BSOD on ntkrnlmp.exe

yadeki · 17 Feb 2016

Hello,

I have a laptop where I get this BSOD on the ntkrnlmp.exe. I cannot find what is wrong.
Can someone help me troubleshoot this please?

Thanks in advance!

Arc · 18 Feb 2016

You have enabled driver verifier which caught Citrix as the guilty.

Code:

BugCheck C9, {23e, fffff8800484b790, fffff980152e2e10, 1}

Unable to load image \SystemRoot\system32\DRIVERS\ctxusbm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ctxusbm.sys
*** ERROR: Module load completed but symbols could not be loaded for ctxusbm.sys
Probably caused by : ctxusbm.sys ( ctxusbm+16790 )

Followup:     MachineOwner
---------

So if possible let it go, at least as a test basis.

But a non-verifier dump points to Lenovo HDD utility driver; which is a factory bloatware.

Code:

fffff880`073cad58  fffff880`01e0223dUnable to load image \SystemRoot\System32\DRIVERS\Apsx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Apsx64.sys
*** ERROR: Module load completed but symbols could not be loaded for Apsx64.sys
 Apsx64+0x223d

So I'd recommend you to Clean Up Factory Bloatware, with a special reference to Point #19

19. Consider a Clean Reinstall - Factory OEM Windows 7 which is often better than getting a new computer considering how pre-installed bloatware can corrupt Windows 7 even if it's completely cleaned up.

yadeki · 18 Feb 2016

Arc said:

But a non-verifier dump points to Lenovo HDD utility driver; which is a factory bloatware.

Code:

fffff880`073cad58  fffff880`01e0223dUnable to load image \SystemRoot\System32\DRIVERS\Apsx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Apsx64.sys
*** ERROR: Module load completed but symbols could not be loaded for Apsx64.sys
 Apsx64+0x223d

Hello Arc,

Thank you very much!
How did you get to the non-verified dump? I have a few other laptops that have BSOD and found nothing more when investigating the dump file via WinDbg. Especially the above warning and error is interesting to know, but I never got to that point.

Thanks.

I already upgraded the Citrix receiver for the ctxusbm.sys BSOD.

Arc · 18 Feb 2016

yadeki said:

How did you get to the non-verified dump?

Not non-verified but non-verifier enabled.

yadeki · 19 Feb 2016

Arc said:

But a non-verifier dump points to Lenovo HDD utility driver; which is a factory bloatware.

Code:

fffff880`073cad58  fffff880`01e0223dUnable to load image \SystemRoot\System32\DRIVERS\Apsx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Apsx64.sys
*** ERROR: Module load completed but symbols could not be loaded for Apsx64.sys
 Apsx64+0x223d

Hello Arc,

Thank you. Can you help me getting to the above point?
If I open the crashdump and use "!analyze -v" than I don't get the above information. I get this.

Code:

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 0000000000000004, Memory contents of the pool block
Arg4: fffff8a0039cab50, Address of the block of pool being deallocated

Am I missing some commands? I have a few other laptops with BSOD so I don't want to create a forum post for each of the BSOD.

Arc · 19 Feb 2016

yadeki said:

Thank you. Can you help me getting to the above point?

I am sorry mate, I dont have that much time nowadays. I just get some little time to come to this forum and I try to help other members out of it. Teaching debugging techniques is very time consuming, and it is not unique in most of the cases.

yadeki · 19 Feb 2016

Arc said:

yadeki said:

Thank you. Can you help me getting to the above point?

I am sorry mate, I dont have that much time nowadays. I just get some little time to come to this forum and I try to help other members out of it. Teaching debugging techniques is very time consuming, and it is not unique in most of the cases.

Do you maybe know a useful manual I can read? I cannot find any useful thing on google...
The help in WinDbg is not that clear.

Many thanks already for your help!

Arc · 19 Feb 2016

Here are some documents which are having some (a little) advanced windbg techniques: https://www.sevenforums.com/crash-lockup-debug-how/

yadeki · 21 Feb 2016

Arc said:

Here are some documents which are having some (a little) advanced windbg techniques: https://www.sevenforums.com/crash-lockup-debug-how/

Ok thank you!

The thing is that on these clients I usually get BSOD on 'ntkrnlmp.exe' which I cannot get deeper on it. I never have the situation like in the tutorials where you have the answer already in the "Probably caused by: xxx.sys".