[Tommy]

Having a problem trying to install the new v2.2i kernel extension. It complains that atl.dll is in use...however, I can't terminate everything connected to it otherwise I get a BSoD. What's up?

[blackwingcat]

In almost cases, you can installe it with terminate explorer.exe
and you can search using program with process explorer "Find handle or DLL"
But don't terminate winlogon and lsass.
you can terminate svchost with services manager.

SearanoX, on 05 October 2012 - 10:37 PM, said:

Having a problem trying to install the new v2.2i kernel extension. It complains that atl.dll is in use...however, I can't terminate everything connected to it otherwise I get a BSoD. What's up?

[Tommy]

Well, we have another slight problem. I did finally manage to get passed that atl.dll problem, only to be greeted with some more glad tidings on the next boot. I got a nice BSoD with the code 0x0000007B, Inaccessable_Boot_Device, had to log into the recovery console once more to remove the hotfix. Hope this new information comes in handy.

[blackwingcat]

Can you test to replace ATL.DLL version to 3.5.2284.2 and 3.5.2284.3 ?

SearanoX, on 06 October 2012 - 10:51 PM, said:

Well, we have another slight problem. I did finally manage to get passed that atl.dll problem, only to be greeted with some more glad tidings on the next boot. I got a nice BSoD with the code 0x0000007B, Inaccessable_Boot_Device, had to log into the recovery console once more to remove the hotfix. Hope this new information comes in handy.

[piotrhn]

If i use comctl32.dll ver(6.00.2900.6029), these programs croashes


SIGVERIF.EXE
starts and scan files ok, but when i click on advanced program crashes
sigverif works when comctl32 is 5.81 (2k)


CLICONFG.EXE
When try run cliconfg.exe app doesn't start only Error log is created
cliconcfg works if comctl32 is 5.81 (2k) & 5.82.**.**.6028, doesn't work with 6029

[blackwingcat]

comctl32 is installed in %systemroot%\systemxp
You can copy from there to the folder which application uses comctl v6.0 like BitTorrent and notepad++ and IE6SP3.
Don't copy it into system32.

piotrhn, on 09 October 2012 - 02:32 AM, said:

If i use comctl32.dll ver(6.00.2900.6029), these programs croashes


SIGVERIF.EXE
starts and scan files ok, but when i click on advanced program crashes
sigverif works when comctl32 is 5.81 (2k)


CLICONFG.EXE
When try run cliconfg.exe app doesn't start only Error log is created
cliconcfg works if comctl32 is 5.81 (2k) & 5.82.**.**.6028, doesn't work with 6029

This post has been edited by blackwingcat: 09 October 2012 - 07:15 PM

[plachance]

blackwingcat, on 02 October 2012 - 05:40 PM, said:

Hi,
What is MS12-095 issue ?
(Is it the future Microsoft Security Hole? http://technet.micro...lletin/ms12-095 )
On Windows 2000 iso file can be mount by Microsoft VCD Driver.

plachance, on 02 October 2012 - 12:02 PM, said:

Hi, Just coming out of windows 98 kernel ex and I have 1 machine that is a win2k server which I need to keep running for the for see able future. I have managed to install V1.5 for this machine but can't bring it up to V2.2 because of the MS12-095 issue. I understand there is an ISO that it can be extracted from but I can't seem to find it in the ISO. If someone would be so kind as to let me know what I need to do to finish the V2.2 upgrade it would be appreciated. THX!

Thanks! VCD driver did the trick... Now to retry installing v2.2!

[Tommy]

I'm not sure if this relates to the kernel extension or not but it seems like launching any type of MSI via InstallShield wizard, I get a weird error such as 'The instruction at "0x7d2c1ec9" reference memory at "0x7d2c1ec9". The memory could not be "read". Is there a way to fix that error since most of them come up very similar to that?

[erpdude8]

hi blackwingcat. see the following picture below:



this is a WinXP version of the shell32.dll file with exFAT support if KB955704 or any subsequent shell32.dll update after that is installed [I viewed the contents of the DLL file in Notepad; hence "e x F A T" is highlighted].

can you try to add exFAT support into shell32.dll for your KernelEx project for Win2000?

[jimmsta]

I'm only guessing here, so don't crucify me - is it right to assume that if shell32.dll doesn't _know_ about other filesystem's, it will show the drives that have those filesystems as being unformatted? If that were the case, then addon programs like ext2fs driver and MacDrive would not be able to function. What I'm getting at here, is that perhaps we need some sort of filter driver to place in between the exfat driver and the OS. Not knowing the internals of how the exfat driver work,s I can only guess how it interfaces within XP, let alone 2000. I'm all for trying everything to get exFat working on win2k, since I'm starting to use and see exfat used more and more, and, hell, exFat is a great filesystem for larger volumes where NTFS isn't needed.

[tomasz86]

DanR20, on 19 September 2012 - 03:45 PM, said:

After installing 2.2 there was an extra service running in Task Manager but couldn't figure out what it was. Finally nailed it down to Cryptographic Services?

@blackwingcat

I'm just wondering... what exactly do we gain from this Cryptographic Service?

[Tommy]

The only thing I can possibly figure out that would benefit from the cryptographic service is if we could figure out how to get IE7 functional. But maybe blackwingcat knows other reasons for having it.

[blackwingcat]

Did you use exteneded kernel v22i3 or i4 ?
Can you tell me what module in 0x7d2c1ec9 ?

SearanoX, on 12 October 2012 - 05:38 PM, said:

I'm not sure if this relates to the kernel extension or not but it seems like launching any type of MSI via InstallShield wizard, I get a weird error such as 'The instruction at "0x7d2c1ec9" reference memory at "0x7d2c1ec9". The memory could not be "read". Is there a way to fix that error since most of them come up very similar to that?

[Tommy]

I don't have the latest updates installed. The latest I have as of now is v22g installed, however it's been an ongoing thing for a few of these packs now. It unfortunately doesn't say which module is in question. But this is what I get out of the event viewer.

Application popup: Setup.exe - Application Error : The instruction at "0x7d2c1ec9" referenced memory at "0x7d2c1ec9". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

I'm almost positive that this is an installshield MSI setup installer. However, a very similar thing happens when I try installing the Logitech (Logicool) webcam setup too. It's been going on for at least a month now. And maybe this might help as well but I tried installing Microsoft Security Essentials as well but I also get an error similar to that, but I didn't when I tested it on a Microsoft only updated system. Attempting to install it on this machine results in these errors in the event viewer.

Application popup: setup.exe - Application Error : The instruction at "0x7d2de372" referenced memory at "0x7d2de372". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

*And*

Application popup: setup.exe - Application Error : The instruction at "0x7d27cd05" referenced memory at "0x7d27cd05". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

Hopefully this information helps, and I will try and install the updated kernel extensions and see what happens.

[piotrhn]

Microsoft Security Essentials needs these functions:


NISSRV.EXE
InterlockedCompareExchange64

NISDRVWFP.SYS:
ExDeleteLookasideListEx
EtwRegister
EtwUnregister
ExInitializeLookasideListEx
WmiQueryTraceInformation
ZwOpenProcessTokenEx
IoQueryFileDosDeviceName
EtwWrite
PoUnregisterPowerSettingCallback
PoRegisterPowerSettingCallback
WmiTraceMessage


MPFILTER.SYS:
VerSetConditionMask
PsRemoveCreateThreadNotifyRoutine
WmiQueryTraceInformation
RtlVerifyVersionInfo
PsRemoveLoadImageNotifyRoutine
RtlHashUnicodeString
CmRegisterCallback
ZwOpenThreadTokenEx
ZwOpenProcessTokenEx
PsDereferencePrimaryToken
PsIsSystemThread
IoQueryFileDosDeviceName
CmUnRegisterCallback

MPBOOT.SYS:
memcpy_s
CmRegisterCallback
CmUnRegisterCallback
CmCallbackGetKeyObjectID

This post has been edited by piotrhn: 15 October 2012 - 03:16 PM

[Tommy]

That's quite a few functions. However, I was just saying that the error didn't come up on my test machines. Of course the installer itself failed but it didn't come up with a critical stop saying such and such cannot be read like it does on my main machine. It almost seems like it's related to the Windows Installer somehow, but I don't know. I could be wrong. Aside from USP5 and UpdateRollup 2, all I use as far as unofficial updates are blackwingcat's kernel extensions.

This post has been edited by SearanoX: 15 October 2012 - 05:42 PM

[tomasz86]

@

What's yourr MSI.DLL version?

[Tommy]

@tomasz86

My msi.dll version is: 3.1.4001.5842

[tomasz86]

SearanoX, on 15 October 2012 - 07:38 PM, said:

@tomasz86

My msi.dll version is: 3.1.4001.5842

I think that you didn't tell us everything

Quote

Aside from USP5 and UpdateRollup 2, all I use as far as unofficial updates are blackwingcat's kernel extensions.

MSI.DLL 3.1.4001.5842 is NOT included in any of those packages. You must've installed other updates too. Are you 100% sure that the problem happens with MSI installers only? Do any of them work or all just fail to start? Could you go to Services (services.msc) and try to manually start "Windows Installer"? What happens?

Even if it's not directly related to the issue which you've been experiencing, I myself did test this particular version of MSI.DLL in the past and found it very problematic (if not buggy). Windows Installer service just refused to start randomly. The situation came back to normal after I've restored the previous version (KB968006).

[blackwingcat]

Version v22 series and previous v22i2　 is so buggy that I delete Extended Kernel blog page before.
There are many reasons why the installer crashes with v22g.

SearanoX, on 15 October 2012 - 11:36 AM, said:

I don't have the latest updates installed. The latest I have as of now is v22g installed, however it's been an ongoing thing for a few of these packs now. It unfortunately doesn't say which module is in question. But this is what I get out of the event viewer.