Intel RST Installation Failure [NBZ]

The bug/issue

  1. What you did: Attempted to install Intel RST 10.1.0.1008 drivers.
  2. What actually happened or you actually saw: “Installation Framework has stopped working”.
  3. What you expected to happen or see: Install cleanly.
  4. How you tried to fix it & what happened: Disabled firewall/defense & it still didn’t install cleanly. Solution was to uninstall Comodo Firewall, reboot and restart RST installation.
  5. If its an application compatibility problem have you tried the application fixes here?: N/A
  6. Details & exact version of any application (execpt CIS) involved with download link: Intel RST 10.1.0.1008 drivers [at] http://downloadmirror.intel.com/19607/eng/iata_enu.exe
  7. Whether you can make the problem happen again, and if so exact steps to make it happen: Yes. Attempting installation, fails every time; while Comodo Firewall is installed.
  8. Any other information (eg your guess regarding the cause, with reasons): guard32.dll

Files appended. (Please zip unless screenshots).

  1. Screenshots illustrating the bug:
    http://i.imgur.com/uEXJF.png

  2. Screenshots of related CIS event logs and the Defense+ Active Processes List: N/A

  3. A CIS config report or file: N/A

  4. Crash or freeze dump file:

Problem signature:
  Problem Event Name:	APPCRASH
  Application Name:	Setup.exe_Intel(R) Installation Framework
  Application Version:	1.3.10.0
  Application Timestamp:	4cf4481d
  Fault Module Name:	guard32.dll
  Fault Module Version:	5.3.43550.1216
  Fault Module Timestamp:	4d1a8a4f
  Exception Code:	c00000fd
  Exception Offset:	0000a39a
  OS Version:	6.1.7600.2.0.0.256.1
  Locale ID:	1033
  Additional Information 1:	7b20
  Additional Information 2:	7b20d75c3e394b06ecd495104a7e724a
  Additional Information 3:	bfa0
  Additional Information 4:	bfa0f7d72cf8a03c472b3c75c8d629df

via Report.wer

Version=1
EventType=APPCRASH
EventTime=129428022740509684
ReportType=2
Consent=1
ReportIdentifier=15159c6c-3e0d-11e0-96d3-002354f34e13
IntegratorReportIdentifier=15159c6b-3e0d-11e0-96d3-002354f34e13
WOW64=1
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=Setup.exe_Intel(R) Installation Framework
Sig[1].Name=Application Version
Sig[1].Value=1.3.10.0
Sig[2].Name=Application Timestamp
Sig[2].Value=4cf4481d
Sig[3].Name=Fault Module Name
Sig[3].Value=guard32.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=5.3.43550.1216
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=4d1a8a4f
Sig[6].Name=Exception Code
Sig[6].Value=c00000fd
Sig[7].Name=Exception Offset
Sig[7].Value=0000a39a
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.1.7600.2.0.0.256.1
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=7b20
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=7b20d75c3e394b06ecd495104a7e724a
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=bfa0
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=bfa0f7d72cf8a03c472b3c75c8d629df
UI[2]=C:\Windows\Temp\IIF2\Setup.exe
UI[3]=Intel(R) Installation Framework has stopped working
UI[4]=Windows can check online for a solution to the problem.
UI[5]=Check online for a solution and close the program
UI[6]=Check online for a solution later and close the program
UI[7]=Close the program
LoadedModule[0]=C:\Windows\Temp\IIF2\Setup.exe
LoadedModule[1]=C:\Windows\SysWOW64\ntdll.dll
LoadedModule[2]=C:\Windows\syswow64\kernel32.dll
LoadedModule[3]=C:\Windows\syswow64\KERNELBASE.dll
LoadedModule[4]=C:\Windows\syswow64\USER32.dll
LoadedModule[5]=C:\Windows\syswow64\GDI32.dll
LoadedModule[6]=C:\Windows\syswow64\LPK.dll
LoadedModule[7]=C:\Windows\syswow64\USP10.dll
LoadedModule[8]=C:\Windows\syswow64\msvcrt.dll
LoadedModule[9]=C:\Windows\syswow64\ADVAPI32.dll
LoadedModule[10]=C:\Windows\SysWOW64\sechost.dll
LoadedModule[11]=C:\Windows\syswow64\RPCRT4.dll
LoadedModule[12]=C:\Windows\syswow64\SspiCli.dll
LoadedModule[13]=C:\Windows\syswow64\CRYPTBASE.dll
LoadedModule[14]=C:\Windows\syswow64\SHELL32.dll
LoadedModule[15]=C:\Windows\syswow64\SHLWAPI.dll
LoadedModule[16]=C:\Windows\syswow64\ole32.dll
LoadedModule[17]=C:\Windows\system32\Cabinet.dll
LoadedModule[18]=C:\Windows\syswow64\SETUPAPI.dll
LoadedModule[19]=C:\Windows\syswow64\CFGMGR32.dll
LoadedModule[20]=C:\Windows\syswow64\OLEAUT32.dll
LoadedModule[21]=C:\Windows\syswow64\DEVOBJ.dll
LoadedModule[22]=C:\Windows\system32\VERSION.dll
LoadedModule[23]=C:\Windows\syswow64\PSAPI.DLL
LoadedModule[24]=C:\Windows\system32\apphelp.dll
LoadedModule[25]=C:\Windows\AppPatch\AcGenral.DLL
LoadedModule[26]=C:\Windows\system32\UxTheme.dll
LoadedModule[27]=C:\Windows\system32\WINMM.dll
LoadedModule[28]=C:\Windows\system32\samcli.dll
LoadedModule[29]=C:\Windows\system32\MSACM32.dll
LoadedModule[30]=C:\Windows\system32\sfc.dll
LoadedModule[31]=C:\Windows\system32\sfc_os.DLL
LoadedModule[32]=C:\Windows\system32\USERENV.dll
LoadedModule[33]=C:\Windows\system32\profapi.dll
LoadedModule[34]=C:\Windows\system32\dwmapi.dll
LoadedModule[35]=C:\Windows\syswow64\urlmon.dll
LoadedModule[36]=C:\Windows\syswow64\WININET.dll
LoadedModule[37]=C:\Windows\syswow64\iertutil.dll
LoadedModule[38]=C:\Windows\syswow64\CRYPT32.dll
LoadedModule[39]=C:\Windows\syswow64\MSASN1.dll
LoadedModule[40]=C:\Windows\system32\MPR.dll
LoadedModule[41]=C:\Windows\system32\IMM32.DLL
LoadedModule[42]=C:\Windows\syswow64\MSCTF.dll
LoadedModule[43]=C:\Windows\SysWOW64\guard32.dll
LoadedModule[44]=C:\Windows\system32\fltlib.dll
LoadedModule[45]=C:\Windows\system32\Riched20.dll
LoadedModule[46]=C:\Windows\SysWOW64\msls31.dll
LoadedModule[47]=C:\Windows\Temp\IIF2\Lang\en-us\Setup.exe.mui
LoadedModule[48]=C:\Windows\system32\DEVRTL.dll
LoadedModule[49]=C:\Windows\system32\SPINF.dll
LoadedModule[50]=C:\Windows\syswow64\WINTRUST.dll
LoadedModule[51]=C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
LoadedModule[52]=C:\Windows\syswow64\CLBCatQ.DLL
FriendlyEventName=Stopped working
ConsentKey=APPCRASH
AppName=Intel(R) Installation Framework
AppPath=C:\Windows\Temp\IIF2\Setup.exe

Your set-up

  1. CIS version, AV database version & configuration used: 5.3.176757.1236
  2. a) Have you updated (without uninstall) from CIS 3 or 4: No.
    b) if so, have you tried a clean reinstall (without losing settings - if not please do)?:
  3. a) Have you imported a config from a previous version of CIS: No.
    b) if so, have U tried a standard config (without losing settings - if not please do)?:
  4. Have you made any other major changes to the default config? (eg ticked ‘block all unknown requests’, other egs here.): No.
  5. Defense+, Sandbox, Firewall & AV security levels: D+ Disable. Everything else [at] Default settings.
  6. OS version, service pack, number of bits, UAC setting, & account type: Windows 7, N/A, x64, Disabled, Administrator
  7. Other security and utility software installed: MSE.
  8. Virtual machine used (Please do NOT use Virtual box): N/A

I’ve already seen reports from other users (on forums like OCN) having hit this bug, so it’s obviously not an isolated incident.

Hey and warm welcome to comodo forums Trigunflame!

I am sorry to hear that CIS is giving you trouble.

Could you show us your d+logs (CIS → d+ → view d+ events)

You can also try to add this exe file by going to CIS —> Defense+ —> Defense+ Settings —> Execution control Settings —> Detect shellcode injections (i.e. Buffer overflow protection) —> Exclusions —> Add —> Browse…

Regards,
Valentin N

D+ is disabled. I use MSE for AV/Malware.

http://i.imgur.com/cGUP4.png

http://i.imgur.com/ARWxj.png


Update:

I decided to try out your suggestion, and with slight modification found it to work.

Though it begs the question: Why would changes to Any of these settings make a difference, if Defense+ had supposedly been “Permanently Disabled” as it should have been. Shouldn’t that One setting prevent any of this from being necessary? Added to that, moving the Execution Control Level to Disabled didn’t resolve this behavior either. Last but not least, simply unchecking “Detect shellcode injections” in and of itself would not prevent the error from occurring.

If Any of those items (D+ Security Level, Execution Control Level or “Detect shellcode injections” respected their “Disabled” selection) the item in question (Intel RST) shouldn’t need to be added to an exclusion list.

To summarize:

Defense+: Disabled
Everything else: Default
RST installation fails.

http://i.imgur.com/P5JIc.png

http://i.imgur.com/s72hD.png

Defense+: Disabled
Execution Control Level: Disabled
Everything else: Default
RST installation fails.

http://i.imgur.com/P5JIc.png

http://i.imgur.com/S2w2k.png

Defense+: Disabled
Execution Control Level: Disabled
Detect Shellcode injections: Disabled
Everything else: Default
RST installation fails.

http://i.imgur.com/P5JIc.png

http://i.imgur.com/DVBrE.png

Defense+: Disabled
Execution Control Level: Disabled
Detect Shellcode injections: Disabled
Exclusions list: Populated with *
Everything else: Default
RST installation successful.

http://i.imgur.com/P5JIc.png

http://i.imgur.com/DVBrE.png

http://i.imgur.com/EvutI.png

please add MSE in exclusion and try to see if that helps.

Regards,
Valentin N

Unfortunately it didn’t make a difference. Both MsMpEng.exe & msseces.exe were added to the exclusions list.
However, as previously noted, using either “Executables” or “All applications” managed to work fine.

Thank you for your bug report in the required format.

Moved to verified.

Thank you

Dennis

Ran into the same issue today myself. The only D+ change I made to get the installer to complete was to put the “*” in the shell-code exception list.

Configuration: Proactive
AV: Enabled - Stateful
Firewall: Enabled - Safe Mode
Defense+: Enabled - Safe Mode
Sandbox: Enabled
Execution Control Level: All Enabled - Treat unrecognized as Untrusted
Detect Shellcode injections: Enabled - but added “*” as the exception

Certainly still a bug, but hopefully this helps narrow the developer “fix” search.

Thanks for the catch Trigunflame!

Thanks guys. The issue will be fixed soon.

Doskey

For reference, I’m having the exact same problem trying to install the same version of Intel RST. Just like the original poster, I also have D+ disabled and marked as Permanently Deactivated. Adding “all executables” to the D+ exceptions list allowed Intel RST to install, but this is fully contradictory to D+ being disabled.

I’ve experience two other times in the past where D+ interceded with a process even though it’s “deactivated”. Those instances weren’t too critical, so I didn’t complain. But, this RST installation failure eventually lead to a startup BSOD which took some time to resolve. I’m now starting to wonder if some of the other app crashes I’ve experienced are being caused by D+. With that in mind, my question to the techs here is…

Why is D+ still active even though it’s marked as Disabled and Permanently Deactivated? Is it possible to completely un-install the D+ portion of the program? Or, perhaps make the installation more modular so that D+ is an installation option and not mandatory?

Thanks!

  • nn6o

I experienced the exact same conflict on this Intel driver. I was pretty lost amongst all the tech-talk above, but imitated the screenprints above where the install was successful and I manged to get the driver installed this time.

I hope this stops my system instability. I even had an BSOD while trying to figure out how to reconfigure D+ the first time around.

sigh