How can I get the reason

NTDEV
1

Dear All,
Please Help me to fix this problem.

I had write a class lower filter, and installed it on one computer(window xp sp2) by the regediy , then for some reason , i uninstalled it.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysstor32]
“start”=dword:00000000
“type”=dword:00000001
“ErrorControl”=dword:00000001
“Group”=“Extended Base”
“DisplayName”=“clsLowerFilter”
“ImagePath”=“system32\clsLowerFilter.sys”

a few days later, I tried to install it again, but this time , I found that the driver cannot be named with the old service name. It couldnot start with the system, and if I tried to use “net start”,I would got a 1058 error. But when I changed the service name , the driver looked work well.

How can solve this problem?

2

How did you uninstall your driver and service?

On Sat, Aug 2, 2008 at 1:16 AM, illiac wrote:

>
> Dear All,
> Please Help me to fix this problem.
>
> I had write a class lower filter, and installed it on one
> computer(window xp sp2) by the regediy , then for some reason , i
> uninstalled it.
>
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysstor32]
> “start”=dword:00000000
> “type”=dword:00000001
> “ErrorControl”=dword:00000001
> “Group”=“Extended Base”
> “DisplayName”=“clsLowerFilter”
> “ImagePath”=“system32\clsLowerFilter.sys”
>
> a few days later, I tried to install it again, but this time , I
> found that the driver cannot be named with the old service name. It couldnot
> start with the system, and if I tried to use “net start”,I would got a 1058
> error. But when I changed the service name , the driver looked work well.
>
> How can solve this problem?
>
>
>
>
>
>
>
>
> — NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and
> other seminars visit: http://www.osr.com/seminars To unsubscribe, visit
> the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

–
Mark Roddy

3

I just delete the service in the registry and reboot it

so I delete the registry key below:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysstor32]

Is there any problem with it ?It looked that the problem laid there, but I could not get the reason

??2008-08-02 18:52:41??“Mark Roddy” д???

How did you uninstall your driver and service?

On Sat, Aug 2, 2008 at 1:16 AM, illiac wrote:

Dear All,
Please Help me to fix this problem.

I had write a class lower filter, and installed it on one computer(window xp sp2) by the regediy , then for some reason , i uninstalled it.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysstor32]
“start”=dword:00000000
“type”=dword:00000001
“ErrorControl”=dword:00000001
“Group”=“Extended Base”
“DisplayName”=“clsLowerFilter”
“ImagePath”=“system32\clsLowerFilter.sys”

a few days later, I tried to install it again, but this time , I found that the driver cannot be named with the old service name. It couldnot start with the system, and if I tried to use “net start”,I would got a 1058 error. But when I changed the service name , the driver looked work well.

How can solve this problem?

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Mark Roddy

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

4

You have to reboot.

Here is what happens: the servioce entry in registry is mirrored by an in-memory copy of SM’s database.

If you delete the service from the registry (but it is still in memory) and try to create it, you get ERROR_SERVICE_MARKED_FOR_DELETE = 1072; if you want to start this service without rebooting, you get ERROR_SERVICE_DISABLED = 1058.

Both errors are SM complaints “I have it in memory but not in registry”.

…
DWORD gle;
SetLastError(S_OK);
SC_HANDLE hSvc = CreateServiceW(hSvcMgr, serviceName, serviceName,
SERVICE_ALL_ACCESS,
SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL,
fullPathToDriverSys, 0, 0, 0, 0, 0);
…
gle = GetLastError(); // 1072 = 0x430 = ERROR_SERVICE_MARKED_FOR_DELETE
…
BOOL brc = StartService(hSvc, 0, 0);
…
DWORD gle = GetLastError();
// 1058 = 0x422 = ERROR_SERVICE_DISABLED, if ERROR_SERVICE_MARKED_FOR_DELETE above

----- Original Message -----
From: illiac
To: Windows System Software Devs Interest List
Sent: Saturday, August 02, 2008 10:02 PM
Subject: Re:Re: [ntdev] How can I get the reason

I just delete the service in the registry and reboot it

so I delete the registry key below:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysstor32]

Is there any problem with it ?It looked that the problem laid there, but I could not get the reason

??2008-08-02 18:52:41??“Mark Roddy” д???

How did you uninstall your driver and service?

On Sat, Aug 2, 2008 at 1:16 AM, illiac wrote:

Dear All,
Please Help me to fix this problem.

I had write a class lower filter, and installed it on one computer(window xp sp2) by the regediy , then for some reason , i uninstalled it.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysstor32]
“start”=dword:00000000
“type”=dword:00000001
“ErrorControl”=dword:00000001
“Group”=“Extended Base”
“DisplayName”=“clsLowerFilter”
“ImagePath”=“system32\clsLowerFilter.sys”

a few days later, I tried to install it again, but this time , I found that the driver cannot be named with the old service name. It couldnot start with the system, and if I tried to use “net start”,I would got a 1058 error. But when I changed the service name , the driver looked work well.

How can solve this problem?

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Mark Roddy

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

Maybe reboot cannot help me.

I deleted the service registry key and then rebooted it, when the reboot finished, I used “net start ***” to start the service.

As I expected, I got a error description “The service does not exist”.

at that time, I thought that it was sure that the system had deleted the service, So I installed the service again,
and then rebooted the windows .

But just as it finished, I used “net start ***” and got a error with code 1058.

Puzzled!

??2008-08-03 19:05:24??“Alex Shvedov” д???

You have to reboot.

Here is what happens: the servioce entry in registry is mirrored by an in-memory copy of SM’s database.

If you delete the service from the registry (but it is still in memory) and try to create it, you get ERROR_SERVICE_MARKED_FOR_DELETE = 1072; if you want to start this service without rebooting, you get ERROR_SERVICE_DISABLED = 1058.

Both errors are SM complaints “I have it in memory but not in registry”.

…
DWORD gle;
SetLastError(S_OK);
SC_HANDLE hSvc = CreateServiceW(hSvcMgr, serviceName, serviceName,
SERVICE_ALL_ACCESS,
SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, SERVICE_ERROR_NORMAL,
fullPathToDriverSys, 0, 0, 0, 0, 0);
…
gle = GetLastError(); // 1072 = 0x430 = ERROR_SERVICE_MARKED_FOR_DELETE
…
BOOL brc = StartService(hSvc, 0, 0);
…
DWORD gle = GetLastError();
// 1058 = 0x422 = ERROR_SERVICE_DISABLED, if ERROR_SERVICE_MARKED_FOR_DELETE above

----- Original Message -----
From:illiac
To:Windows System Software Devs Interest List
Sent: Saturday, August 02, 2008 10:02 PM
Subject: Re:Re: [ntdev] How can I get the reason

I just delete the service in the registry and reboot it

so I delete the registry key below:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysstor32]

Is there any problem with it ?It looked that the problem laid there, but I could not get the reason

??2008-08-02 18:52:41??“Mark Roddy” д???

How did you uninstall your driver and service?

On Sat, Aug 2, 2008 at 1:16 AM, illiac wrote:

Dear All,
Please Help me to fix this problem.

I had write a class lower filter, and installed it on one computer(window xp sp2) by the regediy , then for some reason , i uninstalled it.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysstor32]
“start”=dword:00000000
“type”=dword:00000001
“ErrorControl”=dword:00000001
“Group”=“Extended Base”
“DisplayName”=“clsLowerFilter”
“ImagePath”=“system32\clsLowerFilter.sys”

a few days later, I tried to install it again, but this time , I found that the driver cannot be named with the old service name. It couldnot start with the system, and if I tried to use “net start”,I would got a 1058 error. But when I changed the service name , the driver looked work well.

How can solve this problem?

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Mark Roddy

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer--- NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

6

I did some experiment again and I found that the driver couldnot be named with the old name .

first I changed “ImagePath”=“system32\sysstor32.sys” to “ImagePath”=“system32\sysstor.sys” and renamed the driver, then I rebooted the system.

when the system started, I found that the driver was working well.

So only the driver name matters, should it be changed to another name ?

??2008-08-02??illiac д???

Dear All,
Please Help me to fix this problem.

I had write a class lower filter, and installed it on one computer(window xp sp2) by the regediy , then for some reason , i uninstalled it.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysstor32]
“start”=dword:00000000
“type”=dword:00000001
“ErrorControl”=dword:00000001
“Group”=“Extended Base”
“DisplayName”=“clsLowerFilter”
“ImagePath”=“system32\clsLowerFilter.sys”

a few days later, I tried to install it again, but this time , I found that the driver cannot be named with the old service name. It couldnot start with the system, and if I tried to use “net start”,I would got a 1058 error. But when I changed the service name , the driver looked work well.

How can solve this problem?

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer