Random problems at system startup

Mitja Kolsek -

Some users have reported random problems at system startup such as user desktop not appearing, various services not working properly, and sound not working. These problems seem to be occurring sporadically, and restarting Windows often seems to resolve them until the next restart.

We've tracked this issue to early 0patch Agent activities (injecting 0patchLoader.dll into processes and applying patches into system services quickly after their startup), which seems to be met with unfavorable race conditions on a small fraction of users' computers.

The issue can be solved by delaying 0patch Agent activities at system startup. Depending on the severity of the problem, two delay options are available:

  1. Short delay: delaying until 0patch Service gets started (i.e., a couple of seconds, waiting for the most basic Windows services to start first), and
  2. Long delay: delaying for 1-2 minutes after system startup.

Using any of these delays will delay the application of micropatches to already running processes. For the Short delay, the impact is almost insignificant, while the Long delay will keep your computer exposed to attacks against unpatched vulnerabilities during the first 1-2 minutes after system startup. We therefore recommend first applying the Short delay, and then only if the problems persists, applying the Long delay. When using the Long delay, we also recommend not browsing the Internet or opening any documents received from unknown 3rd parties in the first 2 minutes after system startup (until 0patch Service gets started). The Long delay will prevent manual syncing via 0patch Console from working until 0patch Service is started.

Please follow the instructions below to apply the delay or restore immediate (no-delay) 0patch Agent operation. All changes will come into effect upon the next system startup.

 

Applying the Short delay

PowerShell

Launch PowerShell as local administrator, then execute the following commands:

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 0 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d $(Get-Random) /f
net stop 0patchService
net start 0patchService

Command Prompt / cmd.exe

Launch cmd.exe as local administrator, then execute the following commands:

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 0 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d %random%%random% /f
net stop 0patchService
net start 0patchService

 

Applying the Long delay

The Long delay works as an addition to the Short delay, so you have to already have the Short delay configured (see above for instructions on how to apply the Short delay).

Launch PowerShell or cmd.exe as local administrator, then execute the following command:

sc config 0patchService start= delayed-auto

 

Restoring immediate (no-delay) operation

This procedure removes both Short delay and Long Delay, restoring the default immediate (no-delay) operation of 0patch Agent.

PowerShell

Launch PowerShell as local administrator, then execute the following commands:

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 1 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d $(Get-Random) /f
net stop 0patchService
sc config 0patchService start= auto
net start 0patchService

Command Prompt / cmd.exe

Launch cmd.exe as local administrator, then execute the following commands:

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 1 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d %random%%random% /f
net stop 0patchService
sc config 0patchService start= auto
net start 0patchService

 

 

Have more questions? Submit a request

8 Comments

  • 0
    Avatar
    bdgregory

    I'm baffled.

    What's the random number in Counter for?

  • 0
    Avatar
    Mitja Kolsek

    Hi bdgregory, our agent is reacting to changes in various Registry values; putting a random value in such values is almost certain to trigger a change, and get the agent to react. In this case, the agent reacts by unloading our DLL from running processes.

  • -1
    Avatar
    greg3k

    Hi Mitja,

    I tried the short delay and the long delay on my Win7 Pro and Win10Home machines. The results were negative in all four cases, the problem persists and 0patch is not connecting to the server.

    - Greg

  • 0
    Avatar
    Mitja Kolsek

    Hi greg3k, your problems with 0patch Agent not connecting to the server were likely caused by our cert snafu (see https://twitter.com/0patch/status/1300735855603191808). Please try again; thanks and sorry!

  • 0
    Avatar
    jdecbaker

    I applied the Short Delay yesterday and tested it. Several times Windows 7 booted successfully, so I thought that was the solution. But this morning when I booted Windows 7 the same problems re-occurred. The first error in the System Event log was a 60s timeout for the RPC Endpoint Mapper service - many other services depend on the RPC Endpoint Mapper service so the rest of the boot up has lots of errors.

    I then applied the Long Delay but that didn't delay the patches being applied (0patch.log file records "Patch 516 applied in application wininit.exe" only about 12 seconds following reboot). The Long Delay delayed the start of the 0patch service, but that did not help.

    Is there a way of delaying the Agent, which could help by delaying the application of patches?

  • 0
    Avatar
    lgrobertson

    Same issue here w. Win7 64 bit SP1; applied the reg alterations (made a system restore point first), and it seems to have turned the trick. Thanks, Mitja. Nice to see an outfit that can admit an error, then turn around and provide a fix that fast.

    As a new user of 0Patch, I'm impressed.

    How so very NOT- Microsoft. :)

  • 0
    Avatar
    FranceBB

    It goes without saying but if you're using Windows XP, then only the Short Delay patch can be applied. ;)

  • 0
    Avatar
    Mitja Kolsek

    Thank you FranceBB, it seems Windows XP really doesn't support delayed start for services.

Please sign in to leave a comment.