_ugatherer_9f1f9c5b6cd50d98.cdf-ms", Destination = [l:136{68}]"\SystemRoot\WinSxS\FileMaps\$$_inf_ugatherer_9f1f9c5b6cd50d98.cdf-ms" 6: Move File: Source = [l:234{117}]"\SystemRoot\WinSxS\Temp\PendingRenames\32a655064517cc0109000000b0199416.$$_inf_ugatherer_0000_046b5203f9ca3f14.cdf-ms", Destination = [l:146{73}]"\SystemRoot\WinSxS\FileMaps\$$_inf_ugatherer_0000_046b5203f9ca3f14.cdf-ms" 7: Move File: Source = [l:230{115}]"\SystemRoot\WinSxS\Temp\PendingRenames\959056064517cc010a000000b0199416.$$_inf_wsearchidxpi_a2c41dc1731a4204.cdf-ms", Destination = [l:142{71}]"\SystemRoot\WinSxS\FileMaps\$$_inf_wsearchidxpi_a2c41dc1731a4204.cdf-ms" 8: Move File: Source = [l:240{120}]"\SystemRoot\WinSxS\Temp\PendingRename 2011-05-21 00:24:11, Info CSI s\5c6558064517cc010b000000b0199416.$$_inf_wsearchidxpi_0000_2e6e3f1caf9fca20.cdf-ms", Destination = [l:152{76}]"\SystemRoot\WinSxS\FileMaps\$$_inf_wsearchidxpi_0000_2e6e3f1caf9fca20.cdf-ms" POQ 0 ends. 2011-05-21 00:24:11, Info CSI 0000001a [SR] Verify complete Scotty

Running WIN7, SERVICE PACK 1, now, and still searchprotocolhost.exe has "i/o OTHER" constantly updating, 100 bytes a second. How can I disable SEARCH ? Its a total waste for something I rarely use. For a while I could not STOP THE SEARCH SERVICE WSEARCH (busy) and on the rare ocassions, when I can, it simply re-starts.