Problem installing Dingtalk

[LiaoXingyu 0]

When installing the DingTalk installation program (an instant messaging software), it was found that it was stuck in CreateFileW. The kernel stack (by procexp) and application layer stack (by windbg) are shown in the following figure;

And I also captured stack calls after timeout (I suspended the application layer)

The reason for the blockage caused by requesting assistance

 

--- chinese 

安装钉钉安装程序（一款即时通讯软件）时发现卡在CreateFileW , 内核栈(通过procexp获取)与应用层栈（通过windbg获取）如下图所示；

并且我也捕获了超时之后的栈调用（我挂起了应用层）

请求援助导致卡住的原因

 

 

And I Wrote there code to test

bu it can not reappear.

 

#include <iostream>
#include <Windows.h>

int main()
{
    LPCWSTR               lpFileName = L"C:\\Program Files (x86)\\DingDing\\DingtalkLauncher.exe";
    DWORD                 dwDesiredAccess = 0x80000000;
    DWORD                 dwShareMode = 0x5;
    LPSECURITY_ATTRIBUTES lpSecurityAttributes = 0x0;
    DWORD                 dwCreationDisposition = 0x3;
    DWORD                 dwFlagsAndAttributes = 0x80;
    HANDLE                hTemplateFile = NULL;

    HANDLE  handle = ::CreateFileW(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);

    if (handle != NULL)
    {
        ::CloseHandle(handle);
    }

    std::cout << "测试完毕 ，正常" << std::endl;

    system("pause");

    return 0;
}

 

[Marcos 5,298]

Does pausing real-time protection or any other ESET protection feature actually make a difference?

[LiaoXingyu 0]

Just now, Marcos said:

暂停实时保护或任何其他 ESET 保护功能实际上会产生影响吗？

Yes 。 

--Install this program normally after pausing the depth check

Not only does this program have problems, but other installation programs also have problems

 

 

--暂停深度检查 之后 正常安装 此程序

 

不仅仅是这个程序会出现问题，还有其他的安装程序会出现问题

[LiaoXingyu 0]

here is few minutes later.

Edited September 18, 2023 by LiaoXingyu

[Marcos 5,298]

What do you mean by "depth check"? Please do not post screenshots from Process Explorer unless we ask you to, they are unnecessary and not useful at this point.

[LiaoXingyu 0]

OK

3 minutes ago, Marcos said:

“深度检查”是什么意思？除非我们要求，否则请不要发布Process Explorer的屏幕截图，此时它们是不必要的且没有用处。

 

 

[Marcos 5,298]

I didn't have a problem installing the app in question (DingTalkLite_v5.1.21.516) with Deep Behavior Inspection and other protection features enabled. Please raise a support ticket for help with further troubleshooting of the issue.

[LiaoXingyu 0]

How to  raise a support ticket for help with further troubleshooting of the issue?

3 minutes ago, Marcos said:

I didn't have a problem installing the app in question (DingTalkLite_v5.1.21.516) with Deep Behavior Inspection and other protection features enabled. Please raise a support ticket for help with further troubleshooting of the issue.

 

[Marcos 5,298]

Then go through the support wizard until you get the option to raise a support ticket.