"Bad Image" error when launching ClipUp.exe

mitja.kolsek -

On Windows 10, launching ClipUp.exe application (which may get launched automatically in the process of upgrading a Windows license) can result in an error message stating that 0patchAgentX64.dll is not designed for Windows or corrupt:

 

image001.jpg

 

In fact, the cause is that ClipUp.exe requires all loaded DLLs to be signed by Microsoft, and 0patch's Loader DLL isn't (obviously) - hence the 0xc0000428 error.

If you're affected by this issue, you can instruct 0patch Agent to exclude ClipUp.exe from injection via Registry.

 

Excluding ClipUp.exe from injection by 0patch Agent

As administrator, set the registry value ExcludeModules under HKLM\Software\0patch to "clipup.exe" (without quotes). Then to enforce this new setting without restarting your computer, change the value of HKLM\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll\Counter to any other number than it already has (this removes 0patch loader from all processes), and restart the 0patch Service.

This can be done using the following command-line script executed as administrator:

 PowerShell

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v ExcludeModules /t REG_SZ /d "clipup.exe" /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d $(Get-Random) /f
net stop 0patchService
net start 0patchService

 Command Prompt / cmd.exe

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v ExcludeModules /t REG_SZ /d "clipup.exe" /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d %random%%random% /f
net stop 0patchService
net start 0patchService

 

If you already have some content in ExcludeModules value, append "|clipup.exe" (starting with a pipe character) to it in the procedure described above.

 

 

Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.