Mark Russinovich’s technical blog covering topics such as Windows troubleshooting, technologies and security.
I love the cases people send me where the Sysinternals tools have helped them successfully troubleshoot, but nothing is more satisfying than using them to solve my own cases. This case in particular was fun because, well, solving it helped me get back to having fun.
When I have time, I occasionally play PC games to let off steam (pun intended, as you’ll see). One of my favorites over the last few years was the puzzle game, Portal. I enjoyed the first Portal so much that I pre-ordered Portal 2 on Valve’s Steam network when it became available and played through it within a few hours of its release. Since then, I’ve been playing community-developed maps. Last Saturday I started a particularly fun map, a winner from a community map contest, but didn’t have time to finish it in one sitting. The next morning I returned to my PC, double-clicked on the Portal 2 desktop icon, and got the standard Steam launch dialog. The game normally launches in a couple of seconds, but this time the dialog just sat there:
I killed Steam and double-clicked again, but again the dialog hung. I captured a Process Monitor trace and looked at the stacks of Steam’s threads in Process Explorer, but didn’t see any clues. Figuring that perhaps Portal 2’s configuration or installation had somehow been corrupted, I deleted Portal 2, re-downloaded it, and reinstalled it. That didn’t fix the problem, though. With Portal 2 reset to a clean state, that left either Steam or some general Windows issue to blame. The next step was therefore to reinstall Steam.
I first went to the Uninstall or Change a Program page in the Control Panel, but double-clicking on the Steam entry brought up a dialog asking me to confirm uninstalling it and warning that doing so would delete all local content. I didn’t want to risk losing my game settings or have to reinstall all my games, so I aborted the uninstall. Most Microsoft Installer Service (MSI)-based installers have a repair option that reinstalls the application without deleting user data or configuration, so I went to the Steam home page, downloaded and executed the Steam installer. Sure enough, the install wizard offered the repair option:
When I pressed the Next button, though, I was greeted with an obviously misleading error message that reported a network error while trying to read from a local file:
I turned to Process Monitor again and captured a trace of the failed repair operation. The error message referred to a file named SteamInstall.msi, so I searched the log file for that string. The first hit was the data value read in a query of a registry value under HKCR\Installer\Products named PackageName:
The next hits, a few operations later, were attempts by the installer to read from the file location printed in the error dialog:
That the installer was reading the file name from an existing registry key and the file’s location was in Internet Explorer’s (IE’s) download cache suggested that it was trying to launch the copy of itself that had performed the initial install. Because I had originally launched the installer via IE directly from the Valve web site, just like I was doing now, the download location was in IE’s download cache, but the file must have aged out and been deleted since then.
The Process Monitor trace revealed that the installer was reading the original location from the registry, so if I pointed the registry at the installer’s new download location, I could trick it into launching itself, rather than looking for the previous copy that was now missing. I scanned the log for the new download location by searching for Steaminstall.msi and found its path, another download cache location:
I then went back to the registry query’s entry, right-clicked on it, and selected “Jump To” from the context menu. That caused Process Monitor to launch Regedit and navigate directly to the registry key, where I updated the LastUsedSource and PackageName values to reflect the new download location:
Next, I dismissed the installer’s error dialog, which I had left open, and pressed the wizard’s Next button to try the repair again. This time, Steam proceeded to reinstall and the wizard concluded with a message of success:
Crossing my fingers, I launched Portal 2. Steams’s ‘Preparing to Launch’ dialog flashed for a second and then Portal 2’s splash screen took over the screen: case closed. Uninstalling and then reinstalling Steam and all the games would have likely lead to the same conclusion, but Process Monitor had surely saved me a lot of time and possibly even my saved game state and configurations. In just a few minutes I was back to solving puzzles of a different kind.
Check out the new Windows Sysinternals Administrator’s Reference by me and Aaron Margosis for more tips on using all 70+ Sysinternals tools to troubleshoot and manage your Windows systems! Buy a copy by August 15, email the receipt to me at firstname.lastname@example.org and I’ll enter you for a drawing of one of 10 signed copies of Zero Day I’m giving away.
Mark Russinovich is a Technical Fellow on the Windows Azure team at Microsoft and is author of Windows Internals, The Windows Sysinternals Administrator’s Reference, and the cyberthriller Zero Day: A Novel. You can contact him at email@example.com.
<p>One of the most pathetic post that we expected from you Mark.</p>
<p>This does illustrate a flaw in Steam in not storing a copy of its installer. This is a common occurence. Many of the cool self-repair features of Windows Installer rely on access to the MSI. This is why Office now installs a local cache of the MSI files, for example. One thing you can actually do is to install pointing to the MSI over HTTP instead of from the cache. That can be useful sometimes too.</p>
<p>Hmm... Some insight into Windows Installer-related issues... I must be careful not to commit this mistake myself in the future. Unfortunately, I am quite liable, because of a habit of mine: I maintain a local archive of all software that I download and install. (Of course, I no longer have Steam; I was not satisfied with it.)</p>
<p>Oh, and one thing about xcellentmind's comment: That was also my first impression; but soon I realized that the only thing that gave me this impression was the less-that-optimum choice of title. The title should have been "The Case of Misleading Installer Error", because that is indeed the area in which Process Monitor has shown its significance. Otherwise, as far as the hung game launcher is concerned, Mark, you just re-installed Steam and it is nothing brilliant.</p>
<p>How about going to a school and doing a case of the slow Windows 7 login?</p>
<p>Thanks for sharing Mark.. even though this one wasn't as complicated a mystery to solve compared to some of the other ones you've blogged about, I always enjoy how you tell the story</p>
<p>Nice one there Mark! You must try to play their "Mafia wars" if you still haven't done so :)</p>
<p> I agree, it was a nice investigative job, you did .. I also agree, your sysint-tools are all AAA-class software, ... but I would simply wipe the buggy installer reg entry manually (or maybe using msicuu/msizap). - Then make a backup of my game files and the registry to preserve all game settings. - Then simply reinstall steam, and merged the registry back ... But who knows?</p>
<p>...a nice article. .. and we could simply call it: - "STEAMY WINDOWS"</p>
<p>I fixed 'regular user prompted to install a device driver' with procmon: <a rel="nofollow" target="_new" href="http://social.technet.microsoft.com/Forums/en-US/w7itproinstall/thread/3c90cad7-3729-49b6-8d16-a89fc7830702">social.technet.microsoft.com/.../3c90cad7-3729-49b6-8d16-a89fc7830702</a></p>