Some users have reported random problems at system startup such as user desktop not appearing, various services not working properly, and sound not working. These problems seem to be occurring sporadically, and restarting Windows often seems to resolve them until the next restart.
We've tracked this issue to early 0patch Agent activities (injecting 0patchLoader.dll into processes and applying patches into system services quickly after their startup), which seems to be met with unfavorable race conditions on a small fraction of users' computers.
The issue can be solved by delaying 0patch Agent activities at system startup. Depending on the severity of the problem, two delay options are available:
- Short delay: delaying until 0patch Service gets started (i.e., a couple of seconds, waiting for the most basic Windows services to start first), and
- Long delay: delaying for 1-2 minutes after system startup.
Using any of these delays will delay the application of micropatches to already running processes. For the Short delay, the impact is almost insignificant, while the Long delay will keep your computer exposed to attacks against unpatched vulnerabilities during the first 1-2 minutes after system startup. We therefore recommend first applying the Short delay, and then only if the problems persists, applying the Long delay. When using the Long delay, we also recommend not browsing the Internet or opening any documents received from unknown 3rd parties in the first 2 minutes after system startup (until 0patch Service gets started). The Long delay will prevent manual syncing via 0patch Console from working until 0patch Service is started.
Please follow the instructions below to apply the delay or restore immediate (no-delay) 0patch Agent operation. All changes will come into effect upon the next system startup.
Applying the Short delay
PowerShell
Launch PowerShell as local administrator, then execute the following commands:
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 0 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d $(Get-Random) /f
net stop 0patchService
net start 0patchService
Command Prompt / cmd.exe
Launch cmd.exe as local administrator, then execute the following commands:
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 0 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d %random%%random% /f
net stop 0patchService
net start 0patchService
Applying the Long delay
The Long delay works as an addition to the Short delay, so you have to already have the Short delay configured (see above for instructions on how to apply the Short delay).
Launch PowerShell or cmd.exe as local administrator, then execute the following command:
sc config 0patchService start= delayed-auto
Restoring immediate (no-delay) operation
This procedure removes both Short delay and Long Delay, restoring the default immediate (no-delay) operation of 0patch Agent.
PowerShell
Launch PowerShell as local administrator, then execute the following commands:
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 1 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d $(Get-Random) /f
net stop 0patchService
sc config 0patchService start= auto
net start 0patchService
Command Prompt / cmd.exe
Launch cmd.exe as local administrator, then execute the following commands:
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v InjectPermanently /t REG_DWORD /d 1 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d %random%%random% /f
net stop 0patchService
sc config 0patchService start= auto
net start 0patchService
Comments
8 comments
I'm baffled.
What's the random number in Counter for?
Hi bdgregory, our agent is reacting to changes in various Registry values; putting a random value in such values is almost certain to trigger a change, and get the agent to react. In this case, the agent reacts by unloading our DLL from running processes.
Hi Mitja,
I tried the short delay and the long delay on my Win7 Pro and Win10Home machines. The results were negative in all four cases, the problem persists and 0patch is not connecting to the server.
- Greg
Hi greg3k, your problems with 0patch Agent not connecting to the server were likely caused by our cert snafu (see https://twitter.com/0patch/status/1300735855603191808). Please try again; thanks and sorry!
I applied the Short Delay yesterday and tested it. Several times Windows 7 booted successfully, so I thought that was the solution. But this morning when I booted Windows 7 the same problems re-occurred. The first error in the System Event log was a 60s timeout for the RPC Endpoint Mapper service - many other services depend on the RPC Endpoint Mapper service so the rest of the boot up has lots of errors.
I then applied the Long Delay but that didn't delay the patches being applied (0patch.log file records "Patch 516 applied in application wininit.exe" only about 12 seconds following reboot). The Long Delay delayed the start of the 0patch service, but that did not help.
Is there a way of delaying the Agent, which could help by delaying the application of patches?
Same issue here w. Win7 64 bit SP1; applied the reg alterations (made a system restore point first), and it seems to have turned the trick. Thanks, Mitja. Nice to see an outfit that can admit an error, then turn around and provide a fix that fast.
As a new user of 0Patch, I'm impressed.
How so very NOT- Microsoft. :)
It goes without saying but if you're using Windows XP, then only the Short Delay patch can be applied. ;)
Thank you FranceBB, it seems Windows XP really doesn't support delayed start for services.
Please sign in to leave a comment.