Windows 10 20H2 fix available?

[slizzap]

I found that HyperSpin won't launch on 2 of my PCs that are running Windows 10 20H2. It still runs fine on a 3rd PC that's on Windows 10 1903. After doing some research it looks like this is a known problem with a posted "fix", which does not appear to be confirmed as a fix by everyone. I tried downloading this 2004 fix (sxs.dll), did the file properties -> unblock and even a reboot, but HyperSpin still won't launch. It reports an error message in the Application log after the 1st launch attempt, but after subsequent launches and even reboots it stops creating entries in the Application log. HyperSpin also does not create a log file.

Is anyone aware of a true fix for this issue? I only see one other thread related to this, but unfortunately there was no new information given there and it simply devolved into an unhelpful conversation and subsequently locked. I'm curious if anyone is actively looking into this, if there's a fix in the works, or another workaround worth trying. The 2004 fix that some say works is the "sxs.dll" file, but my Application log entries are saying the faulting module is "ntdll.dll". Details of 2 Application log entries included below.

Thanks.

Fault bucket 1498558675681970465, type 1
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: HyperSpin.exe
P2: 1.5.1.0
P3: 5aec9b23
P4: ntdll.dll
P5: 10.0.19041.662
P6: 5f641e44
P7: c0000005
P8: 00086a94
P9: 
P10: 

Faulting application name: HyperSpin.exe, version: 1.5.1.0, time stamp: 0x5aec9b23
Faulting module name: ntdll.dll, version: 10.0.19041.662, time stamp: 0x5f641e44
Exception code: 0xc0000005
Fault offset: 0x00086a94
Faulting process id: 0x26c8
Faulting application start time: 0x01d6f8d3a08a2c2a
Faulting application path: D:\HyperSpin\HyperSpin.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: d3c23a08-8bf5-439f-a866-b6bb6962a305
Faulting package full name: 
Faulting package-relative application ID: 

 

[dark13]

Try to put this .dll in HS folder. It should be the normal version (32bit). Using dll from internet usually is not a good idea, if you want to be 100% safe install a pre 20H2 on a virtual machine and retrieve the dll from that installation. Anyway they come from my w10 pro 1909, there should not be any problems with them.

... and for god's sake use Windows10 LTSC on HTPCs and MAMEcabs, LTSC don't upgrade version and comes with 10 years of security update.

https://www.dropbox.com/s/r33eiavqukxr8aw/ntdllfix.zip?dl=0

[slizzap]

No luck, unfortunately. I copied over the ntdll.dll from my working Windows 10 1903 PC and the behavior was the same...it still wouldn't launch. I then tried the 32-bit DLL you provided and also wouldn't launch, also after a reboot. Watching Task Manager you'll see the HyperSpin.exe process pop-up then a few seconds just disappear.

Good suggestion on using LTSC, but I would expect that's only feasible for dedicated HyperSpin PCs. My MAME cabinets with HyperSpin all use Windows 7 and don't get touched. However, my other PCs that use HyperSpin for console emulation are general purpose PCs that update regularly.

Any other suggestions?

Thanks.

[slizzap]

I also tried Compatibility Mode (Windows XP, 7, 8), but that also had no impact.

[Creezz67]

9 hours ago, slizzap said:

I also tried Compatibility Mode (Windows XP, 7, 8), but that also had no impact.

This fix is working fine on Windows 10 H0H2 (Build 19042.746) which i have used since the update came out.

Ensure the drive Hyperspin runs from is set as an exclusion in any anti virus/windows defender.

Check your antivirus /Windows defender to see if they are being blocked and also make sure you run Hyperspin.exe as admin

[slizzap]

4 hours ago, Creezz67 said:

This fix is working fine on Windows 10 H0H2 (Build 19042.746) which i have used since the update came out.

Ensure the drive Hyperspin runs from is set as an exclusion in any anti virus/windows defender.

Check your antivirus /Windows defender to see if they are being blocked and also make sure you run Hyperspin.exe as admin

Apparently it's not, at least not for everyone  I would love to say this fix worked for me, but it does not. Apparently I'm not the only one judging by looking at other threads as well. So I'm really hopeful we can keep this thread productive and useful for myself and others.

This was not mentioned before, but I did previously try running HyperSpin as an administrator, but that had no impact. My logged in account is an administrator and before the Windows 10 upgrade I was not required to run the executable as an administrator. With that said, it no longer works either way.

Defender is not running since I'm using a 3rd party antivirus (Sophos Home). I put in an exclusion for the HyperSpin and RocketLauncher folders, but that did not help. I did completely disable all realtime protection, but that also did not help. The only thing I can do to completely rule out my antivirus is to uninstall it and then confirm Defender is either disabled or has exclusions as well. Once I get some free time I'll try that as my next steps.

Despite Defender being off due to Sophos being installed, I still tried opening "Windows Security" and going to "App & browser control" -> "Exploit Protection Settings" -> "Program Settings" and added the full path/executable for HyperSpin. I then configured an Override for every option (showing a total of 23 system overrides) and every possible option is turned "Off". This did not help.

Any other suggestions?

Thanks.

[Creezz67]

19 hours ago, slizzap said:

Apparently it's not, at least not for everyone  I would love to say this fix worked for me, but it does not. Apparently I'm not the only one judging by looking at other threads as well. So I'm really hopeful we can keep this thread productive and useful for myself and others.

This was not mentioned before, but I did previously try running HyperSpin as an administrator, but that had no impact. My logged in account is an administrator and before the Windows 10 upgrade I was not required to run the executable as an administrator. With that said, it no longer works either way.

Defender is not running since I'm using a 3rd party antivirus (Sophos Home). I put in an exclusion for the HyperSpin and RocketLauncher folders, but that did not help. I did completely disable all realtime protection, but that also did not help. The only thing I can do to completely rule out my antivirus is to uninstall it and then confirm Defender is either disabled or has exclusions as well. Once I get some free time I'll try that as my next steps.

Despite Defender being off due to Sophos being installed, I still tried opening "Windows Security" and going to "App & browser control" -> "Exploit Protection Settings" -> "Program Settings" and added the full path/executable for HyperSpin. I then configured an Override for every option (showing a total of 23 system overrides) and every possible option is turned "Off". This did not help.

Any other suggestions?

Thanks.

All I will say look towards you computer rather than Hyperspin.

If it didn't work, 1000's of people would flood the forum saying the same thing.

Try a clean install of windows 10 64bit with latest update.

Make sure you set exclusion for entire drive (e.g. D:/ ) if your setup is on a drive using letter D

add sxs.dll to same folder as hyperspin.exe

Job done.

Everything, including Hyperspin, Hypertheme and HyperHQ all work fine.

I just have a normal Windows 10 home edition on latest update.

[slizzap]

So the root of my problem is in fact that the executables are still detected as malicious content by multiple antivirus vendors. After removing my antivirus (Sophos) I was able to resolve the problem by simply dropping in the sxs.dll file, but this isn't a real resolution. One of my PCs requires that I add an exclusion to Windows Security, and another did not. My primary personal/work PC has Sophos, so I had to reach out to them for input. Despite having an exclusion for the specific HyperSpin.exe executable and for the entire HyperSpin folder, Sophos was still blocking it. With some assistance from Sophos support I had to add another exclusion using a different method to work around this. I consider this to be a defect in Sophos, and they stated they're reviewing on their side. Regardless, this was their explanation for why the exclusions were not properly working relative to this specific incident:

Quote

Please note that application wasn't just blocked because it was known malware but also because the Exploit Mitigation protection detected behaviour that might exploit the system.  It is not recommended to allow this item as it will decrease the ability of Sophos Home to protect your computer. See: Adding local exclusions/Allowing Installations and/or applications to run
 

After following their instructions I was able to get HyperSpin running again. So yes, on one hand the issue was with my antivirus, but on the other hand, the root cause is really due to the way the executable is coded and being flagged by multiple antivirus products as malicious. See detection results at VirusTotal. If you can't download or install the program without your antivirus kicking in, that's a problem. The correct and permanent fix is for the developers to review and correct the executables. Hopefully they'll get around to doing so.

 

[Creezz67]

17 hours ago, slizzap said:

So the root of my problem is in fact that the executables are still detected as malicious content by multiple antivirus vendors. After removing my antivirus (Sophos) I was able to resolve the problem by simply dropping in the sxs.dll file, but this isn't a real resolution. One of my PCs requires that I add an exclusion to Windows Security, and another did not. My primary personal/work PC has Sophos, so I had to reach out to them for input. Despite having an exclusion for the specific HyperSpin.exe executable and for the entire HyperSpin folder, Sophos was still blocking it. With some assistance from Sophos support I had to add another exclusion using a different method to work around this. I consider this to be a defect in Sophos, and they stated they're reviewing on their side. Regardless, this was their explanation for why the exclusions were not properly working relative to this specific incident:

After following their instructions I was able to get HyperSpin running again. So yes, on one hand the issue was with my antivirus, but on the other hand, the root cause is really due to the way the executable is coded and being flagged by multiple antivirus products as malicious. See detection results at VirusTotal. If you can't download or install the program without your antivirus kicking in, that's a problem. The correct and permanent fix is for the developers to review and correct the executables. Hopefully they'll get around to doing so.

 

17 hours ago, slizzap said:

So the root of my problem is in fact that the executables are still detected as malicious content by multiple antivirus vendors. After removing my antivirus (Sophos) I was able to resolve the problem by simply dropping in the sxs.dll file, but this isn't a real resolution. One of my PCs requires that I add an exclusion to Windows Security, and another did not. My primary personal/work PC has Sophos, so I had to reach out to them for input. Despite having an exclusion for the specific HyperSpin.exe executable and for the entire HyperSpin folder, Sophos was still blocking it. With some assistance from Sophos support I had to add another exclusion using a different method to work around this. I consider this to be a defect in Sophos, and they stated they're reviewing on their side. Regardless, this was their explanation for why the exclusions were not properly working relative to this specific incident:

After following their instructions I was able to get HyperSpin running again. So yes, on one hand the issue was with my antivirus, but on the other hand, the root cause is really due to the way the executable is coded and being flagged by multiple antivirus products as malicious. See detection results at VirusTotal. If you can't download or install the program without your antivirus kicking in, that's a problem. The correct and permanent fix is for the developers to review and correct the executables. Hopefully they'll get around to doing so.

 

I think you forgot to add ... Thanks Creezz67 for getting my Hyperspin working again !!

FYI, There is NO way you could ever leave your anti-virus enabled without exclusions to run a Hyperspin or any other frontend setup, as it will block certain files like gamesloader, cetain emulators, certain dll files etc etc

This is a known issue in emulation, so please do not blame the exe file for being detected by an anti-virus, because in my experience 1000's of files are detected/quarantined all the time if it is left on.

[slizzap]

No, I can't say I forgot...

It's pretty clear you haven't used anything other than HyperSpin. RocketLauncher has never required an exception in antivirus. Don't you think it's strange that the HyperLaunch executables do? In fact, HyperSpin never required an exception until post 1.3 updates...somewhere thereabouts IIRC. From that point forward attempts to download would trigger malware alerts from various antivirus products. I've used 2 other frontends in my time, and none of them required exceptions. I actually downloaded a new one, which shall remain nameless, over the weekend to give it a test run...no exception required. Simple fact of the matter, and this is relevant to homebrew applications like this or legitimate real-world applications...uninstalling antivirus, disabling antivirus, or adding folder exceptions is never a solution. It's a workaround, but not a solution. You don't blame the security vendors because their products are doing their jobs, you blame the software developers because they're not doing theirs.

On that note, we sure can place blame on the executable, and no this is not a known issue in emulation as a whole. I've never had to add an exception for any emulator. I could place a pretty safe bet that you're not a software developer. Here's a good article worth reading - https://www.zdnet.com/article/windows-malware-how-to-stop-your-files-being-wrongly-tagged-as-malicious-by-windows-defender-atp/ This gives good tips for developers to ensure their applications are not falsely flagged as malicious. This is something that would need to be addressed by the HyperSpin developer(s). It's up to them if they think it's worth their time.

[Guest]

Some tools in emulation will require exceptions because of how they work. DLL injectors, etc will always look like viruses (they kind of are, just the good kind).

A front end should never need an exception. There’s no reason a single platform front end should be doing anything that would look suspicious to an anti virus program.

Flash is likely a big reason HS gets flagged, and also its shameless lack of development.


Oh and also - this scene is about people helping each other enjoy a hobby. Prompting for thanks and posting misinformation is just not helpful.


Sent from my iPhone using Tapatalk Pro

[Creezz67]

5 hours ago, slizzap said:

No, I can't say I forgot...

It's pretty clear you haven't used anything other than HyperSpin. RocketLauncher has never required an exception in antivirus. Don't you think it's strange that the HyperLaunch executables do? In fact, HyperSpin never required an exception until post 1.3 updates...somewhere thereabouts IIRC. From that point forward attempts to download would trigger malware alerts from various antivirus products. I've used 2 other frontends in my time, and none of them required exceptions. I actually downloaded a new one, which shall remain nameless, over the weekend to give it a test run...no exception required. Simple fact of the matter, and this is relevant to homebrew applications like this or legitimate real-world applications...uninstalling antivirus, disabling antivirus, or adding folder exceptions is never a solution. It's a workaround, but not a solution. You don't blame the security vendors because their products are doing their jobs, you blame the software developers because they're not doing theirs.

On that note, we sure can place blame on the executable, and no this is not a known issue in emulation as a whole. I've never had to add an exception for any emulator. I could place a pretty safe bet that you're not a software developer. Here's a good article worth reading - https://www.zdnet.com/article/windows-malware-how-to-stop-your-files-being-wrongly-tagged-as-malicious-by-windows-defender-atp/ This gives good tips for developers to ensure their applications are not falsely flagged as malicious. This is something that would need to be addressed by the HyperSpin developer(s). It's up to them if they think it's worth their time.

Apart from my 600 x wheel setup on my slow as a snail Launchbox setup, with 175,000 games you mean ?

I have been into/using emulation since MAME 001 and know what I am talking about from experience over 20+ years.

As I said, it wouldn't matter if Hyperspin was not flagged, because hundreds if not thousands of other files in an emulation setup will get flagged/blocked all the time (just leave yours on then if you think you know better)

I would place a pretty good bet that you haven't even tried it

If you don't like Hyperspin, then don't use it. A simple exclusion to set and it's like the end of the world !

[Creezz67]

4 minutes ago, tonesmalone said:

Some tools in emulation will require exceptions because of how they work. DLL injectors, etc will always look like viruses (they kind of are, just the good kind).

A front end should never need an exception. There’s no reason a single platform front end should be doing anything that would look suspicious to an anti virus program.

Flash is likely a big reason HS gets flagged, and also its shameless lack of development.


Oh and also - this scene is about people helping each other enjoy a hobby. Prompting for thanks and posting misinformation is just not helpful.


Sent from my iPhone using Tapatalk Pro

I never said Hyperspin.exe needed an exception, I said the Hyperspin setup needed one, just like Launchbox and any other frontend setup.

It's not the exe that is usually the issue, it's the millions of files running it in the background, where some are just silently quarantined or cause black screens because they are being blocked by anti-virus if it is left on with no exclusions added.

Easiest thing to do is set exclusion for entire drive the setup is on. Try running Gamesloader with anti virus on for example.

[Guest]

I never said Hyperspin.exe needed an exception, I said the Hyperspin setup needed one, just like Launchbox and any other frontend setup.
It's not the exe that is usually the issue, it's the millions of files running it in the background, where some are just silently quarantined or cause black screens because they are being blocked by anti-virus if it is left on with no exclusions added.
Easiest thing to do is set exclusion for entire drive the setup is on. Try running Gamesloader with anti virus on for example.

That literally isn’t how it works technically. There aren’t, and shouldn’t be, “millions of files” running in the background.

Gamesloader is a DLL injector! It isn’t a front end.




Sent from my iPhone using Tapatalk Pro

[Creezz67]

3 minutes ago, tonesmalone said:

 

That literally isn’t how it works technically. There aren’t, and shouldn’t be, “millions of files” running in the background.

Gamesloader is a DLL injector! It isn’t a front end.




Sent from my iPhone using Tapatalk Pro

I know it's not a frontend, but unless you have the crappest system on the planet with 1 system (NES) for example, you are going to get issues with anti virus if exclusions are not set.

A Hyperspin setup and Hyperspin.exe are 2 different things.

Also millions of files in the background (not all running at the same time) of which some will be flagged as exclusions, for any pedantic people reading this.

[Kleyon]

I came on topic to tell I am suing Windows 10 20H2 x64 and Hyperspin is working fine using Windows 10 2004 fix on download section then.... I see you talking about anti-virus exceptions.... I just want to tell... WTF?!

I am brand new to Hyperspin (since one week or so), I have ESET Internet Security installed and I use Hyperspin + RocketLauncher, this far, I didn't create any exception! Everything is working fine! Or maybe I didn't installed concerned emulators... This far :

1. Daphne
2. Daphne Singe
3. Retroarch
4. CPS3 Emulator
5. Mame64
6. DEmul
7. Model 2 Emulator
8. Supermodel

So I am not really sure to understand what you are talking about, except concerning HyperLaunch but I don't use it like I said since I use RocketLauncher.

I think real issue here is sources where content is grab.

[Creezz67]

22 hours ago, Kleyon said:

I came on topic to tell I am suing Windows 10 20H2 x64 and Hyperspin is working fine using Windows 10 2004 fix on download section then.... I see you talking about anti-virus exceptions.... I just want to tell... WTF?!

I am brand new to Hyperspin (since one week or so), I have ESET Internet Security installed and I use Hyperspin + RocketLauncher, this far, I didn't create any exception! Everything is working fine! Or maybe I didn't installed concerned emulators... This far :

1. Daphne
2. Daphne Singe
3. Retroarch
4. CPS3 Emulator
5. Mame64
6. DEmul
7. Model 2 Emulator
8. Supermodel

So I am not really sure to understand what you are talking about, except concerning HyperLaunch but I don't use it like I said since I use RocketLauncher.

I think real issue here is sources where content is grab.

Try adding 250 emulators smart arse, then come back and tell us that you don't need to set any exclusions.

Yet another person that install a couple of systems and thing he is a Hyperspin master !! 🤣

[slizzap]

Kleyon: The source where content is downloaded from is irrelevant. The issue is that due to the way the program is coded, 17 out of 70 antivirus providers consider HyperSpin malicious. ESET is not one of them, so you're not seeing any issues. This was posted above, but you can see the details here at VirusTotal.

Creezz67: You're really not being helpful in any way.

[Kleyon]

@slizzap, ok thanks for explanation I'm pretty surprised since ESET is not that bad habitually, anyway we're talking about false positives so it is kind of a good thing ESET don't detect it ^^ And looking at those 17 antivirus concerned... they're not really good ones 😕 (except Palo Alto 😵, well I know them for professional firewall stuff and fortinet maybe). Anyway most users are using Hyperspin for baretop or so, my opinion is that it is easier to make an offline computer in that case.

@Creezz67 tells me who pretend to be a Hyperspin master?! On conrtary I told I was brand new to it... Your behaviour is watching us your oversized ego. Hyperspin is really a great frontend but seems like community is really toxic... if someone is searching for help, he better search anywhere else.... maybe we have to donate for that... what a mess...

Maybe I'm just a Hyperspin noob, but in one week, I understood how it works and installed 60Gb+ of working content when somes are having a real hard time... And my goal isn't to install 250+ emulators, my goal is just arcade content so I am near it. Just have some little remaining issues.

Edit: Seems like Spawk makes me lie, someone here helped me! So one remaining issue less! Thanks god maybe I was not completely right thinking it is now nothing else than a business...

[Creezz67]

18 hours ago, Kleyon said:

@slizzap, ok thanks for explanation I'm pretty surprised since ESET is not that bad habitually, anyway we're talking about false positives so it is kind of a good thing ESET don't detect it ^^ And looking at those 17 antivirus concerned... they're not really good ones 😕 (except Palo Alto 😵, well I know them for professional firewall stuff and fortinet maybe). Anyway most users are using Hyperspin for baretop or so, my opinion is that it is easier to make an offline computer in that case.

@Creezz67 tells me who pretend to be a Hyperspin master?! On conrtary I told I was brand new to it... Your behaviour is watching us your oversized ego. Hyperspin is really a great frontend but seems like community is really toxic... if someone is searching for help, he better search anywhere else.... maybe we have to donate for that... what a mess...

Maybe I'm just a Hyperspin noob, but in one week, I understood how it works and installed 60Gb+ of working content when somes are having a real hard time... And my goal isn't to install 250+ emulators, my goal is just arcade content so I am near it. Just have some little remaining issues.

Edit: Seems like Spawk makes me lie, someone here helped me! So one remaining issue less! Thanks god maybe I was not completely right thinking it is now nothing else than a business...

60gb already ?

That's nearly as much as my 40,000gb (or 40tb)  for newbies on 650 x Systems 

When I seen you sarcastically add WTF to you comments , I then made my points.

If you don't like them ..... I care why ?

Start adding Gamesloader for TeknoParrot and other emulators and then see if you think exclusions are no longer required then.

If you want help on this forum I suggest you respect people that have been doing this since you were in nappies (not just me) !!

[Guest]

60gb already ?
That's nearly as much as my 40,000gb (or 40tb)  for newbies on 650 x Systems  [emoji4]
When I seen you sarcastically add WTF to you comments , I then made my points.
If you don't like them ..... I care why ?
Start adding Gamesloader for TeknoParrot and other emulators and then see if you think exclusions are no longer required then.
If you want help on this forum I suggest you respect people that have been doing this since you were in nappies (not just me) !!

Dude, back the fuck off. This community used to be an actual community, not people cock waving at every opportunity. This is supposed to be fun for everyone.

The original point still stands - HS should not require an exclusion. AV packages see it as a virus because it’s based on flash and hasn’t been updated in a decade. Yes, exclusions are needed for the likes of TP because it’s a DLL injector! This point has already been explained.

Mods - do your job and lock this thread.

If anyone wants to actually enjoy this hobby and not have a cock waved in your face every time you post something - there are much more welcoming communities out there. Don’t let this deter you.


Sent from my iPhone using Tapatalk Pro

[Creezz67]

5 minutes ago, tonesmalone said:

 

Dude, back the fuck off. This community used to be an actual community, not people cock waving at every opportunity. This is supposed to be fun for everyone.

The original point still stands - HS should not require an exclusion. AV packages see it as a virus because it’s based on flash and hasn’t been updated in a decade. Yes, exclusions are needed for the likes of TP because it’s a DLL injector! This point has already been explained.

Mods - do your job and lock this thread.

If anyone wants to actually enjoy this hobby and not have a cock waved in your face every time you post something - there are much more welcoming communities out there. Don’t let this deter you.


Sent from my iPhone using Tapatalk Pro

Hyperspin the entire package !!

WHAT DO YOU NOT GET ?

You will NEVER run Hyperspin (with the games, emulators etc) without setting exclusions for your entire setup (NOT HYPERSPIN.,EXE) , unless you have a setup with one game and one emulator.

PS, as if they will lock mthis thread because YOU asked them to  !! 🤣

 

[Guest]

Just now, Creezz67 said:

Hyperspin the entire package !!

WHAT DO YOU NOT GET ?

You will NEVER run Hyperspin (with the games, emulators etc) without setting exclusions for your entire setup (NOT HYPERSPIN.,EXE) , unless you have a setup with one game and one emulator.

 

Dude I very much get it. You are conflating points and being an arse.

This needs locking down now.

[Creezz67]

1 minute ago, tonesmalone said:

Dude I very much get it. You are conflating points and being an arse.

This needs locking down now.

I am just speaking from experience.

For everyone out there, just set an exclusion in your anti-virus/ Windows Defender for your entire Hyperspin drive and you are good to go.

If you do NOT do this, you will have files being quarantined and blocked in the background with no notifications.

I think I am being helpful, but when BBB's keep telling me they know best that is really starting to annoy me.

[Guest]

I am just speaking from experience.
For everyone out there, just set an exclusion in your anti-virus/ Windows Defender for your entire Hyperspin drive and you are good to go.
If you do NOT do this, you will have files being quarantined and blocked in the background with no notifications.
I think I am being helpful, but when BBB's keep telling me they know best that is really starting to annoy me.

It’s the naming calling and put downs that are the issue. And you continue to conflate points without really understanding what that means.


Sent from my iPhone using Tapatalk Pro