Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

STATUS_DLL_INIT_FAILED from SetupApi

Maxim_S._ShatskihMaxim_S._Shatskih Member Posts: 10,396
I saw some Windows machines where the SetupAPI calls used to install the driver package are failing with STATUS_DLL_INIT_FAILED.

Setupapi.dev.log says that it is the drvinst.exe process (spawned by SetupAPI at some moment) who fails (I think at process init time) with this error.

Future investigation have shown that, on such a machine, ANY PnP driver package cannot be installed, not only ours. The PnP install subsystem is broken.

Questions:

1) Is this known to MS? is this a known issue with PnP installs?

2) Let's suppose this is due to malware, or lame malware removal/registry optimization tools (lots of them for free download). Is there any MS-supported way to repair this damage, and to rebuild the Driver Store databases/registry entries from scratch?

--
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

Comments

  • Jim_CavalarisJim_Cavalaris Member Posts: 2
    Hi Maxim, Thanks for raising this. We're not aware of any known issues like this. What OS version is this seen on?

    Based on the STATUS_DLL_INIT_FAILED error, this seems like there is something pretty fundamentally wrong with some Windows system files while loading DRVINST.EXE and its DLL dependencies.

    Likely causes could include malware as you suggest, or corruption / file version mismatch with one of the dependent DLLs on these machines. It doesn't sound like there's a problem with the Driver Store or registry/database entries (a DLL initialization error would likely happen before anything there is even touched) so I don't think it's necessary to repair those.

    Can you send a snippet of the log entry that shows the failure? If you have access to some machine where this is happening, is it possible to run a binary dependency walker tool like DEPENDS.EXE against DRVINST.EXE and see if everything looks OK there?

    Thanks,
    Jim.
  • Pavel_APavel_A Member Posts: 2,674
    On 17-Jan-2014 23:00, Maxim S. Shatskih wrote:

    > 2) Let's suppose this is due to malware, or lame malware removal/registry optimization tools (lots of them for free download). Is there any MS-supported way to repair this damage, and to rebuild the Driver Store databases/registry entries from scratch?

    Of course, there's no supported way to repair unknown damage.
    Just reimage the machine, and use boxstarter (boxstarter.org) to quickly
    restore working state.

    -- pa
  • Maxim_S._ShatskihMaxim_S._Shatskih Member Posts: 10,396
    > Hi Maxim, Thanks for raising this. We're not aware of any known issues like this. What OS version
    >is this seen on?

    The issue is also described here (it seems to be widely known and not only for our company):

    http://answers.microsoft.com/en-us/windows/forum/windows_7-performance/appcrash-shortly-after-start-updriver-installation/b1335fab-05b9-457f-bc7d-19a95b55dd9c

    and here:

    http://social.technet.microsoft.com/Forums/windowsserver/en-US/326726df-e33e-424a-a59b-1bb0b56ab898/windows-2008-r2-will-not-install-any-drivers?forum=winservergen

    So, several Windows versions are vulnerable.

    > Based on the STATUS_DLL_INIT_FAILED error, this seems like there is something pretty
    >fundamentally wrong with some Windows system files while loading DRVINST.EXE and its DLL
    >dependencies.

    I also think so.

    >Store or registry/database entries (a DLL initialization error would likely happen before anything
    >there is even touched) so I don't think it's necessary to repair those.

    Yes, good point.

    > Can you send a snippet of the log entry that shows the failure?

    For now, I can only send the one from the above pages, not our own. I'm in the process of communicating with the guys to get our own log file.

    The log below is from the person who claims it can occur during just plain in-place upgrade of Windows:

    dvi: {Plug and Play Service: Device Install for STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT1}
    ump: Creating Install Process: DrvInst.exe 16:57:03.512
    ump: Server install process exited with code 0xc0000142 16:57:03.528
    ump: {Plug and Play Service: Device Install exit(c0000142)}
    ndv: Device Install failed for new device...installing NULL driver.
    dvi: {Plug and Play Service: Device Install for STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT1}
    ump: Creating Install Process: DrvInst.exe 16:57:03.528
    ump: Server install process exited with code 0xc0000142 16:57:03.528
    ump: {Plug and Play Service: Device Install exit(c0000142)}
    ndv: {Update Driver Software Wizard exit(c0000142)}
    <<< Section end 2012/01/30 16:57:13.358

    Now from the second URL:

    Problem Event Name: APPCRASH

    Application Name: DrvInst.exe

    Application Version: 6.0.6002.18005

    Application Timestamp: 49e023db

    Fault Module Name: USER32.dll

    Fault Module Version: 6.0.6002.18005

    Fault Module Timestamp: 49e0421d

    Exception Code: c0000142

    So, it looks like the init code of USER32.DLL has failed.

    >If you have access to some machine where this is happening, is it possible to run a binary
    >dependency walker tool like DEPENDS.EXE against DRVINST.EXE and see if everything looks OK

    Yes, good idea.

    --
    Maxim S. Shatskih
    Microsoft MVP on File System And Storage
    xxxxx@storagecraft.com
    http://www.storagecraft.com
  • Maxim_S._ShatskihMaxim_S._Shatskih Member Posts: 10,396
    Also, this can probably be due to a buggy DLL in AppInit_DLLs, which are IIRC called in DllMain of USER32.

    I will check.

    --
    Maxim S. Shatskih
    Microsoft MVP on File System And Storage
    xxxxx@storagecraft.com
    http://www.storagecraft.com

    <xxxxx@microsoft.com> wrote in message news:xxxxx@ntdev...
    > Hi Maxim, Thanks for raising this. We're not aware of any known issues like this. What OS version is this seen on?
    >
    > Based on the STATUS_DLL_INIT_FAILED error, this seems like there is something pretty fundamentally wrong with some Windows system files while loading DRVINST.EXE and its DLL dependencies.
    >
    > Likely causes could include malware as you suggest, or corruption / file version mismatch with one of the dependent DLLs on these machines. It doesn't sound like there's a problem with the Driver Store or registry/database entries (a DLL initialization error would likely happen before anything there is even touched) so I don't think it's necessary to repair those.
    >
    > Can you send a snippet of the log entry that shows the failure? If you have access to some machine where this is happening, is it possible to run a binary dependency walker tool like DEPENDS.EXE against DRVINST.EXE and see if everything looks OK there?
    >
    > Thanks,
    > Jim.
    >
  • Amritanshu_JohriAmritanshu_Johri Member Posts: 73
    At the risk of stating the obvious looking at the procmon logs might
    help in this case. :)

    Sent from my Windows Phone
    From: Maxim S. Shatskih
    Sent: 18-01-2014 20:00
    To: Windows System Software Devs Interest List
    Subject: Re:[ntdev] STATUS_DLL_INIT_FAILED from SetupApi
    Also, this can probably be due to a buggy DLL in AppInit_DLLs,
    which are IIRC called in DllMain of USER32.

    I will check.

    --
    Maxim S. Shatskih
    Microsoft MVP on File System And Storage
    xxxxx@storagecraft.com
    http://www.storagecraft.com

    <xxxxx@microsoft.com> wrote in message news:xxxxx@ntdev...
    > Hi Maxim, Thanks for raising this. We're not aware of any known issues like this. What OS version is this seen on?
    >
    > Based on the STATUS_DLL_INIT_FAILED error, this seems like there is something pretty fundamentally wrong with some Windows system files while loading DRVINST.EXE and its DLL dependencies.
    >
    > Likely causes could include malware as you suggest, or corruption / file version mismatch with one of the dependent DLLs on these machines. It doesn't sound like there's a problem with the Driver Store or registry/database entries (a DLL initialization error would likely happen before anything there is even touched) so I don't think it's necessary to repair those.
    >
    > Can you send a snippet of the log entry that shows the failure? If you have access to some machine where this is happening, is it possible to run a binary dependency walker tool like DEPENDS.EXE against DRVINST.EXE and see if everything looks OK there?
    >
    > Thanks,
    > Jim.
    >

    ---
    NTDEV is sponsored by OSR

    Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

    OSR is HIRING!! See http://www.osr.com/careers

    For our schedule of WDF, WDM, debugging and other seminars visit:
    http://www.osr.com/seminars

    To unsubscribe, visit the List Server section of OSR Online at
    http://www.osronline.com/page.cfm?name=ListServer
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Developing Minifilters 29 July 2019 OSR Seminar Space
Writing WDF Drivers 23 Sept 2019 OSR Seminar Space
Kernel Debugging 21 Oct 2019 OSR Seminar Space
Internals & Software Drivers 18 Nov 2019 Dulles, VA