Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD


  • Please log in to reply
6 replies to this topic

#1 teaman*33

teaman*33

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Illinois
  • Local time:10:29 AM

Posted 06 July 2015 - 10:20 PM

Hi-

I started to get a constant BSOD, in a constant loop, shutting and starting my computer one day last week.  It seemed to start after Windows automatically installed a new "mouse an keyboard center".  I booted into safe mode and removed it and it worked for the next few hours.  Today, the next time, it booted, then started to install this program again, which I stopped from installing, and it worked for a few hours, but then again gave me a BSOD.  At this point,I had the computer set to not restart and the screen said:

ctxusbm.sys

0x00000c9

4dcc9fdc

The "mouse" program was not installed for me to delete this time.  My computer is not set to install automatic updates.  I did not generate the 2nd perfmon report for unclear reasons to me?

It is a Dell Vostro 470 desktop 9/2012 hardware and OS

Win 7 64bit OEM (original pre-installed, never re-installed)

Intel 3.1GH i5-3450

Motherboard is Dell Inc OYJPT1  A00

Nvidea Geforce GT 620

 

Attached is the 1st file.  If you can explain how I can generate the perfmon report I will send it.

Thank you for any help.

 

 

Attached Files



BC AdBot (Login to Remove)

 


#2 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:11:29 AM

Posted 07 July 2015 - 06:11 AM

Don't worry about perfmon for right now.  Most of the info is included in the other reports.  If we need perfmon, we'll provide some more info on how to do it.

 

Your UEFI/BIOS (version A06) dates from 2012.  Please check at the manufacturer's website to see if there are any UEFI/BIOS updates available for your system.  If you are able to install the update through Windows (without booting from an external drive), then go ahead and update it.

This driver is not loaded:

 

Security Processor Loader Driver    ROOT\LEGACY_SPLDR\0000    This device is not present, is not working properly, or does not have all its drivers installed.

This is most likely the spldr.sys driver which is a part of Windows.

I'd strongly suggest running SFC.EXE /SCANNOW from an elevated (run as Adminstrator) Command Prompt

Then open up MSINFO32...Components...Problem Devices to see if it has been fixed.

 

There may be a connection between running Windows Defender and the Norton Internet Security.

Try disabling Windows Defender and see if that helps.  If Microsoft Security Essentials is installed, please uninstall it also.

 

There are 3 BSOD's listed in the WER section of MSINFO32, yet there's only 1 memory dump in the uploaded files.

The other 2 memory dumps/BSOD's were caused by NETIO.sys - a Windows networking driver.

 

If you are running Driver Verifier, please turn it off.  To do this, open up verifier.exe and select "Delete existing settings", click on "Finish" and then reboot in order to make the changes take effect.

 

The last BSOD was a Driver Verifier enabled memory dump and it blames ctxusbm.sys - a driver for your Citrix ICA Client USB Monitor

Uninstall the Citrix program to see if that stops the BSOD's.  If needed, feel free to install a freshly downloaded copy of the program AFTER you've uninstalled the current copy on your system.  In the event that the Citrix ICA Client USB Monitor Driver isn't to blame, keep an eye on which USB devices you have connected to the system.

 

Analysis:
The following is for informational purposes only.

[font=lucida console]**************************Mon Jul  6 21:32:49.439 2015 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\070615-83866-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Built by: [B]7601[/B].18839.amd64fre.win7sp1_gdr.150427-0707
System Uptime:[B]0 days 0:58:19.267[/B]
*** WARNING: Unable to verify timestamp for ctxusbm.sys
*** ERROR: Module load completed but symbols could not be loaded for ctxusbm.sys
Probably caused by :[B]ctxusbm.sys ( ctxusbm+f200 )[/B]
BugCheck [B]C9, {224, fffff88004938200, fffff98122948cf0, 3}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000C9]DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)[/url]
Arguments:
Arg1: 0000000000000224, An IRP dispatch handler has returned a status that is inconsistent with the
    IRP's IoStatus.Status field.
Arg2: fffff88004938200, The address in the driver's code where the error was detected.
Arg3: fffff98122948cf0, IRP address.
Arg4: 0000000000000003, Expected status code.
BUGCHECK_STR:  0xc9_224
PROCESS_NAME:  System
FAILURE_BUCKET_ID: [B]X64_0xc9_224_VRF_ctxusbm+f200[/B]
CPUID:        "Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz"
MaxSpeed:     3100
CurrentSpeed: [B]3096[/B]
  BIOS Version                  A06
  BIOS Release Date             05/25/2012
  Manufacturer                  Dell Inc.
  Product Name                  Vostro 470
  Baseboard Product             0YJPT1
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.
[font=lucida console]**************************Mon Jul  6 21:32:49.439 2015 (UTC - 4:00)**************************
intelppm.sys                Mon Jul 13 19:19:25 2009 (4A5BC0FD)
PxHlpa64.sys                Tue Oct 20 14:08:42 2009 (4ADDFCAA)
amdxata.sys                 Fri Mar 19 12:18:18 2010 (4BA3A3CA)
ctxusbm.sys                 Thu May 12 23:05:00 2011 (4DCC9FDC)
Rt64win7.sys                Wed Nov 23 10:00:40 2011 (4ECD0A98)
iaStor.sys                  Tue Nov 29 22:39:19 2011 (4ED5A567)
IntcDAud.sys                Tue Dec  6 06:23:07 2011 (4EDDFB1B)
athrx.sys                   Mon Dec 12 08:02:13 2011 (4EE5FB55)
btfilter.sys                Mon Dec 26 02:35:06 2011 (4EF823AA)
RTKVHD64.sys                Tue Dec 27 08:09:24 2011 (4EF9C384)
iusb3hub.sys                Fri Jan 27 04:35:25 2012 (4F226FDD)
iusb3xhc.sys                Fri Jan 27 04:35:28 2012 (4F226FE0)
iusb3hcs.sys                Fri Jan 27 04:37:23 2012 (4F227053)
HECIx64.sys                 Mon Jul  2 18:14:58 2012 (4FF21D62)
nvhda64v.sys                Mon Jul 21 10:17:53 2014 (53CD2111)
SRTSPX64.SYS                Tue Aug 26 02:36:42 2014 (53FC2AFA)
nvlddmkm.sys                Sat Sep 13 15:59:50 2014 (5414A236)
nvpciflt.sys                Sat Sep 13 16:02:34 2014 (5414A2DA)
EX64.SYS                    Sat Nov 15 04:14:03 2014 (5467195B)
ENG64.SYS                   Sat Nov 15 04:15:33 2014 (546719B5)
SYMEVENT64x86.SYS           Mon Jan 19 17:43:56 2015 (54BD88AC)
Ironx64.SYS                 Mon May  4 19:51:42 2015 (5548060E)
SYMEFASI64.SYS              Thu May  7 05:44:15 2015 (554B33EF)
SYMNETS.SYS                 Fri May  8 18:20:49 2015 (554D36C1)
SRTSP64.SYS                 Mon May 11 12:53:58 2015 (5550DEA6)
IDSvia64.sys                Mon May 11 18:15:04 2015 (555129E8)
BHDrvx64.sys                Tue May 12 16:20:53 2015 (555260A5)
eeCtrl64.sys                Thu May 14 22:23:14 2015 (55555892)
EraserUtilRebootDrv.sys     Thu May 14 22:23:14 2015 (55555892)
[/font]
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=PxHlpa64.sys
http://www.carrona.org/drivers/driver.php?id=amdxata.sys
http://www.carrona.org/drivers/driver.php?id=ctxusbm.sys
http://www.carrona.org/drivers/driver.php?id=Rt64win7.sys
http://www.carrona.org/drivers/driver.php?id=iaStor.sys
http://www.carrona.org/drivers/driver.php?id=IntcDAud.sys
http://www.carrona.org/drivers/driver.php?id=athrx.sys
http://www.carrona.org/drivers/driver.php?id=btfilter.sys
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
http://www.carrona.org/drivers/driver.php?id=iusb3hub.sys
http://www.carrona.org/drivers/driver.php?id=iusb3xhc.sys
http://www.carrona.org/drivers/driver.php?id=iusb3hcs.sys
http://www.carrona.org/drivers/driver.php?id=HECIx64.sys
http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys
http://www.carrona.org/drivers/driver.php?id=SRTSPX64.SYS
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys
http://www.carrona.org/drivers/driver.php?id=nvpciflt.sys
http://www.carrona.org/drivers/driver.php?id=EX64.SYS
http://www.carrona.org/drivers/driver.php?id=ENG64.SYS
http://www.carrona.org/drivers/driver.php?id=SYMEVENT64x86.SYS
http://www.carrona.org/drivers/driver.php?id=Ironx64.SYS
SYMEFASI64.SYS - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=SYMNETS.SYS
http://www.carrona.org/drivers/driver.php?id=SRTSP64.SYS
http://www.carrona.org/drivers/driver.php?id=IDSvia64.sys
http://www.carrona.org/drivers/driver.php?id=BHDrvx64.sys
http://www.carrona.org/drivers/driver.php?id=eeCtrl64.sys
http://www.carrona.org/drivers/driver.php?id=EraserUtilRebootDrv.sys
 
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#3 teaman*33

teaman*33
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Illinois
  • Local time:10:29 AM

Posted 07 July 2015 - 03:12 PM

Usasma-
Thank you for the lengthy evaluation. It is very much appreciated. I will be at my computer later tonight and do as you instructed.
Regards,

#4 teaman*33

teaman*33
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Illinois
  • Local time:10:29 AM

Posted 08 July 2015 - 03:57 AM

Hi-

I updated my BIOS without difficulty.

I ran the scannow and found the same problem under problem devices, not fixed with the "Security Processor Loader Driver  ROOT\LEGACY...does not have all its drivers installed."

Windows Defender was already turned off.

Microsoft Essentials was not installed.

Driver Verifier was running, so I turned it off.

I spent a lot of time uninstalling Citrix, which I have done many times before and once again could not do a good job even with its so called clean-up utility.  It is notorious for leaving much behind especially in the registry, and pages of details need to be followed to manually remove everything or the re-install does not go smoothly.  I never did get it all removed, and in the registry I found ctxusbm which I could not delete, I believe my permissions did not allow it, and I am poor at changing that.  I found the same problem with the documents folder which was locked.

So, that is where I am at this point.  The Citrix is important for me to be able to re-install for me to connect to two other programs I use frequently, and I am not sure what to do about the missing spldr.sys driver.

I have not had a BSOD for the last several hours though.

Any further suggestions at this point?

Thank you.


Edited by teaman*33, 08 July 2015 - 03:58 AM.


#5 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:11:29 AM

Posted 08 July 2015 - 07:03 AM

I would check at the Citrix website for a more current version:  http://www.citrix.com/downloads.html

I'd also keep an eye on the Security Processor Loader driver - it's a critical component of Windows.

 

Try this set of fixes.  Although focused on Windows Updates, it will also help with SFC.EXE:

 

There's not many experts at fixing Windows Updates.
I am not one of them.
But the few experts that there are a sorely overworked - so getting a reply will be difficult.
I'll continue to attempt to help here, but please bear with me.


First, please try the Windows Update troubleshooter/fixes listed here:
Windows Update Troubleshooter:  https://support.microsoft.com/en-us/gp/windows-update-issues/en-us
Windows Update Troubleshooter KB article:  https://support.microsoft.com/en-us/kb/2714434
Reset Windows Update Components KB article:  https://support.microsoft.com/en-us/kb/971058

Then, if that doesn't fix the Windows Update problem, please do the following. (copied from here:  http://www.sysnative.com/forums/windows-update/4736-windows-update-forum-posting-instructions.html ):
Run SFCFix

    This free tool of neimiro's creation (see above link) is a very good starting point for the diagnosis and repair of all Windows Update and System File Checker corruptions. We therefore need you to run this tool prior to collecting logfiles.

        -  First download and run a copy of the tool from http://www.sysnative.com/niemiro/apps/SFCFix.exe.
        -  Work through any on-screen prompts and then await completion (runtime is approximately 15 minutes).
        -  Once it has finished, if there are any unrepaired corruptions (the tool will notify you if it has succeeded in repairing all corruptions if they're simple in which case we're no longer needed) or unresolved problems with your computer, you need to post us the complete logfile which opens on exit. Simply copy (Ctrl-A, Ctrl-C) and paste (Ctrl-V) the entire logfile into your new thread (also know as a 'topic'). How to create a new thread is shown later on in this post.


My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#6 teaman*33

teaman*33
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Illinois
  • Local time:10:29 AM

Posted 13 July 2015 - 01:17 AM

Hi usasma-

Sorry to not get back to you sooner, but I had to convince myself that the blue screens were gone long enough to say so, and I have not had one since your first set of instructions! After the last reply, I updated Citrix with the latest one from its site, and it is a great improvement over any that they have put together before, backwards compatible and replacing several different forms of that program they had individually released previously....highly recommended to check it out for anyone using it...it is much smoother functioning.
Anyway, I ran the Microsoft products without anything found or at least that it identified as fixable.
I then ran SFCFix twice. The first time it found 2 corrupt files it fixed. Then, figuring if I ran it again, it should show no further "corrupt" files, but much to my surprise, it found another long system file of some sort that was certainly beyond anything I could identify or describe that the program again fixed. At that point, I figured that the program was doing some kind of magic beyond my understanding, and that it would be prudent to not repeat that unless you told me to do it another time. I had no idea why a third file was not found on the first run, so that was it for me. Is that a program to repeat until it says nothing else is corrupt or is once enough?
Thank you for your help.
As I said, no further BSOD thus far. Great! Thank you so much.

#7 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:11:29 AM

Posted 13 July 2015 - 04:58 PM

I've spoken with niemiro (who wrote the program) and I really don't understand it.

I believe in him, so I post this to help out with Windows Update/SFC problems - but it's not intended to fix everything.

If you want to pursue it, post over in the Windows 7 forum with the hopes that an expert here picks up on the topic (mention SFCFix in the post title).

Or, you can register and post over at Sysnative ( http://www.sysnative.com/ ).

Regardless of where you post, don't expect an answer right away - they're even busier than the BSOD analysts!

 

Keep an eye on the system for 2 weeks.

If it goes that long without a BSOD, then it's probably fixed.

Good luck!


My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users