Versions of ntdll.dll going backwards - Win 7 x64 Ultimate & Pro

JCN9801 · 18 Mar 2014

I have done two recent Windows 7 x64 re-installs or catch-ups (150+ WU behind). I noticed that prior to ~23-Oct-2013 my C:\Windows\SysWOW64\ntdll.dll was at Version 22436. Now it is at Version 18247. One system was x64 Ultimate, the other was a fresh install of x64 Pro which first wanted an update of WU itself. Everything did eventually install and catch-up on both systems (HP Pavilion dv7t-6100 and Dell Precision M6550 laptops).

About ~12 other files in SysWOW64 have the same date/time stamp so obviously a WU action.

All scans (sfc, mbam, mse, etc) come back clean.

Is this normal behavior; to go 4-5 version backwards? I spent time with MS Tech Support and the engineer there thought not. But he was unwilling or unable to cross reference which system files change with which particular WU / KB. Got a bit hostile too. Maybe he was not cleared to check this out

Anybody have clues or insight?

Thanks,
--JCN

UsernameIssues · 18 Mar 2014

Interesting.

Did the installation DVD for W7 pro include SP1?

edit:
Never mind about the SP1 question. The forum was showing you as online when I posted that quick question. I wondered if you had missed one number.
e.g.
...7600.22436
...7601.18247
But now that I've looked into it, the version numbers are indeed weird.
e.g.
...7601.22436
...7601.18247

It looks like you had no luck in the MS forums - bummer.

This KB seems to be the one that makes the change:
Update adds ITraceRelogger interface support to Windows Embedded Standard 7 SP1, Windows 7 SP1 and Windows Server 2008 R2 SP1

You might want to back that update out and see if your apps stop crashing.

This is from a fresh install (with SP1 included):
Attachment 310879

This is after KB2882822:
Attachment 310880

I've not found the KB that takes the rev number up to 22436...
...but that version number is mentioned in KB2882822:
Attachment 310881
I'm not sure what I'm looking at with those two rev numbers.

edit2:
This is from KB2859537:
Attachment 310882
So two rev numbers again.

NoelDP · 18 Mar 2014

The difference is from general release 1xxxx and side-branch 2xxxx numbering (on the phone so dont have refs to hand

UsernameIssues · 18 Mar 2014

Thanks NoelDP.

I saw those terms mentioned in the KB:

Attachment 310887

So I went hunting for more info after I sent you that PM/invite.

I found this:
How does Windows choose which version of a file to install? - The Windows Servicing Guy - Site Home - TechNet Blogs
Not that I understand it (nor care to), but I found it

Perhaps you can alleviate the OP's concerns about this being normal (i.e. that versioning moves between branches).

NoelDP · 18 Mar 2014

I can try - but I do admit it's confusing (and gets more so, the deeper you go into it!).

Most updates in Windows belong to the main branch - (which version numbers begin with a 1) - and these are pushed via Windows Updates to most machines.
However, there are some Hotfixes which aren't in the mainstream, and they haven't been through the various hefty testing that mainstream fixes get. These get the version 2xxx tags.

After that hotfix is released, all fixes for that file contain at least two versions of the updated file (one for the 1xxx and one for the 2xxx file) until a general-release patch for both versions is released. This reverts the file version back to the 1xxx series, and the process begins again :)

It's like going down a High Street, and taking a left turn to get to a specialist shop for a temporary replacement part for your phone, then taking two right turns to get back to the main High Street a bit further down, where you can get the phone properly fixed, and continue on the way.

Dunno if that helps at all?

UsernameIssues · 18 Mar 2014

Works for me... thanks.