[wix-users] System registry key started showing up in our MSI

Tue Dec 7 09:39:01 PST 2021

Heat is capturing that registry addition while harvesting the
self-registration for Microsoft.Practices.EnterpriseLibrary.Common.dll.

I don't know enough about heat to know if that guarantees the registry
stuff was added by Microsoft.Practices.EnterpriseLibrary.Common.dll or if
it just happened at the same time heat was harvesting.

--
Edwin G. Castro

On Fri, Dec 3, 2021 at 12:48 PM Dennis Costello <
dennis.costello at prudential.com> wrote:

> I don't see any .reg files being harvested in the logs nor do I see any
> .reg file anywhere in the log file.
>
> I started to look up the component and file connection and I hope I
> explain this right.  The component table entry for these keys have a link
> back to the file table to a specific dll.  That dll is
> Microsoft.Practices.EnterpriseLibrary.Common.dll.  In the build log that
> dll is in a folder that gets harvested via:
>
> <HarvestDirectory Include="$(sourcedir)\Desktop">
>         <DirectoryRefId>INSTALLFOLDER</DirectoryRefId>
>         <ComponentGroupName>DesktopFiles</ComponentGroupName>
>         <SuppressRootDirectory>true</SuppressRootDirectory>
> </HarvestDirectory>
>
> The output from the log shows this for that dll:
> Trying to harvest
> d:\testdotnet_workspace\illustrations_Build_PLISetups\PLIBuild\Desktop\Microsoft.Practices.EnterpriseLibrary.Common.dll
> as an assembly.
> Trying to harvest self-registration information from native DLL
> d:\testdotnet_workspace\illustrations_Build_PLISetups\PLIBuild\Desktop\Microsoft.Practices.EnterpriseLibrary.Common.dll.
>
> We have that dll logged into our version control and just put it into the
> folder before harvesting it, so I know the version hasn't changed.
>
>
> -----Original Message-----
> From: Mike Henseler <m.henseler at simfront.com>
> Sent: Friday, December 3, 2021 3:23 PM
> To: WiX Toolset Users Mailing List <wix-users at lists.wixtoolset.org>;
> Dennis Costello <dennis.costello at prudential.com>; Edwin Castro <
> egcastr at gmail.com>
> Subject: RE: [wix-users] System registry key started showing up in our MSI
>
> I wasn't clear previously,  when I referred to harvesting a .reg file, I
> meant is there a .reg file in your harvesting folder.
> That was somehow being harvested as a registry harvest instead of just as
> a flat file.
>
> my test proved that doesn't happen and you now indicated there is no .reg
> file in your harvest folder.
>
> -----Original Message-----
> From: wix-users <wix-users-bounces at lists.wixtoolset.org> On Behalf Of
> Mike Henseler via wix-users
> Sent: December 3, 2021 3:02 PM
> To: Dennis Costello <dennis.costello at prudential.com>; Edwin Castro <
> egcastr at gmail.com>; WiX Toolset Users Mailing List <
> wix-users at lists.wixtoolset.org>
> Cc: Mike Henseler <m.henseler at simfront.com>
> Subject: Re: [wix-users] System registry key started showing up in our MSI
>
> I would have just cracked open the msi with orca and searched the file
> table for .reg file.
> I tested heat with a .reg file and it did not add anything to reg table.
>
> You must have a component already configured to install/uninstall this key.
> Examine all your .wxs files
> It seams very odd that this regkey/component would just appear in your msi.
>
> Follow the registry table with that component back to your .wxs files.
>
> From: Dennis Costello <dennis.costello at prudential.com>
> Sent: December 3, 2021 2:46 PM
> To: Mike Henseler <m.henseler at simfront.com>; Edwin Castro <
> egcastr at gmail.com>; WiX Toolset Users Mailing List <
> wix-users at lists.wixtoolset.org>
> Subject: RE: [wix-users] System registry key started showing up in our MSI
>
> Yes, Heat is harvesting the folders.  I just checked the build log from a
> build with the registry key in the MSI and I don't have any .reg file
> references in it.
>
> Is there a verbose logging option for builds?
>
> From: Mike Henseler <m.henseler at simfront.com<mailto:
> m.henseler at simfront.com>>
> Sent: Friday, December 3, 2021 2:32 PM
> To: Dennis Costello <dennis.costello at prudential.com<mailto:
> dennis.costello at prudential.com>>; Edwin Castro <egcastr at gmail.com<mailto:
> egcastr at gmail.com>>; WiX Toolset Users Mailing List <
> wix-users at lists.wixtoolset.org<mailto:wix-users at lists.wixtoolset.org>>
> Subject: RE: [wix-users] System registry key started showing up in our MSI
>
> Are you using heat to harvest?
> What would happen if a .reg file was harvested, could/would it be added to
> the registry table and not just treated as a flat file?
>
> This is question for Wix developer
>
>
>
> From: Dennis Costello <dennis.costello at prudential.com<mailto:
> dennis.costello at prudential.com>>
> Sent: December 3, 2021 2:23 PM
> To: Edwin Castro <egcastr at gmail.com<mailto:egcastr at gmail.com>>; WiX
> Toolset Users Mailing List <wix-users at lists.wixtoolset.org<mailto:
> wix-users at lists.wixtoolset.org>>
> Cc: Mike Henseler <m.henseler at simfront.com<mailto:m.henseler at simfront.com
> >>
> Subject: RE: [wix-users] System registry key started showing up in our MSI
>
> Its showing up in our uninstall logs and I see the registry key in the
> registry table in the MSI so it certainly seems like its our install.  I
> just don't know how it's getting into the MSI.
>
> MSI (s) (34:34) [13:58:07:251]: Executing op:
> RegOpenKey(Root=-2147483646,Key=System\CurrentControlSet\Services\WinSock2\Parameters,,BinaryType=0,,)
> MSI (s) (34:34) [13:58:07:251]: Executing op:
> RegRemoveValue(Name=WinSock_Registry_Version,Value=2.0,)
>
> From: Edwin Castro <egcastr at gmail.com<mailto:egcastr at gmail.com>>
> Sent: Friday, December 3, 2021 2:17 PM
> To: WiX Toolset Users Mailing List <wix-users at lists.wixtoolset.org<mailto:
> wix-users at lists.wixtoolset.org>>
> Cc: Dennis Costello <dennis.costello at prudential.com<mailto:
> dennis.costello at prudential.com>>; Mike Henseler <m.henseler at simfront.com
> <mailto:m.henseler at simfront.com>>
> Subject: Re: [wix-users] System registry key started showing up in our MSI
>
> Use ProcMon to determine which process is deleting the key and work back
> up to the process chain to see if this is even happening as a result of
> msiexec at all.
>
> --
> Edwin G. Castro
>
>
> On Fri, Dec 3, 2021 at 10:52 AM Mike Henseler via wix-users <
> wix-users at lists.wixtoolset.org<mailto:wix-users at lists.wixtoolset.org>>
> wrote:
> Try running these cmds manually and see if any are deleting the key.
> But of course this wont explain why it is intermittent.
>
>
>
> -----Original Message-----
> From: Dennis Costello <dennis.costello at prudential.com<mailto:
> dennis.costello at prudential.com>>
> Sent: December 3, 2021 1:47 PM
> To: WiX Toolset Users Mailing List <wix-users at lists.wixtoolset.org<mailto:
> wix-users at lists.wixtoolset.org>>
> Cc: Mike Henseler <m.henseler at simfront.com<mailto:m.henseler at simfront.com
> >>
> Subject: RE: System registry key started showing up in our MSI
>
> Ok, we do have custom actions to run cmd and add 3 ports on install and
> uninstall the 3 ports.
>
>     <CustomAction Id="AddPort1" Directory="INSTALLFOLDER" Execute="commit"
> Impersonate="no" ExeCommand="cmd.exe /c "netsh http add urlacl
> url=http://+:40266/ user=Everyone"" Return="ignore" />
>     <CustomAction Id="AddPort2" Directory="INSTALLFOLDER" Execute="commit"
> Impersonate="no" ExeCommand="cmd.exe /c "netsh http add urlacl
> url=http://+:50266/ user=Everyone"" Return="ignore" />
>     <CustomAction Id="AddPort3" Directory="INSTALLFOLDER" Execute="commit"
> Impersonate="no" ExeCommand="cmd.exe /c "netsh http add urlacl
> url=http://+:60266/ user=Everyone"" Return="ignore" />
>     <CustomAction Id="DeletePort1" Directory="INSTALLFOLDER"
> Execute="commit" Impersonate="no" ExeCommand="cmd.exe /c "netsh http
> delete urlacl url=http://+:40266/"" Return="ignore" />
>     <CustomAction Id="DeletePort2" Directory="INSTALLFOLDER"
> Execute="commit" Impersonate="no" ExeCommand="cmd.exe /c "netsh http
> delete urlacl url=http://+:50266/"" Return="ignore" />
>     <CustomAction Id="DeletePort3" Directory="INSTALLFOLDER"
> Execute="commit" Impersonate="no" ExeCommand="cmd.exe /c "netsh http
> delete urlacl url=http://+:60266/"" Return="ignore" />
>
> And then the InstallExecuteSequence:
>         <Custom Action="DeletePort1" After="BackupDatabases">REMOVE =
> "ALL"</Custom>
>         <Custom Action="DeletePort2" After="DeletePort1">REMOVE =
> "ALL"</Custom>
>         <Custom Action="DeletePort3" After="DeletePort2">REMOVE =
> "ALL"</Custom>
>
> This has been part of the code for years and again, that key doesn't show
> up in every build.  Any idea why it would affect the registry?
>
> -----Original Message-----
> From: wix-users <wix-users-bounces at lists.wixtoolset.org<mailto:
> wix-users-bounces at lists.wixtoolset.org>> On Behalf Of Mike Henseler via
> wix-users
> Sent: Friday, December 3, 2021 1:40 PM
> To: WiX Toolset Users Mailing List <wix-users at lists.wixtoolset.org<mailto:
> wix-users at lists.wixtoolset.org>>
> Cc: Mike Henseler <m.henseler at simfront.com<mailto:m.henseler at simfront.com
> >>
> Subject: Re: [wix-users] System registry key started showing up in our MSI
>
> Also watch for any activity like this cmd " netsh winsock reset" or any
> other action that may affect that registry without explicitly referring to
> it
>
> -----Original Message-----
> From: wix-users <wix-users-bounces at lists.wixtoolset.org<mailto:
> wix-users-bounces at lists.wixtoolset.org>> On Behalf Of Rob Mensching via
> wix-users
> Sent: December 3, 2021 1:33 PM
> To: WiX Toolset Users Mailing List <wix-users at lists.wixtoolset.org<mailto:
> wix-users at lists.wixtoolset.org>>
> Cc: Rob Mensching <rob at firegiant.com<mailto:rob at firegiant.com>>
> Subject: Re: [wix-users] System registry key started showing up in our MSI
>
> A verbose log file will show you what the MSI did and hopefully any Custom
> Actions in the MSI log their work as well.
>
> -----Original Message-----
> From: wix-users <wix-users-bounces at lists.wixtoolset.org<mailto:
> wix-users-bounces at lists.wixtoolset.org>> On Behalf Of Hoover, Jacob via
> wix-users
> Sent: Friday, December 3, 2021 10:31 AM
> To: WiX Toolset Users Mailing List <wix-users at lists.wixtoolset.org<mailto:
> wix-users at lists.wixtoolset.org>>
> Cc: Hoover, Jacob <Jacob.Hoover at greenheck.com<mailto:
> Jacob.Hoover at greenheck.com>>
> Subject: Re: [wix-users] System registry key started showing up in our MSI
>
> Any custom actions?  Have you inspected a known bad MSI with orca?
>
> Windows Installer isn't going to nuke a key if it isn't referenced in the
> authoring, which is why I suspect a CA or you are invoking an exe/script on
> uninstall that may be causing this behavior.
>
>
> From: wix-users <wix-users-bounces at lists.wixtoolset.org<mailto:
> wix-users-bounces at lists.wixtoolset.org>> On Behalf Of Dennis Costello via
> wix-users
> Sent: Friday, December 3, 2021 12:23 PM
> To: wix-users at lists.wixtoolset.org<mailto:wix-users at lists.wixtoolset.org>
> Cc: Dennis Costello <dennis.costello at prudential.com<mailto:
> dennis.costello at prudential.com>>
> Subject: [wix-users] System registry key started showing up in our MSI
>
> We have been using a wix project to build our deployment for several years
> now and very recently we started experiencing a problem with machines not
> being able to boot after our system was uninstalled. After several days of
> investigating it was found that our uninstall was removing the
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\WinSock_Registry_Version
> registry key, thus disabling Windows completely. We do not have any
> references to this key, nor have we had this problem prior to about 2 weeks
> ago. We haven't made any code changes to our wix project since early August
> and that was a very minor change. We build and test our system daily so we
> know that this just started happening very recently, but here's the kicker
> for us, it doesn't happen every build! The same compile machine is used for
> every build, but using Orca I do not see the Registry entry in every msi!
>
> We are at a complete loss as to where to even begin to figure out what is
> going on. I could say some how the registry key is being picked up from the
> compile machine, but it doesn't happen every build. Any help would be
> greatly appreciated.
>
> Thank you!
>
> ____________________________________________________________________
> WiX Toolset Users Mailing List provided by FireGiant
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961332609%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y72OxCQ%2Bgq3MhNHZ56gdYxgnG1xVqnHDU8wSApVsN6I%3D&reserved=0
> <
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961332609%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y72OxCQ%2Bgq3MhNHZ56gdYxgnG1xVqnHDU8wSApVsN6I%3D&reserved=0
> ><
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961332609%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y72OxCQ%2Bgq3MhNHZ56gdYxgnG1xVqnHDU8wSApVsN6I%3D&reserved=0
>
>  1bbcb91b110c43c4e24f08d9b68c485b%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741535889682135%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=vxZrDRvXejKRnqAtBNZKCNSISFffnBUCjjitJpCPxXU%3D&reserved=0<
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961332609%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y72OxCQ%2Bgq3MhNHZ56gdYxgnG1xVqnHDU8wSApVsN6I%3D&reserved=0
> >>
> NOTE: This email was received from an external source. Please use caution
> when opening links or attachments in the message.
>
> ____________________________________________________________________
> WiX Toolset Users Mailing List provided by FireGiant
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961332609%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y72OxCQ%2Bgq3MhNHZ56gdYxgnG1xVqnHDU8wSApVsN6I%3D&reserved=0
> <
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961332609%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y72OxCQ%2Bgq3MhNHZ56gdYxgnG1xVqnHDU8wSApVsN6I%3D&reserved=0
> >
>
> ____________________________________________________________________
> WiX Toolset Users Mailing List provided by FireGiant
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961332609%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y72OxCQ%2Bgq3MhNHZ56gdYxgnG1xVqnHDU8wSApVsN6I%3D&reserved=0
> <
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961332609%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y72OxCQ%2Bgq3MhNHZ56gdYxgnG1xVqnHDU8wSApVsN6I%3D&reserved=0
> >
>
>
> ***** This email was sent outside of your organization *****
>
> ____________________________________________________________________
> WiX Toolset Users Mailing List provided by FireGiant
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961332609%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y72OxCQ%2Bgq3MhNHZ56gdYxgnG1xVqnHDU8wSApVsN6I%3D&reserved=0
> <
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961332609%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y72OxCQ%2Bgq3MhNHZ56gdYxgnG1xVqnHDU8wSApVsN6I%3D&reserved=0
> >
>
>
> ***** This email was sent outside of your organization *****
>
> ____________________________________________________________________
> WiX Toolset Users Mailing List provided by FireGiant
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961332609%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Y72OxCQ%2Bgq3MhNHZ56gdYxgnG1xVqnHDU8wSApVsN6I%3D&reserved=0
> <
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961342612%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=6ncX3R1C2gJxIPysmJH4q07P%2BLmiloOY7WDi6PCDfis%3D&reserved=0
> >
>
> ***** This email was sent outside of your organization *****
>
> ***** This email was sent outside of your organization *****
>
> ____________________________________________________________________
> WiX Toolset Users Mailing List provided by FireGiant
> https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.firegiant.com%2F&data=04%7C01%7Cdennis.costello%40prudential.com%7C5180d157c48b4f31423d08d9b69abbd4%7Cd8fde2f5939242608a030ad01f4746e9%7C0%7C0%7C637741597961342612%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=6ncX3R1C2gJxIPysmJH4q07P%2BLmiloOY7WDi6PCDfis%3D&reserved=0
>
>
> ***** This email was sent outside of your organization *****
>