Prev: KB893086 error
Next: Have error after update WindowsXP
From: Peter Nimmo on 20 May 2005 04:39
"Robert Aldwinckle" <robald(a)techemail.com> wrote in news:eOt5d0cSFHA.2964
@TK2MSFTNGP15.phx.gbl:
>
> Have you tried re-registering the .dlls associated with encryption
> such as the one you are crashing in?
>
><title>KB822798 - You cannot install some updates or programs</title>
>
> (TechNet KB search for
> wintrust "Windows Update"
> )
Yes, I have done that and compared each of the dlls with a collegues and
each one is identical.
From: Robert Aldwinckle on 20 May 2005 12:07

"Peter Nimmo" <Peter.Nimmo(a)nospamtnsofresdotcom> wrote in message news:Xns963C6C55797ECPeterNnospamtnsofres(a)207.46.248.16...
>I have also run an update through Dependancy Walker. The last meaningful
> log entry says "Second chance exception 0xC0000005 (Access Violation)
> occurred in "c:\winnt\system32\WINTRUST.DLL" at address 0x769503B2."
>
> This DLL is identical to a collegues so the DLL is not corrupt.

What about the other recoverable error conditions indicated by
your excellent trace? Do they yield any clues?

Can you create the same sort of trace on the machine which works?
Perhaps you would spot a significant difference that way.
You probably wouldn't be able to compare the traces in any automated
way e.g. using windiff, unless you took the trouble to remove or
"commonalize" all transitory details such as addresses and GUIDs,
etc. but it might at least help to scroll two side by side windows
with such traces in them.

E.g. I don't have your OS (I have XPsp2) but FWIW some of those
"returned NULL" cases in your log would not have occurred on my
system.


FWIW let's highlight those now:

> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL], "IsTNT")
> called from "c:\winnt\system32\OLEAUT32.DLL" at address 0x77A23F12 and
> returned NULL. Error: The specified procedure could not be found (127).

My kernel32 does not have IsTNT either.


> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL], "pSetupIsUserAdmin")
> called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x0106BA4D
> and returned NULL. Error: The specified procedure could not be found (127).

My setupapi.dll does have pSetupIsUserAdmin.


> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL], "CryptCATAdminRemoveCatalog")
> called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x0107366D
> and returned NULL. Error: The specified procedure could not be found (127).

My wintrust.dll has CryptCATAdminRemoveCatalog


> LoadLibraryA("SXS.DLL") called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE"
> at address 0x01073816.
> LoadLibraryA("SXS.DLL") returned NULL. Error: The specified module could
> not be found (126).

I do have such a module, in %windir%\System32
<filever>
--a-- W32i DLL ENU 5.1.2600.2180 shp 713,216 08-04-2004 sxs.dll
</filever>


> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL], "GetSystemWow64DirectoryW")
> called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x0106E0BD
> and returned NULL. Error: The specified procedure could not be found (127).

My kernel32.dll has GetSystemWow64DirectoryW


> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL], "pSetupIsUserAdmin")
> called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x0106BA4D
> and returned NULL. Error: The specified procedure could not be found (127).

> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL], "GetSystemWow64DirectoryW")
> called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x0106E0BD
> and returned NULL. Error: The specified procedure could not be found (127).

(Two more already seen.)

New plan. I have just spotted something interesting in the next "returned NULL".
Something between here and then appears to have caused a cleanup to be
initiated. (Note that this is a guess which should be tested by looking at the
same trace being done for a case which doesn't fail.)


> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpCloseInfFile") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
> returned 0x00C32A37.
> LoadLibraryA("SETUPAPI.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x01066878.
> LoadLibraryA("SETUPAPI.dll") returned 0x77880000.
> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
> "SetupCloseInfFile") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDATE.EXE" at address 0x010668D9 and returned 0x77882D8A.

Hmm... maybe I have a red herring. This looks like it could be
some normal termination of some kind.

> LoadLibraryA("WINTRUST.dll") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A156.
> LoadLibraryA("WINTRUST.dll") returned 0x76930000.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATAdminAcquireContext") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A1AC and returned 0x76949058.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATAdminCalcHashFromFileHandle") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A1AC and returned 0x7694933D.
> LoadLibraryExW("C:\WINNT\System32\asfsipc.dll", 0x00000000, 0x00000000)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
> Loaded "c:\winnt\system32\ASFSIPC.DLL" at address 0x74A50000.
> Successfully hooked module.
> DllMain(0x74A50000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
> \ASFSIPC.DLL" called.
> DllMain(0x74A50000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
> \ASFSIPC.DLL" returned 1 (0x1).
> LoadLibraryExW("C:\WINNT\System32\asfsipc.dll", 0x00000000, 0x00000000)
> returned 0x74A50000.
> GetProcAddress(0x74A50000 [c:\winnt\system32\ASFSIPC.DLL],
> "DllCanUnloadNow") called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C74EDC3 and returned NULL. Error: The specified procedure could not be
> found (127).

Well, FWIW, my asfsiipc.dll doesn't have a DllCanUnloadNow either.
I hope you can find out whether your normal trace has this and more importantly
what follows in it.

I'm going to stop here in case what follows is just documenting failed
error recovery and diagnosis. FWIW all the rest of the "returned NULL"
would occur on my system too.


HTH

Robert
---


First  |  Prev  | 
Pages: 1 2
Prev: KB893086 error
Next: Have error after update WindowsXP