STATUS_DLL_INIT_FAILED from SetupApi

I saw some Windows machines where the SetupAPI calls used to install the driver package are failing with STATUS_DLL_INIT_FAILED.

Setupapi.dev.log says that it is the drvinst.exe process (spawned by SetupAPI at some moment) who fails (I think at process init time) with this error.

Future investigation have shown that, on such a machine, ANY PnP driver package cannot be installed, not only ours. The PnP install subsystem is broken.

Questions:

  1. Is this known to MS? is this a known issue with PnP installs?

  2. Let’s suppose this is due to malware, or lame malware removal/registry optimization tools (lots of them for free download). Is there any MS-supported way to repair this damage, and to rebuild the Driver Store databases/registry entries from scratch?


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

Hi Maxim, Thanks for raising this. We’re not aware of any known issues like this. What OS version is this seen on?

Based on the STATUS_DLL_INIT_FAILED error, this seems like there is something pretty fundamentally wrong with some Windows system files while loading DRVINST.EXE and its DLL dependencies.

Likely causes could include malware as you suggest, or corruption / file version mismatch with one of the dependent DLLs on these machines. It doesn’t sound like there’s a problem with the Driver Store or registry/database entries (a DLL initialization error would likely happen before anything there is even touched) so I don’t think it’s necessary to repair those.

Can you send a snippet of the log entry that shows the failure? If you have access to some machine where this is happening, is it possible to run a binary dependency walker tool like DEPENDS.EXE against DRVINST.EXE and see if everything looks OK there?

Thanks,
Jim.

On 17-Jan-2014 23:00, Maxim S. Shatskih wrote:

  1. Let’s suppose this is due to malware, or lame malware removal/registry optimization tools (lots of them for free download). Is there any MS-supported way to repair this damage, and to rebuild the Driver Store databases/registry entries from scratch?

Of course, there’s no supported way to repair unknown damage.
Just reimage the machine, and use boxstarter (boxstarter.org) to quickly
restore working state.

– pa

> Hi Maxim, Thanks for raising this. We’re not aware of any known issues like this. What OS version

is this seen on?

The issue is also described here (it seems to be widely known and not only for our company):

http://answers.microsoft.com/en-us/windows/forum/windows_7-performance/appcrash-shortly-after-start-updriver-installation/b1335fab-05b9-457f-bc7d-19a95b55dd9c

and here:

http://social.technet.microsoft.com/Forums/windowsserver/en-US/326726df-e33e-424a-a59b-1bb0b56ab898/windows-2008-r2-will-not-install-any-drivers?forum=winservergen

So, several Windows versions are vulnerable.

Based on the STATUS_DLL_INIT_FAILED error, this seems like there is something pretty
fundamentally wrong with some Windows system files while loading DRVINST.EXE and its DLL
dependencies.

I also think so.

Store or registry/database entries (a DLL initialization error would likely happen before anything
there is even touched) so I don’t think it’s necessary to repair those.

Yes, good point.

Can you send a snippet of the log entry that shows the failure?

For now, I can only send the one from the above pages, not our own. I’m in the process of communicating with the guys to get our own log file.

The log below is from the person who claims it can occur during just plain in-place upgrade of Windows:

dvi: {Plug and Play Service: Device Install for STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT1}
ump: Creating Install Process: DrvInst.exe 16:57:03.512
ump: Server install process exited with code 0xc0000142 16:57:03.528
ump: {Plug and Play Service: Device Install exit(c0000142)}
ndv: Device Install failed for new device…installing NULL driver.
dvi: {Plug and Play Service: Device Install for STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT1}
ump: Creating Install Process: DrvInst.exe 16:57:03.528
ump: Server install process exited with code 0xc0000142 16:57:03.528
ump: {Plug and Play Service: Device Install exit(c0000142)}
ndv: {Update Driver Software Wizard exit(c0000142)}
<<< Section end 2012/01/30 16:57:13.358

Now from the second URL:

Problem Event Name: APPCRASH

Application Name: DrvInst.exe

Application Version: 6.0.6002.18005

Application Timestamp: 49e023db

Fault Module Name: USER32.dll

Fault Module Version: 6.0.6002.18005

Fault Module Timestamp: 49e0421d

Exception Code: c0000142

So, it looks like the init code of USER32.DLL has failed.

If you have access to some machine where this is happening, is it possible to run a binary
dependency walker tool like DEPENDS.EXE against DRVINST.EXE and see if everything looks OK

Yes, good idea.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

Also, this can probably be due to a buggy DLL in AppInit_DLLs, which are IIRC called in DllMain of USER32.

I will check.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntdev…
> Hi Maxim, Thanks for raising this. We’re not aware of any known issues like this. What OS version is this seen on?
>
> Based on the STATUS_DLL_INIT_FAILED error, this seems like there is something pretty fundamentally wrong with some Windows system files while loading DRVINST.EXE and its DLL dependencies.
>
> Likely causes could include malware as you suggest, or corruption / file version mismatch with one of the dependent DLLs on these machines. It doesn’t sound like there’s a problem with the Driver Store or registry/database entries (a DLL initialization error would likely happen before anything there is even touched) so I don’t think it’s necessary to repair those.
>
> Can you send a snippet of the log entry that shows the failure? If you have access to some machine where this is happening, is it possible to run a binary dependency walker tool like DEPENDS.EXE against DRVINST.EXE and see if everything looks OK there?
>
> Thanks,
> Jim.
>

At the risk of stating the obvious looking at the procmon logs might
help in this case. :slight_smile:

Sent from my Windows Phone
From: Maxim S. Shatskih
Sent: 18-01-2014 20:00
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] STATUS_DLL_INIT_FAILED from SetupApi
Also, this can probably be due to a buggy DLL in AppInit_DLLs,
which are IIRC called in DllMain of USER32.

I will check.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntdev…
> Hi Maxim, Thanks for raising this. We’re not aware of any known issues like this. What OS version is this seen on?
>
> Based on the STATUS_DLL_INIT_FAILED error, this seems like there is something pretty fundamentally wrong with some Windows system files while loading DRVINST.EXE and its DLL dependencies.
>
> Likely causes could include malware as you suggest, or corruption / file version mismatch with one of the dependent DLLs on these machines. It doesn’t sound like there’s a problem with the Driver Store or registry/database entries (a DLL initialization error would likely happen before anything there is even touched) so I don’t think it’s necessary to repair those.
>
> Can you send a snippet of the log entry that shows the failure? If you have access to some machine where this is happening, is it possible to run a binary dependency walker tool like DEPENDS.EXE against DRVINST.EXE and see if everything looks OK there?
>
> Thanks,
> Jim.
>


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer