Possible fix for the MSI Event Viewer messages

Questions about Update Pack making? Ask here.
Post Reply
User avatar
redxii
Posts: 395
Joined: Sun Dec 17, 2006 5:50 pm

Possible fix for the MSI Event Viewer messages

Post by redxii » Tue Nov 18, 2008 3:46 pm

The following is present when MSI 4.5 is integrated:
HKLM,"System\CurrentControlSet\Services\EventLog\Application\MsiInstaller","EventMessageFile",0x00000000,"%11%\msimsg.dll"

For some reason "EventMessageFile" is set to "%11%\msimsg.dll", this is incorrect, it's supposed to be "%11%\msi.dll". If you installed Windows Installer 4.5 via hotfix it would still be set correctly.

If you already have Windows installed, you can change it to the correct value and all the MSI Installer entries in Event Viewer will automagically turn into what they're supposed to say. The MUI files are still relevant, if you still want MSI error/info dialogs to display correctly.
Last edited by redxii on Tue Nov 18, 2008 4:24 pm, edited 1 time in total.

User avatar
ricktendo64
Posts: 3213
Joined: Mon May 22, 2006 12:27 am
Location: Honduras

Post by ricktendo64 » Tue Nov 18, 2008 4:15 pm

Thanks for pointing this out dude, I did not add the hotfix other reg entries because I thought they were the same (did not pay attention to changed registry in installwatch) but now I think I will add all of them

User avatar
redxii
Posts: 395
Joined: Sun Dec 17, 2006 5:50 pm

Post by redxii » Tue Nov 18, 2008 5:22 pm

Or just that one. It sets it to msimsg.dll at the very beginning of XP setup, I searched every inf and don't see where/how it determines either msi.dll or msimsg.dll is the EventMessageFile.

User avatar
ricktendo64
Posts: 3213
Joined: Mon May 22, 2006 12:27 am
Location: Honduras

Post by ricktendo64 » Tue Nov 18, 2008 5:29 pm

This is where windows search comes in very handy, you could add inf to the index and searching will be much easier

User avatar
redxii
Posts: 395
Joined: Sun Dec 17, 2006 5:50 pm

Post by redxii » Tue Nov 18, 2008 5:38 pm

I already searched EVERY inf, using plain search, and Windows Installer is perhaps the only component which the EventLog keys aren't set up using infs.

I also looked inside the 4.5 files with a hex editor, it's probably set (incorrectly) by msi.dll. I'm just going by this:

E.v.e.n.t.M.e.s.s.a.g.e.F.i.l.e.....T.y.p.e.s.S.u.p.p.o.r.t.e.d.........%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.m.s.i.m.s.g...d.l.l

User avatar
RogueSpear
Posts: 1155
Joined: Tue Nov 23, 2004 9:50 pm
Location: Buffalo, NY

Post by RogueSpear » Tue Nov 18, 2008 6:36 pm

Well Microsoft just released a patch last week for a seven year old documented security vulnerability with SMB. Let's hope we don't have to wait for Windows Installer v10.0

User avatar
code65536
Posts: 735
Joined: Wed Mar 14, 2007 2:58 pm
Location: .us
Contact:

Post by code65536 » Tue Nov 18, 2008 8:32 pm

redxii wrote:I searched every inf and don't see where/how it determines either msi.dll or msimsg.dll is the EventMessageFile.
It's set by msi.dll's DllRegisterServer, so it's set by the DLL's self-registration.

Code: Select all

Disassembly of DllRegisterServer  (0x3FE815AD)
0x3FE81642: BE3019E83F             MOV         ESI,0x3FE81930   ; .text:%SystemRoot%\system32\msimsg.dll 
0x3FE81647: 56                     PUSH        ESI              
0x3FE81648: C78554FFFFFF07000000   MOV         DWORD PTR [EBP-0xAC],0x7
0x3FE81652: FF15E812DE3F           CALL        DWORD PTR [KERNEL32.DLL!lstrlenW]; (0x3FDE12E8) 
0x3FE81658: 8D440002               LEA         EAX,[EAX+EAX+0x2]
0x3FE8165C: 50                     PUSH        EAX              
0x3FE8165D: 56                     PUSH        ESI              
0x3FE8165E: 6A02                   PUSH        0x2              
0x3FE81660: 57                     PUSH        EDI              
0x3FE81661: 68E818E83F             PUSH        0x3FE818E8       ; .text:EventMessageFile 
0x3FE81666: FFB558FFFFFF           PUSH        DWORD PTR [EBP-0xA8]
0x3FE8166C: FFD3                   CALL        EBX_IS_ADVAPI32.DLL!RegSetValueExW              
0x3FE8166E: 6A04                   PUSH        0x4              
0x3FE81670: 8D8554FFFFFF           LEA         EAX,[EBP-0xAC]   
0x3FE81676: 50                     PUSH        EAX              
0x3FE81677: 6A04                   PUSH        0x4              
0x3FE81679: 57                     PUSH        EDI              
0x3FE8167A: 680C19E83F             PUSH        0x3FE8190C       ; .text:TypesSupported 
0x3FE8167F: FFB558FFFFFF           PUSH        DWORD PTR [EBP-0xA8]
0x3FE81685: FFD3                   CALL        EBX_IS_ADVAPI32.DLL!RegSetValueExW              
msimsg.dll does not contain a MESSAGETABLE resource, but msi.dll does, so it looks like Microsoft moved the messages to msi.dll but forgot to update it in the self-registration; this won't be the first time that they changed something but forgot to update the self-registration code--these errors probably go uncaught when they rely on other means of registration other than self-registration, which is what they've been doing more and more lately (not doing self-reg allows them to more easily do a "dump a disk and registry image" method of setup like that used for Vista).
My addons: CmdOpen - HashCheck - Notepad2 - MS Runtimes - DirectX

Into the breach, meatbags!

User avatar
redxii
Posts: 395
Joined: Sun Dec 17, 2006 5:50 pm

Post by redxii » Tue Nov 18, 2008 8:53 pm

I don't believe they moved it at all, it's in and always has been in msi.dll. Version 3.1 is included in SP3, the one with the Eventlog messages is msi.dll and in 4.5 it's still msi.dll.

They did move all the messages from msimsg.dll into separate msimsg.dll.mui files, those were dialogs and not Eventlogs.

Anyway, that one registry key can be added under KB942288.AddReg, it won't be overwritten during registration part in setup.

User avatar
code65536
Posts: 735
Joined: Wed Mar 14, 2007 2:58 pm
Location: .us
Contact:

Post by code65536 » Tue Nov 18, 2008 9:05 pm

Yea, you're right; I forgot about the .mui files. msi.dll contains several MESSAGETABLEs--one for each language. Each of msi.dll's tables is identical to the table found in the corresponding .mui file. So you are getting, regardless of locale, the same message table whether you look in msimsg.dll or msi.dll, which is what makes replacing msimsg with msi workable. So I guess some applications do not handle .mui files correctly?
My addons: CmdOpen - HashCheck - Notepad2 - MS Runtimes - DirectX

Into the breach, meatbags!

User avatar
ricktendo64
Posts: 3213
Joined: Mon May 22, 2006 12:27 am
Location: Honduras

Post by ricktendo64 » Tue Nov 18, 2008 10:30 pm

If you remove msimsg.dll how will you get the msi switches when you do msiexec /?

User avatar
code65536
Posts: 735
Joined: Wed Mar 14, 2007 2:58 pm
Location: .us
Contact:

Post by code65536 » Tue Nov 18, 2008 10:49 pm

ricktendo64 wrote:If you remove msimsg.dll how will you get the msi switches when you do msiexec /?
Well, in many cases, it's hard-coded where you should go to look for a resource. Within msi, it's probably hard-coded that it should look in msimsg.dll and its corresponding .mui files. An "outsider" like the event log usually don't have that "look in msimsg" coded in and will instead take cues from elsewhere--in this case, it looks in the registry. So I'm guessing that the way that the event log loads a message table resource doesn't take into account .mui files. So changing the key here will only affect this particular consumer of the resource.
My addons: CmdOpen - HashCheck - Notepad2 - MS Runtimes - DirectX

Into the breach, meatbags!

User avatar
MrNxDmX
Moderator
Posts: 3112
Joined: Mon Jan 03, 2005 7:33 am

Post by MrNxDmX » Tue Nov 18, 2008 10:56 pm

rick, i changed values in registry, then did "msiexec /?". Both gave same results.

User avatar
redxii
Posts: 395
Joined: Sun Dec 17, 2006 5:50 pm

Post by redxii » Tue Nov 18, 2008 11:14 pm

EventLog isn't hardcoded where to look, that key does determine where it looks. Apparently they want EventLog to retrieve them from "%SystemRoot%\system32\msimsg.dll", and as we see that just plain doesn't work when looking in Event Viewer & any MsiInstaller entry. It'll be set to msimsg.dll in the "self-registration", but then again if you install via hotfix that key will remain as msi.dll.

MrNxDmX: "msiexec /?" doesn't have anything to do with this particular registry key, it has only to do with Event Viewer and nothing else.

User avatar
ricktendo64
Posts: 3213
Joined: Mon May 22, 2006 12:27 am
Location: Honduras

Post by ricktendo64 » Wed Nov 19, 2008 12:29 am

Code said he was going to try and remove msimsg.dll, i asked if that would break msiexec /?

User avatar
redxii
Posts: 395
Joined: Sun Dec 17, 2006 5:50 pm

Post by redxii » Wed Nov 19, 2008 12:38 am

Yes, deleting msimsg.dll does break 'msiexec /?'.

User avatar
code65536
Posts: 735
Joined: Wed Mar 14, 2007 2:58 pm
Location: .us
Contact:

Post by code65536 » Wed Nov 19, 2008 1:50 am

ricktendo64 wrote:Code said he was going to try and remove msimsg.dll, i asked if that would break msiexec /?
I didn't say that; I only said that whatever was in the msimsg.dll MUIs are exactly duplicated (for all locales) in msi.dll; I did not mean for it to be an implication that msimsg could then be deleted. ;) (If you were referring to what I said even earlier, that was speculation that turned out to be partly incorrect.)
My addons: CmdOpen - HashCheck - Notepad2 - MS Runtimes - DirectX

Into the breach, meatbags!

User avatar
5eraph
Site Admin
Posts: 4618
Joined: Tue Jul 05, 2005 9:38 pm
Location: Riverview, MI USA

Post by 5eraph » Wed Nov 19, 2008 5:39 am

Works for me in XP x64 with slight alterations of the line above to match the extant data type:

Code: Select all

HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\Application\MsiInstaller","EventMessageFile",[color=yellow]0x20000[/color],"[color=yellow]%SystemRoot%\system32[/color]\[color=orange]msi.dll[/color]"

User avatar
RogueSpear
Posts: 1155
Joined: Tue Nov 23, 2004 9:50 pm
Location: Buffalo, NY

Post by RogueSpear » Thu Nov 27, 2008 7:22 am

This just came out: KB958655

User avatar
5eraph
Site Admin
Posts: 4618
Joined: Tue Jul 05, 2005 9:38 pm
Location: Riverview, MI USA

Post by 5eraph » Thu Nov 27, 2008 8:16 am

There's already a v2 of that fix on Xable's Hotfix Share. ;)

User avatar
redxii
Posts: 395
Joined: Sun Dec 17, 2006 5:50 pm

Post by redxii » Thu Nov 27, 2008 8:19 am

Still set to msimsg.dll.

User avatar
RogueSpear
Posts: 1155
Joined: Tue Nov 23, 2004 9:50 pm
Location: Buffalo, NY

Post by RogueSpear » Thu Nov 27, 2008 8:27 am

redxii wrote:Still set to msimsg.dll.
Makes me wonder what it is that they're fixing :?

User avatar
ricktendo64
Posts: 3213
Joined: Mon May 22, 2006 12:27 am
Location: Honduras

Post by ricktendo64 » Thu Nov 27, 2008 10:48 am

They probably don't know about it yet and when they do know give em a break, give em like 5 years to fix it :D

User avatar
RogueSpear
Posts: 1155
Joined: Tue Nov 23, 2004 9:50 pm
Location: Buffalo, NY

Post by RogueSpear » Fri Nov 28, 2008 9:13 pm

redxii wrote:Still set to msimsg.dll.
The v2 hotfix set it properly on a couple of machines at work. I purposefully sought out a couple of SP3 w/ MSI 4.5 installs to test the hotfix on. Maybe v1 didn't set it right?

User avatar
redxii
Posts: 395
Joined: Sun Dec 17, 2006 5:50 pm

Post by redxii » Fri Nov 28, 2008 9:53 pm

I already had v2. You're talking about clean installs, aren't you? If you run the hotfix it doesn't touch that registry key, if you delete it then upgrade SP3's MSI 3.1 to 4.5, it won't create it either.

User avatar
yumeyao
Moderator
Posts: 1718
Joined: Sun Aug 27, 2006 9:24 pm
Location: Taiyuan, Shanxi, PR China

Post by yumeyao » Fri Nov 28, 2008 9:56 pm

just wondering....
if set to msi.dll other than msimsg.dll, will all messages appear in english?
Image
My work list(Hosted by dumpydooby)

User avatar
5eraph
Site Admin
Posts: 4618
Joined: Tue Jul 05, 2005 9:38 pm
Location: Riverview, MI USA

Post by 5eraph » Sat Nov 29, 2008 12:31 am

I'd imagine they'll appear in whatever language your OS is set to display. For me, that's English.

You can change it manually and see immediately whether that's the case for you.

User avatar
yumeyao
Moderator
Posts: 1718
Joined: Sun Aug 27, 2006 9:24 pm
Location: Taiyuan, Shanxi, PR China

Post by yumeyao » Sat Nov 29, 2008 3:36 am

but any description on this?
how do i check event log's outputs?
and output generated by what? by installing a msi-based installer?

any help would be appreciated.
Image
My work list(Hosted by dumpydooby)

User avatar
5eraph
Site Admin
Posts: 4618
Joined: Tue Jul 05, 2005 9:38 pm
Location: Riverview, MI USA

Post by 5eraph » Sat Nov 29, 2008 4:54 am

To check the event viewer, type "eventvwr.msc" in the Run box. Choose Application in the left pane, then find MsiInstaller sources and double-click. You should see something like this if the key is set correctly:

Image

If it's not set correctly then you'll see this:

Image

User avatar
yumeyao
Moderator
Posts: 1718
Joined: Sun Aug 27, 2006 9:24 pm
Location: Taiyuan, Shanxi, PR China

Post by yumeyao » Sat Nov 29, 2008 5:18 am

Thank you for the info above. :D
it's ok in chinese.
so this fix can be applied without worrying anything.
Image
My work list(Hosted by dumpydooby)

User avatar
yumeyao
Moderator
Posts: 1718
Joined: Sun Aug 27, 2006 9:24 pm
Location: Taiyuan, Shanxi, PR China

Post by yumeyao » Sat Nov 29, 2008 5:29 am

BTW, what screen-capturing progy do u use, 5eraph?
i like the funtion that only capturing windows, leaving out side blank(100% transparent).
Image
My work list(Hosted by dumpydooby)

User avatar
5eraph
Site Admin
Posts: 4618
Joined: Tue Jul 05, 2005 9:38 pm
Location: Riverview, MI USA

Post by 5eraph » Sat Nov 29, 2008 5:47 am

I use one of these two methods:
  1. I use Ctrl+Alt+PrintScreen to copy the currently selected window to the clipboard. Then I paste into MSPaint.exe and save as PNG.

    For compositing I use Paint.NET. First I open the smaller image in Paint.NET, select all (Ctrl+A), then copy (Ctrl+C). Next, open the larger image, increase the size of the canvas to properly fit the final image, paste (Ctrl+V), then drag the smaller object where I want it. Finally, I select the empty space with the Rectangle Select tool and delete it (Del) to expose the transparency beneath. Save final image as PNG to preserve transparency.
  2. Or, you could copy the entire screen (PrintScreen), paste into Paint.NET, cut away everything that you don't want, select the area of the canvas you want to keep, crop to selection, and save as PNG to preserve transparency.
For the images above, I used the first method.
Last edited by 5eraph on Sat Nov 29, 2008 5:56 am, edited 1 time in total.

User avatar
yumeyao
Moderator
Posts: 1718
Joined: Sun Aug 27, 2006 9:24 pm
Location: Taiyuan, Shanxi, PR China

Post by yumeyao » Sat Nov 29, 2008 5:53 am

i see.
i thought there was any progi could do this easy.

BTW, Alt+PrintScreen is enough for coping current window, ctrl is unneccesary.
Image
My work list(Hosted by dumpydooby)

User avatar
5eraph
Site Admin
Posts: 4618
Joined: Tue Jul 05, 2005 9:38 pm
Location: Riverview, MI USA

Post by 5eraph » Sat Nov 29, 2008 8:19 am

You're welcome. And thanks. :)

newsposter
Posts: 1131
Joined: Wed Sep 14, 2005 11:31 am

Post by newsposter » Sat Nov 29, 2008 4:23 pm

MWSnap, an older utility, does very good work with screen captures. It's available as an addon.

Botus
Posts: 161
Joined: Sat Dec 22, 2007 12:47 pm
Location: UK

Post by Botus » Mon Dec 01, 2008 5:15 am

yumeyao, I use this

http://www.faststone.org/FSCaptureDetail.htm

now limited to 30 day trial but if you get hold of v5.3 it was still free for home use

User avatar
RyanVM
Site Admin
Posts: 5186
Joined: Tue Nov 23, 2004 6:03 pm
Location: Pennsylvania
Contact:

Post by RyanVM » Thu Dec 18, 2008 8:15 pm

I've included this fix in the new packs
Get up to $200 off on hosting from the same people who host this website!
http://www.ryanvm.net/forum/viewtopic.php?t=2357

TechnoHunter
Posts: 506
Joined: Sun Feb 26, 2006 4:13 am

Post by TechnoHunter » Thu Dec 18, 2008 8:22 pm

good to know, thanks ryan!

TechnoHunter

User avatar
xenon2050
Posts: 11
Joined: Fri Mar 28, 2008 5:16 pm
Location: The Midwest

Post by xenon2050 » Fri Jan 23, 2009 5:24 pm

Are you sure its fixed? Because using the most recent SP2 pack I still get the problem and I have to manually make the fix...

User avatar
RyanVM
Site Admin
Posts: 5186
Joined: Tue Nov 23, 2004 6:03 pm
Location: Pennsylvania
Contact:

Post by RyanVM » Fri Jan 23, 2009 5:55 pm

Yes, the registry fix is included in the current Post-SP2 Update Pack. You can confirm that for yourself by opening RVMUpPck.inf and looking at the bottom of the [KB942288.AddReg] section. The registry fix is there. Furthermore, when I check that key on a running install with the Update Pack included, the registry entry is set correctly.

If you're still having problems, there's another issue somewhere.
Get up to $200 off on hosting from the same people who host this website!
http://www.ryanvm.net/forum/viewtopic.php?t=2357

User avatar
redxii
Posts: 395
Joined: Sun Dec 17, 2006 5:50 pm

Post by redxii » Sat Jan 24, 2009 1:43 am

Is EventMessageFile set to msi.dll? msimsg.dll is the one that doesn't work properly.

User avatar
RyanVM
Site Admin
Posts: 5186
Joined: Tue Nov 23, 2004 6:03 pm
Location: Pennsylvania
Contact:

Post by RyanVM » Sun Jan 25, 2009 2:39 pm

OK, you've won this round, redxii ;) :P

It's fixed locally. It'll be in the next pack. Sorry for the screw-up.
Get up to $200 off on hosting from the same people who host this website!
http://www.ryanvm.net/forum/viewtopic.php?t=2357

User avatar
xenon2050
Posts: 11
Joined: Fri Mar 28, 2008 5:16 pm
Location: The Midwest

Post by xenon2050 » Mon Jan 26, 2009 8:57 am

Okay cool. I'm not going crazy then. :)

Post Reply