BootCamp applemtp.sys BSOD woes


UPDATE: Patch Tuesday seems to have fixed the original BSOD (that it caused), which leads to a BSOD if the below “fix” was in place. To put things back in working order, its a simple matter of walking through the steps below again and moving the applemtp.sys driver and associated files back where they belong. Very mysterious.

UPDATE 2: If I had to bet, I’d bet that either MS11-012 or MS11-013 were the culprits here. Both deal with kernel mode driver interaction with user mode. Why this situation played out the way it did is very peculiar though.

Has a routine Windows Update on your BootCamp enabled MacBook Air left you facing this?

Unpleasant to say the least! It’s a tricky problem and seems to be related to some inherent weirdness in the Apple multi-touch pointer driver that goes way back (there is Google history of this problem going back quite a while).

I’m not sure what set of conditions causes it yet, but it is hard to fix. Safe mode won’t work, nor will safe mode command prompt only. Restore last known good and System Restore both came up empty. Last known good tripped a BSOD as well (which is quite strange) and System Restore outright failed despite a restore point being available.

So how does one fix this annoying error? I took a bit of a sledge hammer approach… First, boot into BootCamp and select “Startup Repair”:

W7 startup menu with repair option

When startup repair launches, it will automatically attempt repairs. It won’t work, but this initial stage can’t be bypassed:

Startup Repair

Once it fails, you will get the option to try advanced options:

Startup repair failed

From the advanced options, the one we’re going to need is Command Prompt:

Recovery Options menu

From the command prompt, change to the C: drive and change directory to C:\Windows\System32\DriverStore\FileRepository\applemtp.inf_x86_neutral_35d22cf8
bad9797d>

C:\Windows\System32\DriverStore\FileRepository\applemtp.inf_x86_neutral_35d22cf8 bad9797d>

Create a directory called “tmp” by typing “md tmp” and move all of the files into it by typing “move *.* tmp”

Next change to C:\Windows\System32\Drivers and rename applemtp.sys to applemtp.bad and reboot

This is a bit of a sledgehammer fix that effectively makes Windows forget about the MTP driver altogether, but the system will now boot. Device Manager will show a device error:

applemtp device not found

Once I figure out what is going on with the applemtp driver, I will manually update to clear the error and post an updated entry on the blog.

Advertisements

4 thoughts on “BootCamp applemtp.sys BSOD woes

  1. Ben

    can you specify the patch you are referring to you in your update? I’m experiencing exactly the same issue and am faced with having no computer (because of BSODs) or a dysfunctional trackpad. Thanks for the info, btw, this was very helfpul.

    1. If I had to guess I would say either MS11-012 or MS11-013. Both deal with vulnerabilities in how kernel mode drivers interact with user mode. In looking at my system logs, I notice that the Windows Update on patch Tue (2/08) actually failed (even though it appeared to work). After that is when the blue screens started that moving the applemtp driver into limbo corrected. On 2/10, the update successfully managed to install (interesting). After that the blue screens started again *because* applemtp had been moved to limbo.

      As of now, the system is up to date on patches and applemtp is back and loading. What the heck happened is going to be hard to deduce without having had debug mode on at the time of the problem and having some traces and crash dumps.

      All I can think is that one of the failed installs the first time through the patches was actually partially successful and left the system in a state where applemtp.sys somehow could no longer function (its a kernel mode driver). Once the updates successfully completed, Im not sure why the absence of applemtp would all of a sudden start causing a bluescreen though (absence of applemtp hits the event log as a warning, not critical)

      Bizarre…

  2. Pete

    These instructions saved me and got me working again, thanks so much. But I did have to tinker with a few of your instructions. For instance C:\Windows\System32\DriverStore\FileRepository\applemtp.inf_x86_neutral_35d22cf8
    bad9797d> did not exist in my case, instead mine was called C:\Windows\System32\DriverStore\FileRepository\applemtp64.inf_amd64_neutral_651bc2d40afd56dc

    Also I had to also rename applemtm.sys to applemtm.bad

    I would be interested in hearing more followup when you have it.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s