Random problems at system startup

mitja.kolsek -

Some users have reported random problems at system startup such as user desktop not appearing, various services not working properly, and sound not working. These problems seem to be occurring sporadically, and restarting Windows often seems to resolve them until the next restart.

We've tracked this issue to early 0patch Agent activities (injecting 0patchLoader.dll into processes and applying patches into system services quickly after their startup), which seems to be met with unfavorable race conditions on a small fraction of users' computers.

The issue can be solved by delaying 0patch Agent activities at system startup. Depending on the severity of the problem, two delay options are available:

  1. Short delay: delaying until 0patch Service gets started (i.e., a couple of seconds, waiting for the most basic Windows services to start first), and
  2. Long delay: delaying for 1-2 minutes after system startup.

Using any of these delays will delay the application of micropatches to already running processes. For the Short delay, the impact is almost insignificant, while the Long delay will keep your computer exposed to attacks against unpatched vulnerabilities during the first 1-2 minutes after system startup. We therefore recommend first applying the Short delay, and then only if the problems persists, applying the Long delay. When using the Long delay, we also recommend not browsing the Internet or opening any documents received from unknown 3rd parties in the first 2 minutes after system startup (until 0patch Service gets started). The Long delay will prevent manual syncing via 0patch Console from working until 0patch Service is started.

Please follow the instructions below to apply the delay or restore immediate (no-delay) 0patch Agent operation. All changes will come into effect upon the next system startup.

 

Applying the Short delay

PowerShell

Launch PowerShell as local administrator, then execute the following commands:

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 0 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d $(Get-Random) /f
net stop 0patchService
net start 0patchService

Command Prompt / cmd.exe

Launch cmd.exe as local administrator, then execute the following commands:

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 0 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d %random%%random% /f
net stop 0patchService
net start 0patchService

 

Applying the Long delay

The Long delay works as an addition to the Short delay, so you have to already have the Short delay configured (see above for instructions on how to apply the Short delay).

Launch PowerShell or cmd.exe as local administrator, then execute the following command:

sc config 0patchService start= delayed-auto

 

Restoring immediate (no-delay) operation

This procedure removes both Short delay and Long Delay, restoring the default immediate (no-delay) operation of 0patch Agent.

PowerShell

Launch PowerShell as local administrator, then execute the following commands:

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 1 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d $(Get-Random) /f
net stop 0patchService
sc config 0patchService start= auto
net start 0patchService

Command Prompt / cmd.exe

Launch cmd.exe as local administrator, then execute the following commands:

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 1 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d %random%%random% /f
net stop 0patchService
sc config 0patchService start= auto
net start 0patchService

 

 

Have more questions? Submit a request

4 Comments

  • 0
    Avatar
    bdgregory

    I'm baffled.

    What's the random number in Counter for?

  • 0
    Avatar
    mitja.kolsek

    Hi bdgregory, our agent is reacting to changes in various Registry values; putting a random value in such values is almost certain to trigger a change, and get the agent to react. In this case, the agent reacts by unloading our DLL from running processes.

  • -1
    Avatar
    greg3k

    Hi Mitja,

    I tried the short delay and the long delay on my Win7 Pro and Win10Home machines. The results were negative in all four cases, the problem persists and 0patch is not connecting to the server.

    - Greg

  • 0
    Avatar
    mitja.kolsek

    Hi greg3k, your problems with 0patch Agent not connecting to the server were likely caused by our cert snafu (see https://twitter.com/0patch/status/1300735855603191808). Please try again; thanks and sorry!

Please sign in to leave a comment.