Sunday, November 26, 2006

The memory could not be read: Anatomy of a complex series of Microsoft defects

This is how it began. A notice on startup from svchost.exe that referenced memory at 0x00000000 could not be read.







Not a very helpful error message. Then I looked into the XP event log, that invaluable and invisible resource that Microsoft hides from users. The only thing worse than an unresponsive fire alarm is a silent fire alarm. Microsoft's technological indictments include hiding fatal errors from users.

There I saw a number of cryptic messages indicating that my automated updates had been failing -- and that this might also have been causing my automated Retrospect Professional backups to fail (that's by far the most serious problem here). That's when the detective work began, a series of probes and explorations powered by Google. The bottom line fixes were, I think:
  • Turn off Windows Automatic Update (aka Microsoft Update)
  • Use Regedit to find "LocalCacheDrive" settings for Office. Notice that the drive letter is "D" when it should be "C". Change it.
  • Repair the Office installation.
  • Manually run Windows Update.
  • Discover Flash update still doesn't work.
  • Download Flash uninstaller from Adobe/Macromedia. Uninstall Flash. Reinstall Flash.
  • Windows Update now has no errors.
  • I also, though I'm not sure it was necessary, did: "net stop WuAuServ", remove "windows\SoftwareDistribution" and "net start WuAuServ"
  • Changed Windows Automatic Update to download but do not install.
It all seems to have resolved. In retrospect I think this all began when I installed Office with the 'remove install file option'. I use that option because I kept my install files on a hard drive. Alas, a separate hard drive in those days. Drive letter "D". Nowadays drive letter D: does not exist. The bug bites when Office looks for its install files using a drive letter that no longer exists. Office doesn't produce a dialog box or a reasonable error message, it just dies. The automated install process persists daily in the futile update. (Update: I've been told this was an ancient bug with Windows update too.)
I've written recently about Microsoft's mess This is a good example. In the process of debugging I ran into:
1. Listool.exe: the app that was supposed to fix this no longer works the way Microsoft thinks it does. My guess was they found a serious bug in it, stripped out the dangerous functionality, and never updated their many references to it.
2. All those critical alerts in the XP Events log that one has to dig down to find.
3. Incredibly obscure hex error messages.
4. Thousands of web pages related to automatic updater problems.
5. XP error messages with embedded URLs that no longer work or redirect.
6. An incredible bug in office where a change to a drive letter causes an incredible pile-up of cascading bugs.
I can't break the repair process down in much more detail because it was an insanely complex process. All I can do below is provide a set of links to web resources and some of the many different error messages I got along the way. I hope the time I spent putting this together will help someone; it's my way to repay those who's work helped debug this.

Here are of the more and less helpful web pages:
Here are a few of the many error message and long entries I worked through:
Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address
0x00000000.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Product: Microsoft Office Professional Edition 2003 -- Error 1327. Invalid Drive: D:
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Product: Microsoft Office Professional Edition 2003 - Update 'Security Update for PowerPoint 2003
(KB923091): POWERPNT' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: http://go.microsoft.com/fwlink/?LinkId=23127

Error Code: 0x52F
Try to install the update again, or request help from one of the following resources.

Product: Microsoft Office Professional Edition 2003 -- Error 1327. Invalid Drive: D:
Product: Microsoft Office Professional Edition 2003 - Update 'Security Update for Excel 2003 (KB923088): EXCEL' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages.

Faulting application svchost.exe, version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000.
Update 3/27/07: I think this bug with Windows update scattering files across external drives may be a related flaw. Microsoft might have cleaned up the offending updater, but you need to delete the junk folders. I found I could not delete "updspapi.dll" from the update folder until I assigned full control permissions to myself as administrator.

Update 4/11/07: Another windows update (five fixes) again broke XP with the same error message, but the LocalCacheDrive setting was unchanged. I've disabled Microsoft Update for now. I really need to get rid of my last XP machine.

keywords: drive mapping, drive letter, windows update.

3 comments:

Anonymous said...

Use Regedit to find "LocalCacheDrive" settings for Office. Notice that the drive letter is "D" when it should be "C". Change it.

What a godsend. I had moved my disks around and changed the drive letters and could no longer get the Office updates to run. Applied the above registry change and it worked great for the first test update I tried. I'm applying all the other stacked up patches now. Thanks again,
Greg

Andrew Whittington said...

Gordon
Well Done mate.
Many other suggestions from other places, mostly involving getting help from MS.
But before trying that drastic step, I kept looking and came across your suggestion.
Yes - I had reorganised my disks, specifying an older drive for my temp stuff, then later on I changed my mind and used a different old disk.
Editing the Registry was the answer to my woes.
2 mins to apply the fix and 5 minutes to re-apply the updates.
Job done. No need to involve others (especially MS).
You're a star.

JGF said...

you're welcome Andrew. Every so often these old posts do seem to be valuable.