The memory could not be read: Anatomy of a complex series of Microsoft defects

This is how it began. A notice on startup from svchost.exe that referenced memory at 0x00000000 could not be read.







Not a very helpful error message. Then I looked into the XP event log, that invaluable and invisible resource that Microsoft hides from users. The only thing worse than an unresponsive fire alarm is a silent fire alarm. Microsoft's technological indictments include hiding fatal errors from users.

There I saw a number of cryptic messages indicating that my automated updates had been failing -- and that this might also have been causing my automated Retrospect Professional backups to fail (that's by far the most serious problem here). That's when the detective work began, a series of probes and explorations powered by Google. The bottom line fixes were, I think:

• Turn off Windows Automatic Update (aka Microsoft Update)
  
• Use Regedit to find "LocalCacheDrive" settings for Office. Notice that the drive letter is "D" when it should be "C". Change it.
• Repair the Office installation.
• Manually run Windows Update.
• Discover Flash update still doesn't work.
• Download Flash uninstaller from Adobe/Macromedia. Uninstall Flash. Reinstall Flash.
• Windows Update now has no errors.
• I also, though I'm not sure it was necessary, did: "net stop WuAuServ", remove "windows\SoftwareDistribution" and "net start WuAuServ"
• Changed Windows Automatic Update to download but do not install.
  

It all seems to have resolved. In retrospect I think this all began when I installed Office with the 'remove install file option'. I use that option because I kept my install files on a hard drive. Alas, a separate hard drive in those days. Drive letter "D". Nowadays drive letter D: does not exist. The bug bites when Office looks for its install files using a drive letter that no longer exists. Office doesn't produce a dialog box or a reasonable error message, it just dies. The automated install process persists daily in the futile update. (Update: I've been told this was an ancient bug with Windows update too.)
I've written recently about Microsoft's mess This is a good example. In the process of debugging I ran into:

1. Listool.exe: the app that was supposed to fix this no longer works the way Microsoft thinks it does. My guess was they found a serious bug in it, stripped out the dangerous functionality, and never updated their many references to it.
2. All those critical alerts in the XP Events log that one has to dig down to find.
3. Incredibly obscure hex error messages.
4. Thousands of web pages related to automatic updater problems.
5. XP error messages with embedded URLs that no longer work or redirect.
6. An incredible bug in office where a change to a drive letter causes an incredible pile-up of cascading bugs.

I can't break the repair process down in much more detail because it was an insanely complex process. All I can do below is provide a set of links to web resources and some of the many different error messages I got along the way. I hope the time I spent putting this together will help someone; it's my way to repay those who's work helped debug this.

Here are of the more and less helpful web pages:

• Office updates are not successfully installed if you deploy updates by using Windows Server Update Services or the Microsoft Update Web site after the path of the local installation source changes
• Office 2003 Tool: Local Installation Source Tool: This looks promising, until you discover that Listool.exe has been broken and Microsoft hasn't noticed. The recommended fix is (remove=all) is not a supported command line option with this version. I suspect they lost the new version and somehow replaced it with an old one.
• Office updates are not successfully installed if you deploy updates by using Windows Server Update Services or the Microsoft Update Web site after the path of the local installation source changes: This was part of the problem, but of course LisTool.exe doesn't work any more. Still, it was a valuable clue.
• Windows Update Broke My Machine (svchost.exe -- application error), and How to Fix It: This was closely related. I followed some of the advice here. In particular "net stop WuAuServ", remove "windows\SoftwareDistribution" and "net start WuAuServ". I also turned off Windows automatic update - permanently.
• You receive a "Error 1327. Invalid Drive... " error message when you install Office 2003: This generally useless article was critical because of this one sentence: "Before you try to install Office 2003, check to see if the MSOCache folder exists. If it exists, you must move it to the location that is specified by the LocalCacheDrive registry subkey. To do this, use the Office 2003 Local Installation Source Tool (LISTool.exe)." I knew LISTool.exe was defective, but now I knew what registry key to manually edit using regedit.
• MS06-020: Vulnerabilities in Macromedia Flash Player from Adobe could allow remote code execution: This Microsoft automatic update failed with "Error Code: 0x643". I had to find the Flash uninstaller, run it, then run the Flash installer. Note the Flash installer has no UI -- it doesn't even say that it completed successfully.
• There are LOT of knowledge base articles related to automatic update failures.
• The Generic Host Process error. I got that one too, but this wasn't all that helpful.
• Solution available for Windows XP "Generic Host Process" error: This was one of the few links from Microsoft's logs and crashes that wasn't broken. I followed the recommendations, but I can't recall if this did anything.
  

Here are a few of the many error message and long entries I worked through:

Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address
0x00000000.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Product: Microsoft Office Professional Edition 2003 -- Error 1327. Invalid Drive: D:
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Product: Microsoft Office Professional Edition 2003 - Update 'Security Update for PowerPoint 2003
(KB923091): POWERPNT' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: http://go.microsoft.com/fwlink/?LinkId=23127

Error Code: 0x52F
Try to install the update again, or request help from one of the following resources.

Product: Microsoft Office Professional Edition 2003 -- Error 1327. Invalid Drive: D:
Product: Microsoft Office Professional Edition 2003 - Update 'Security Update for Excel 2003 (KB923088): EXCEL' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages.

Faulting application svchost.exe, version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

Update 3/27/07: I think this bug with Windows update scattering files across external drives may be a related flaw. Microsoft might have cleaned up the offending updater, but you need to delete the junk folders. I found I could not delete "updspapi.dll" from the update folder until I assigned full control permissions to myself as administrator.

Update 4/11/07: Another windows update (five fixes) again broke XP with the same error message, but the LocalCacheDrive setting was unchanged. I've disabled Microsoft Update for now. I really need to get rid of my last XP machine.

keywords: drive mapping, drive letter, windows update.