64 bit installer error

Discussion in 'ESET Smart Security' started by dkyuss, Aug 30, 2009.

Thread Status:
Not open for further replies.
  1. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    o_O
    Hey all. I hope there is a simple solution to this fix. Let me know what you think.

    My situation is this;
    XP Pro x64 . installing ess_nt64_enu.msi. I previously had Bit defender total security installed, and had used its uninstaller (with reboot) prior to the first ESS installation.

    So after the initial installation of ESS, which progressed smoothly, I rebooted the computer. On loading of XP, I get a BSOD and use 'Last configuration settings that worked' to get my XP up in action. At this point ESS errors with something like error communicating with kernel. I find some help through Google to install .NET 1.1 (dotnetfx) and then go through windows updates. ESS still errors out, so I uninstalled ESS through ADD/REMOVE, reboot, and now the installer errors out with a 'premature failure' message.

    I have attached an installer log file (split into 2 files as it exceeded limits). Any thoughts out there??
    This comment stands out to me in the installer log...

    "DEBUG: Error 2826: Control BottomLine on dialog PrepareDlg extends beyond the boundaries of the dialog to the right by 3 pixels
    The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2826. The arguments are: PrepareDlg, BottomLine, to the right"

    Thanks in advance,
     
  2. trencan

    trencan Eset Staff

    Joined:
    Nov 21, 2008
    Posts:
    120
    The root cause of problem is this error while installing ESET epfwndis driver:
    SetupCopyOEMInf failed with error 5

    From some reason installer is not able to copy inf file to \windows\inf folder. Error is "access denied".

    Post here also files: \windows\setupapi.log and \WINDOWS\system32\CatRoot2\dberr.txt
     
  3. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    Trencan,
    Thanks for the input.

    See the other log files attached.

    I will take a further look at this tonight.
     

    Attached Files:

  4. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    I have played around with this a little bit with no luck and I am not too sure of where to go next.

    Is this an issue with publisher trusts? Conflict with other software?

    Any direction you can provide would be much appreciated!

    Beyond this, I am looking at doing a windows 'repair' as I am at a loss.

    Thanks
     
  5. trencan

    trencan Eset Staff

    Joined:
    Nov 21, 2008
    Posts:
    120
    Setupapi.log which you posted here contains events only since 2009/08/30 23:51:23. But in install.log I see you did ESS installation on 8/30/2009 1:22:37. Older events are stored in file \windows\setupapi.log.0.old, post it here.

    Verify that you have rights to copy files to \windows\inf folder.

    In dberr.txt file, there are some errors related to catalog DB. You can try this:
    http://support.microsoft.com/kb/822798
    especially:
    Method 3: Rename the Catroot2 folder
    1. Click Start, click Run, type cmd, and then click OK.
    2. At the command prompt, type the following commands, and then press ENTER after each line:
    net stop cryptsvc
    ren %systemroot%\System32\Catroot2 oldcatroot2
    net start cryptsvc
    exit
    3. Remove all tmp*.cat files from the following folder:
    %systemroot%\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}

    Then reboot PC and run again ESS installation.
     
    Last edited: Sep 2, 2009
  6. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    So I tried method #3 with no luck.....
    See attached logs.

    Since I have done this method 3, I have no \system32\Catroot2 folder so cant post that log.

    From the link Trencan provided, it states "The Catroot2 folder is automatically recreated by Windows, but the Catroot folder is not recreated if the Catroot folder is renamed."

    I have rebooted a couple times now and expected to see the dberr.log?
     

    Attached Files:

  7. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    oops. Found it. Not much in there...
     

    Attached Files:

  8. trencan

    trencan Eset Staff

    Joined:
    Nov 21, 2008
    Posts:
    120
    Still no clue.

    Download ProcMon from SysInternals:
    http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
    start it before ESS installation and stop as soon as installation is rolled back. In order to make log's size smaller, you can add filter on process msiexec.exe. Post resulting log here.

    Since there is error: access denied in install.log, ProcMon log should bring more light into problem.
     
  9. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    Sorry,
    I did this this morning but forgot to post it o_O

    Too busy doing Kitchen Reno's..

    Anyways, I was about to post the ProcMon log file now, but it is 42mb, as filtered? That is pretty big for a log file! It seems to have filtered correctly as only msiexec.exe process name is listed but there are 191,912 events!

    Most of the info is in Regestry and system activity, which are 10 mb and 32mb when separated. Any thoughts?
     
  10. trencan

    trencan Eset Staff

    Joined:
    Nov 21, 2008
    Posts:
    120
    You can make the log smaller, if you start ProcMon before last "Next" in ESS installation process, so before installation itself proceeds. You don't need to run ProcMon when you click first pages of msi Wizard.

    But still it can be several tenths of MB. Try to upload it where possible.

    Registry and filesystem activities are the right ones which I need to see, there should occur error related to "access denied".
     
  11. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
  12. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    There are two entries indicating 'access denied'....


    11:43:05.1965851 AM MsiExec.exe 2312 CreateFile D:\WINDOWS\inf\oem41.PNF ACCESS DENIED Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: None, AllocationSize: 0

    11:43:11.7096644 AM MsiExec.exe 2312 CreateFile D:\WINDOWS\inf\oem40.PNF ACCESS DENIED Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: None, AllocationSize: 0
     
  13. trencan

    trencan Eset Staff

    Joined:
    Nov 21, 2008
    Posts:
    120
    Ok, I had a look at your log file.

    Source of trouble is first "access denied" for file oem41.pnf. This file is related to eset epfwndis driver. It seems that oem41.inf and oem41.pnf files remained in D:\windows\inf folder after last installation process.

    Now question is why msiexec process can not open oem41.pnf file for write access:
    1) verify that keyword "eset_epfwndis" is present in file oem41.inf to be sure it is dedicated to epfwndis driver, there should be something like this:
    [ESET.NTamd64]
    %Epfwndis_Desc% = Epfwndis.ndi, eset_epfwndis
    2) verify that attribute "read-only" is not set for file oem41.pnf
    3) verify that you have sufficient rights to modify oem41.pnf. Most probably you are logged as admin, so group Administrators should have Full Control rights.

    If 1), 2) and 3) were fulfilled, then delete files:
    - D:\Windows\inf\oem41.pnf
    - D:\Windows\inf\oem41.inf

    Then try to install ESS again with ProcMon running.
     
  14. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    YEY!!! You got it!
    Thanks sooo much.

    oem41.PNF was 0 bytes. Hidden and archive attributes
    oem41.inf was archive only.

    I have rights to modify and change so I renamed the files *.*old

    Retried the installation and Voila!

    Thanks again Trencan for your input!
     
  15. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    OK .... So I guess that was a little premature.

    I spent an hour or so playing with ESS after the installation with no problems. Updated and scanned my PC (it was clean)and customized the settings to suit me. Proceeded to do a windows update which required a restart and.... BSOD.
    I chose use last good settings option and boot back into XP. After a few minutes an ESET Smart Security warning about lack of communicating with the Kernel. So I am right back where I started.

    So I uninstalled ESS, reboot, reinstall, reboot just to see, and the re-installation was smooth with no issues with oem41.PNF.

    The BSOD Stop error does not indicate a .dll, and I didnt write down the HEX code. Maybe next time.

    So... I am assuming a driver or service conflict, but not sure where to go next. Currently have ESS running, but I just cant reboot :doubt:

    Any thoughts?
     
  16. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    Bump!
     
  17. trencan

    trencan Eset Staff

    Joined:
    Nov 21, 2008
    Posts:
    120
    Most probably there is some driver conflict. When BSOD occurs, it creates memory dump file to HDD, you can send it to cutomer care for analysis.
     
  18. _other_

    _other_ Registered Member

    Joined:
    Sep 16, 2009
    Posts:
    1
    I'm having virtually the identical problem. Installed ESS on XP x64 no problem. At first reboot OS fails to load, gives the option to boot with last known working configuration settings which I accept. XP boots, ESET gives the failure to communicate with kernel message (probably due to the fact that it's services have been removed/rolled back). I try ESET installer's repair option. It says no go you have to reinstall. I uninstall using ESET uninstaller. Reboot. Try reinstall which bails out near the end.

    These comps are new HP dc7900 desktops.

    Extra added twists: These are dual boot machines (XP x86 and XP x64) and have no connection to the outside world. ESS is installed and working (so far) on the x86 side.

    dkyuss - let me know if you learn anything about driver conflicts etc.

    Great fun!
     
  19. trencan

    trencan Eset Staff

    Joined:
    Nov 21, 2008
    Posts:
    120
    It is necessary to analyze memory dump file created when BSOD appears. It should enlighten which driver causes troubles and why.
     
  20. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    Well, still no luck here.

    I cannot seem to get a memory dump or event log item to register?

    I have 8 gb ram, drive D is my boot drive with 9000mb of page file available, 394gb of available space... and no %systemroot%\memory.dmp file to be found. I have reinstalled to cause a memory dump about 4 times now. I have tried kernel dump, small dump, complete dump (which is not an available option any moreo_O)..... still nothing.

    My BSOD is the general might be a recent hardware change, driver conflict etc..... message.

    stop error lists no file, just hex,
    0x000000000000001E (0xFFFFFFFFC000000E, 0xFFFFFADF37430495, 0x0000000000000000, 0x0000000000000000)

    http://technet.microsoft.com/en-us/library/cc939014.aspx
    stop error 0x1E indicates that a kernel-mode process tried to execute an illegal or unknown processor instruction. This error handler is a default error handler that catches errors not associated with other specific error handlers.
    Interpreting the Message

    The four parameters listed in the message are defined in order of appearance as follows:

    1. Exception code that was not handled
    2. Address at which the exception occurred
    3. Parameter 0 of the exception
    4. Parameter 1 of the exception

    I have a feeling the problem is with the ESS firewall and I have found several forum posts talking of similar problems with BSOD's. I uninstalled both my wireless and network drivers and tried a reinstall with no luck. Not my Ethernet or network drivers.

    _other_ Interestingly, this is an HP as well. I have an HP pavilion elite m9450f desktop that originally came with Vista 64 bit. I hated it and quickly formatted and went to XP. Now HP, in this model does not seem to offer XP drivers.... Vista only. Which sucks! So I have used a program called Driver Genie to find and install all XP x64 drivers. My device manager listing looks good, and I have been running this way for over a year flawlessly.

    I would be interested if you have any of the same hardware in your system. From an Everest Ultimate report I have the following trimmed details.

    Computer Type ACPI Multiprocessor x64-based PC

    Operating System Microsoft Windows XP Professional x64 Edition

    OS Service Pack Service Pack 2

    CPU Type QuadCore Intel Core 2 Quad Q9300, 2500 MHz (7.5 x 333)

    Motherboard Name Asus IPIBL-LB (Benicia) (1 PCI, 2 PCI-E x1, 1 PCI-E x16, 4 DDR2 DIMM, Audio, Video, Gigabit LAN, IEEE-1394)

    Motherboard Chipset Intel Bearlake G33

    System Memory 8192 MB

    DIMM1: Samsung M3 78T5663QZ3-CF7 2 GB DDR2-800 DDR2 SDRAM (6-6-6-18 @ 400 MHz) (5-5-5-15 @ 333 MHz) (4-4-4-12 @ 266 MHz)

    DIMM2: Samsung M3 78T5663QZ3-CF7 2 GB DDR2-800 DDR2 SDRAM (6-6-6-18 @ 400 MHz) (5-5-5-15 @ 333 MHz) (4-4-4-12 @ 266 MHz)

    DIMM3: Samsung M3 78T5663QZ3-CF7 2 GB DDR2-800 DDR2 SDRAM (6-6-6-18 @ 400 MHz) (5-5-5-15 @ 333 MHz) (4-4-4-12 @ 266 MHz)

    DIMM4: Samsung M3 78T5663QZ3-CF7 2 GB DDR2-800 DDR2 SDRAM (6-6-6-18 @ 400 MHz) (5-5-5-15 @ 333 MHz) (4-4-4-12 @ 266 MHz)

    BIOS Type AMI (09/05/0:cool:

    Video Adapter NVIDIA GeForce 9800 GT (512 MB)

    3D Accelerator nVIDIA GeForce 9800 GT

    Monitor Samsung SyncMaster T190(G)/MagicSyncMaster T190(G) (Digital) [19" LCD] (HVZQ702829)

    Audio Adapter Realtek ALC888/1200 @ Intel 82801IB ICH9 - High Definition Audio Controller [A-2]

    IDE Controller Intel(R) ICH9 Family 2 port Serial ATA Storage Controller 2 - 2926

    IDE Controller Intel(R) ICH9R/DO/DH 4 port Serial ATA Storage Controller 1 - 2920

    Keyboard Logitech HID-Compliant Keyboard

    Mouse HID-compliant Bluetooth Mouse

    Network Adapter 802.11n Wireless PCI Express Card LAN Adapter

    Network Adapter Realtek PCIe GBE Family Controller

    Printer HP Deskjet F4200 series




    The next thing I am going to try is installing ESS with firewall disabled.
    I will let you know how it goes.
     
    Last edited: Sep 18, 2009
  21. dkyuss

    dkyuss Registered Member

    Joined:
    Aug 30, 2009
    Posts:
    19
    I guess it is not the ESS Firewall... I downloaded NOD32 and installed it.
    Reboot, and identical BSOD stop error as before.

    So... I am not sure where to go now. Maybe start a trouble ticket with ESET. DAMN I SHOULD HAVE DONE A TRIAL BEFORE BUYING.
     
  22. trencan

    trencan Eset Staff

    Joined:
    Nov 21, 2008
    Posts:
    120
    You could try to disable loading of "ehdrv" driver, if it makes difference. Go to safe mode, and via regedit change in key: HKLM\System\CurrentControlSet\Services\ehdrv ValueName:Start to Value: 4, what means "disabled". Then try to boot normal mode. If still BSOD, change the value back to 1 in safe mode.

    You can repeat the sequence for other eset drivers, e.g. eamon, epfwtdir, ... This way you should be able to find out which driver makes problem.
     
  23. trencan

    trencan Eset Staff

    Joined:
    Nov 21, 2008
    Posts:
    120
    One more question, did you try to install version 3? If so, without BSOD?
     
  24. Fidelius

    Fidelius Registered Member

    Joined:
    Oct 2, 2006
    Posts:
    151
    Exactly same problem here. Dual boot winxp32(C) and winxp_prox64(D). I have got the same message error explained by dkyuss and _other_.
    The installation file is eav_nt64_enu.msi (38,4 MB).
     
    Last edited: Sep 18, 2009
  25. Fidelius

    Fidelius Registered Member

    Joined:
    Oct 2, 2006
    Posts:
    151
    I forgot to mention my licence expires on 13 October 2009.
    I don't want to waste my time tweaking my WinXPx64, make logs or others stuff like that. An AV must install itself easily. I have read some forums and people complain that your 64 bits EAV does not install properly and no good answers have been given yet. ::mad:
    :thumbd: :thumbd: :thumbd:
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.