none
IE 11 appcrash ntdll.dll - Windows Server 2012 R2 - help with analyzing the dump RRS feed

  • Question

  • Greetings,

    We have a Windows Server 2012 R2 running Citrix XenApp 7.6

    Our issue is  that IE 11 crashes from time to time for all users. We've tried disabled some plugins without success.

    The eventlog says:

      Problem Event Name:    APPCRASH
      Application Name:    iexplore.exe

     Fault Module Name:    ntdll.dll

    So I've collected some dump files for you to analyse, I don't know how to do that..

    Dump1: https://copy.com/W1GQcgoyB6sqvlar

    Dump2: https://copy.com/ZWXZr2uKd8FKj1J8

    Thanks in advance!



    • Edited by smekfis Wednesday, April 22, 2015 8:29 AM
    Wednesday, April 22, 2015 7:44 AM

Answers

  • In WinDbg if you run an !analyze you will see two third party modules are referenced, Flash.ocx and PseudoServerInprocLoader.dll:

    0:040> !analyze
    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    *** WARNING: Unable to verify timestamp for Flash.ocx
    *** ERROR: Module load completed but symbols could not be loaded for Flash.ocx
    *** WARNING: Unable to verify timestamp for PseudoServerInprocLoader.dll
    *** ERROR: Module load completed but symbols could not be loaded for PseudoServerInprocLoader.dll
    Probably caused by : mfcore.dll ( mfcore!CSampleQueue::Flush+1b )

    That those two modules are involved in the crash may indicate the issue is similar to what has been reported before such as in the following link:

    http://discussions.citrix.com/topic/312600-ie-crashing-with-latest-pseudoserverinproc2dll/

    There appears to be a hotfix for the PseudoServerInprocLoader.dll in  Citrix XenApp 7.67.6 if you wanted to give it a try:

    http://support.citrix.com/search?searchQuery=PseudoServerInprocLoader.dll&searchbtn.x=8&searchbtn.y=7

    • Marked as answer by smekfis Thursday, April 23, 2015 9:24 AM
    Wednesday, April 22, 2015 3:41 PM

All replies

  • I just tried the WinDbg and analized one of the dumps:

    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (6804.46e8): Access violation - code c0000005 (first/second chance not available)
    *** WARNING: Unable to verify timestamp for ntdll.dll
    *** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
    *** WARNING: Unable to verify timestamp for kernel32.dll
    *** ERROR: Module load completed but symbols could not be loaded for kernel32.dll
    eax=00000000 ebx=00000000 ecx=29cb4daf edx=7fb52000 esi=00000003 edi=00000003
    eip=77b4cbec esp=15a9e844 ebp=15a9e9cc iopl=0         nv up ei pl nz na pe nc
    cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206
    ntdll+0x3cbec:
    77b4cbec c21400          ret     14h

    Any suggestions? Repair ntdll.dll?

    Wednesday, April 22, 2015 11:23 AM
  • In WinDbg if you run an !analyze you will see two third party modules are referenced, Flash.ocx and PseudoServerInprocLoader.dll:

    0:040> !analyze
    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    *** WARNING: Unable to verify timestamp for Flash.ocx
    *** ERROR: Module load completed but symbols could not be loaded for Flash.ocx
    *** WARNING: Unable to verify timestamp for PseudoServerInprocLoader.dll
    *** ERROR: Module load completed but symbols could not be loaded for PseudoServerInprocLoader.dll
    Probably caused by : mfcore.dll ( mfcore!CSampleQueue::Flush+1b )

    That those two modules are involved in the crash may indicate the issue is similar to what has been reported before such as in the following link:

    http://discussions.citrix.com/topic/312600-ie-crashing-with-latest-pseudoserverinproc2dll/

    There appears to be a hotfix for the PseudoServerInprocLoader.dll in  Citrix XenApp 7.67.6 if you wanted to give it a try:

    http://support.citrix.com/search?searchQuery=PseudoServerInprocLoader.dll&searchbtn.x=8&searchbtn.y=7

    • Marked as answer by smekfis Thursday, April 23, 2015 9:24 AM
    Wednesday, April 22, 2015 3:41 PM
  • Hi auggy!

    Thank you so much, we will try the appropiate fix.

    I've seen you in other threads here on microsoft forum, when people needed dump-file assistans.

    I was hoping to hear from you! :)

    Thursday, April 23, 2015 9:24 AM
  • You're welcome and hopefully the problem will be resolved.
    Thursday, April 23, 2015 11:40 AM