Ctxhide Look and Feel has stopped working

Reference problem post : http://forums.citrix.com/thread.jspa?messageID=1409280

Here is my environment : Windows 2008 SP2 with MUI pack installed and Citrix XenApp 5 with latest hotfixes and Citrix Edgesight XenApp Agent 5.1 . I get this error when I open a console on the XenApp servers and it seems to popup in some user’s session…

snap00048

Click on read more to continue…

Problem signature:  
Problem Event Name: BEX
Application Name: CtxHide.exe
Application Version: 5.0.0.5357
Application Timestamp: 48a7429b
Fault Module Name: apphelp.dll
Fault Module Version: 6.0.6002.18005
Fault Module Timestamp: 49e036f3
Exception Offset: 000012a5
Exception Code: c0000005
Exception Data: 00000008
OS Version: 6.0.6002.2.2.0.16.7
Locale ID: 1036
Additional Information 1: fd00
Additional Information 2: ea6f5fe8924aaa756324d57f87834160
Additional Information 3: fd00
Additional Information 4: ea6f5fe8924aaa756324d57f87834160

And in the system’s event log :

snap00049

Log Name:      Application
Source:        Application Error
Date:          29/09/2009 14:40:59
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      EMCXPA1031.emea.cib
Description:
Faulting application CtxHide.exe, version 5.0.0.5357, time stamp 0x48a7429b, faulting module apphelp.dll, version 6.0.6002.18005, time stamp 0x49e036f3, exception code 0xc0000005, fault offset 0x000012a5, process id 0x18a0, application start time 0x01ca410218e4f98f.
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event“>
<System>
<Provider Name=”Application Error” />
<EventID Qualifiers=”0″>1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”2009-09-29T12:40:59.000Z” />
<EventRecordID>3694</EventRecordID>
<Channel>Application</Channel>
<Computer>EMCXPA1031.emea.cib</Computer>
<Security />
</System>
<EventData>
<Data>CtxHide.exe</Data>
<Data>5.0.0.5357</Data>
<Data>48a7429b</Data>
<Data>apphelp.dll</Data>
<Data>6.0.6002.18005</Data>
<Data>49e036f3</Data>
<Data>c0000005</Data>
<Data>000012a5</Data>
<Data>18a0</Data>
<Data>01ca410218e4f98f</Data>
</EventData>
</Event>

I found some guys who have exactly the same issue and it seems MUI related, the thread on the Citrix’s forum is here : http://forums.citrix.com/thread.jspa?messageID=1409280 .

Update 01 October 2009 10:00am :

I got a dump of this crash :

*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************
Unable to load image c:\Program Files (x86)\Citrix\System32\ctxhide.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ctxhide.exe
Unable to load image C:\Windows\System32\csma_ldr32.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for csma_ldr32.dll
*** ERROR: Module load completed but symbols could not be loaded for csma_ldr32.dll
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
FAULTING_IP:
apphelp!__security_check_cookie+0
732012a5 3b0d00802273    cmp     ecx,dword ptr [apphelp!__security_cookie (73228000)]
EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 732012a5 (apphelp!__security_check_cookie)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000008
   Parameter[1]: 732012a5
Attempt to execute non-executable address 732012a5
PROCESS_NAME:  ctxhide.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_PARAMETER1:  00000008
EXCEPTION_PARAMETER2:  732012a5
WRITE_ADDRESS:  732012a5
FOLLOWUP_IP:
apphelp!__security_check_cookie+0
732012a5 3b0d00802273    cmp     ecx,dword ptr [apphelp!__security_cookie (73228000)]
AUTOBUG_USER_LCID_STR:  ENU
AUTOBUG_OS_SKU:  7
NTGLOBALFLAG:  0
APPLICATION_VERIFIER_FLAGS:  0
FAULTING_THREAD:  00001ab8
BUGCHECK_STR:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_FALSE_POSITIVE_SOFTWARE_NX_FAULT
PRIMARY_PROBLEM_CLASS:  SOFTWARE_NX_FAULT_FALSE_POSITIVE
DEFAULT_BUCKET_ID:  SOFTWARE_NX_FAULT_FALSE_POSITIVE
LAST_CONTROL_TRANSFER:  from 732092d1 to 732012a5
STACK_TEXT:
0027ee8c 732092d1 00000000 00000000 00001521 apphelp!__security_check_cookie
0027f0fc 73209571 000001a8 00000000 00000000 apphelp!InternalCheckRunApp+0x5a3
0027f158 76a6bad7 000001a8 00000000 00000000 apphelp!ApphelpCheckRunAppEx+0x91
0027f1c0 769f69e8 00000000 000001a8 00342ee0 kernel32!BasepSkipSetupShims+0x1db
0027f20c 769f698e 00000000 000001a8 00342ee0 kernel32!BaseCheckRunApp+0x46
0027f250 769f690a 00000000 000001a8 00342ee0 kernel32!BasepCheckBadapp+0x6e
0027f29c 76a0d7fc 00000000 00000000 00000000 kernel32!BasepQueryAppCompat+0x60
0027f8dc 769e0c3b 00000000 00000000 002b128a kernel32!CreateProcessInternalW+0x1346
0027f914 664a16cc 00000000 002b128a 00000000 kernel32!CreateProcessW+0x2c
0027f9c0 664a188b 664a0000 00000000 002b2974 ctxhide!WinMain+0x1fc
0027fa50 76a5eccb 7efde000 0027fa9c 775fd24d ctxhide!NtCurrentTeb+0x192
0027fa5c 775fd24d 7efde000 6286a6a9 00000000 kernel32!BaseThreadInitThunk+0xe
0027fa9c 775fd45f 664a1a68 7efde000 ffffffff ntdll!__RtlUserThreadStart+0x23
0027fab4 00000000 664a1a68 7efde000 00000000 ntdll!_RtlUserThreadStart+0x1b
STACK_COMMAND:  ~0s; .ecxr ; kb
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  apphelp!__security_check_cookie+0
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: apphelp
IMAGE_NAME:  apphelp.dll
DEBUG_FLR_IMAGE_TIMESTAMP:  49e036f3
FAILURE_BUCKET_ID:  SOFTWARE_NX_FAULT_FALSE_POSITIVE_c0000005_apphelp.dll!__security_check_cookie
BUCKET_ID:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_FALSE_POSITIVE_SOFTWARE_NX_FAULT_apphelp!__security_check_cookie+0
WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/ctxhide_exe/5_0_0_5357/48a7429b/apphelp_dll/6_0_6002_18005/49e036f3/c0000005/000012a5.htm?Retriage=1
Followup: MachineOwner
---------
0:000> lmvm apphelp
start    end        module name
73200000 7322c000   apphelp    (pdb symbols)          C:\Program Files\Debugging Tools for Windows (x86)\sym\apphelp.pdb\106D8ED641E04B8680350C1D3E541ADF2\apphelp.pdb
    Loaded symbol image file: apphelp.dll
    Mapped memory image file: C:\Program Files\Debugging Tools for Windows (x86)\sym\apphelp.dll\49E036F32c000\apphelp.dll
    Image path: C:\Windows\System32\apphelp.dll
    Image name: apphelp.dll
    Timestamp:        Sat Apr 11 08:21:39 2009 (49E036F3)
    CheckSum:         0002C264
    ImageSize:        0002C000
    File version:     6.0.6002.18005
    Product version:  6.0.6002.18005
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     Apphelp
    OriginalFilename: Apphelp
    ProductVersion:   6.0.6002.18005
    FileVersion:      6.0.6002.18005 (lh_sp2rtm.090410-1830)
    FileDescription:  Application Compatibility Client Library
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

 

There is no fix until now even in limited hotfixes. Stay tune !

Edit 16 October 2009 : Kegan gave the tip and it seems to fix this issue. With Edgesight XenApp agent updated to 5.2 this issue disapear. I have try to open 40 or 50 session without beeing able to see this error yet. Thanks Kegan !

But I still don’t understand why this issue appear and why apphelp.exe is involve…

Post author