Patch Scan Error Code 101: Unable To Determine OS Language

Version 3

    Symptoms


    When running a patch scan with Protect, the target machine fails to scan, and you recieve the error:

     

    Error 101: Unable to determine OS Language

     

    Within the hf.log you see logging similar to this:

     

    2013-11-19T21:20:38.3196511Z 1c2c E FastFile.cpp:98 GFF - Init failed
    2013-11-19T21:20:38.3196511Z 1c2c V FileInfo.cpp:330 GetVersionData failed for \\192.168.x.x\C$\WINDOWS\system32\NTDLL.DLL
    Invalid dos header
    5001
    2013-11-19T21:20:38.3196511Z 1c2c V FileInfo.cpp:218 Using FB
    2013-11-19T21:21:16.1962083Z 1c2c V Machine.cpp:942 Unable to determine language
    2013-11-19T21:21:16.1962083Z 1c2c V MachineSelector.cpp:668 Prereq - FAIL - Unable to determine System Language

    2013-11-19T21:21:16.1962083Z 1c2c V Registry.cpp:224 ERROR: CloseOpenKey() - RegCloseKey returned error 1727 for key Handle 0x00000000004CC7E1.
    2013-11-19T21:21:16.1962083Z 1c2c I MachineSelector.cpp:712 CHFScanThreadClass - DID NOT pass Prereqs

    2013-11-19T21:21:16.1962083Z 1c2c V DBOutput.cpp:53 Start output of one machine (DB)
    2013-11-19T21:21:16.1962083Z 1c2c I DBOutput.cpp:71 Reason [101]

     

     

    Cause


    Protect's scan process uses the target system's NTDLL.DLL file to determine the operating system's language setting. If this file is inaccessible or corrupt, the prerequisite validation fails and the scan is aborted.

     

    Resolution


    1) Verify that you are using an Administrator account to run the scan, and that the account has at least read rights to the ntdll.dll file on the target system.

     

    The path to the file is C:\Windows\System32\ntdll.dll

     

    ntdll.JPG

     

    2) Analysis of an affected DC revealed that the Network account was given explicit denial and the Administrator’s permission was drastically reduced. The cause of the permission change is undetermined, but the DC was involved in a system state restore as part of a disaster recovery process, it could have changed prior to, or during this event. Restore the permission to the original state as inherited from the C:\Windows\System32\ folder.

     

    f7f40800.jpg

    f7f40800-2.jpg

     

    3) Open a command prompt on the target system, and try re-registering the dll using the following commands:

     

    cd C:\Windows\System32

    regsvr32 ntdll.dll

     

    4) The operating system may be corrupted. You can try the following additional steps to possibly resolve this issue:

     

    -Reboot the target system, and see if the issue still persists.

    -Run the Microsoft System File Checker tool (sfc.exe). This Microsoft article is helpful: http://support.microsoft.com/kb/929833/en-us#manually

    -If you have a restore point, you could attempt a system restore. More information about using system restore can be found in the Microsoft article, here: http://windows.microsoft.com/en-US/windows7/products/features/system-restore

     

    Affected Product(s)

     

    Shavlik Protect 9.x