Symptoms

When running a patch scan with Protect, the target machine fails to scan, and you recieve the error:

Error 101: Unable to determine OS Language

Within the hf.log you see logging similar to this:

2013-11-19T21:20:38.3196511Z 1c2c E FastFile.cpp:98 GFF - Init failed
2013-11-19T21:20:38.3196511Z 1c2c V FileInfo.cpp:330 GetVersionData failed for \\192.168.x.x\C$\WINDOWS\system32\NTDLL.DLL
Invalid dos header
5001
2013-11-19T21:20:38.3196511Z 1c2c V FileInfo.cpp:218 Using FB
2013-11-19T21:21:16.1962083Z 1c2c V Machine.cpp:942 Unable to determine language
2013-11-19T21:21:16.1962083Z 1c2c V MachineSelector.cpp:668 Prereq - FAIL - Unable to determine System Language

2013-11-19T21:21:16.1962083Z 1c2c V Registry.cpp:224 ERROR: CloseOpenKey() - RegCloseKey returned error 1727 for key Handle 0x00000000004CC7E1.
2013-11-19T21:21:16.1962083Z 1c2c I MachineSelector.cpp:712 CHFScanThreadClass - DID NOT pass Prereqs

2013-11-19T21:21:16.1962083Z 1c2c V DBOutput.cpp:53 Start output of one machine (DB)
2013-11-19T21:21:16.1962083Z 1c2c I DBOutput.cpp:71 Reason [101]

Cause

Protect's scan process uses the target system's NTDLL.DLL file to determine the operating system's language setting. If this file is inaccessible or corrupt, the prerequisite validation fails and the scan is aborted.

Resolution

1) Verify that you are using an Administrator account to run the scan, and that the account has at least read rights to the ntdll.dll file on the target system.

The path to the file is C:\Windows\System32\ntdll.dll

2) Analysis of an affected DC revealed that the Network account was given explicit denial and the Administrator’s permission was drastically reduced. The cause of the permission change is undetermined, but the DC was involved in a system state restore as part of a disaster recovery process, it could have changed prior to, or during this event. Restore the permission to the original state as inherited from the C:\Windows\System32\ folder.

3) Open a command prompt on the target system, and try re-registering the dll using the following commands:

cd C:\Windows\System32

regsvr32 ntdll.dll

4) The operating system may be corrupted. You can try the following additional steps to possibly resolve this issue:

-Reboot the target system, and see if the issue still persists.

-Run the Microsoft System File Checker tool (sfc.exe). This Microsoft article is helpful: http://support.microsoft.com/kb/929833/en-us#manually

-If you have a restore point, you could attempt a system restore. More information about using system restore can be found in the Microsoft article, here: http://windows.microsoft.com/en-US/windows7/products/features/system-restore

Affected Product(s)

Shavlik Protect 9.x