Paint.NET 5.1 not starting properly. (Sentinel One antivirus bug)

[adrianbarker]

Just to confirm; SentinelOne user here. Paint.net stopped working. Well, it certainly not usable but as per OP the main window is essentially not responsive but the toolbox windows are movable/responsive to some degree but don't display correctly. Not used it for a little while and upgraded to Windows 11 last week. i.e. It may have been broken for a while. Tried uninstalling, not sure of the version and reinstalled the very latest 5.1. Found this thread after trying lots of options - disabling S1 fixed it. Only a very temporary solution. Have reached out to S1 to try for a fix rather than an exclusion.

[Tactilis]

10 minutes ago, adrianbarker said:

Have reached out to S1 to try for a fix rather than an exclusion.

Please read the other recent threads in the Troubleshooting and Bug Reports section of the forum. Sentinel One are already aware of the problem. There is no fix from them yet.

To use Paint.NET you will need to add a Sentinel One exclusion or temporarily revert to 5.0.13 (see the other recent threads).

[gappvembe]

2 hours ago, Rick Brewster said:

 

This is a work PC, right? That might be something your IT department or network admin is pushing down. Paint.NET can't auto-update "invisibly" like that unless you have the Microsoft Store release installed.

It is a work PC, but there really is no IT depart that does much, at least with my PC. I need it pretty open for all my industrial automation software.

Anyway. This is happening on a couple of PCs, just like the video I showed. It disappears and comes back as 5.1.

In fact, I uninstalled 5.1, installed the previous version via the github link. Installed. It let me open paint dot net.
I needed to make a drawing real quick (I like do do our purchase orders with it).
In the middle of the creation, I noticed in my programs list, paint dot net again transferred to the 5.1 version... with it OPEN!?!?

I saved the picture, even printed as a PDF.

Closed it. Tried to open it back up. Hang up/lock up is there.

I haven't downloaded the microsoft store version, always direct.

[Rick Brewster]

Okay that isn't something I've ever implemented. Perhaps you have one of those package managers that is automatically deploying it somehow. It just isn't possible for Paint.NET to install itself, on its own, that quickly, and without showing any UI.

[gappvembe]

Oh I believe you. Why I captured a video of it's odd behavier.
Anyway, I did it again... unistalled 5.1, reinstalled 5.0.13, made a picture, saved, printed pdf. Closed.
So far it's staying as 5.0.13, its been since I last posted an hour plus. 🤷‍♂️

[Ricky]

I'm also having an issue after the 5.1 update.  Windows 10 Pro.  Goes to a blank screen.  The diagnostics above didn't function for me (wasn't able to get any data).

It doesn't crash my computer, just locks up the program.  I have to use task mgr to end it.

 

Reinstall gives me this error" The application was unable to start correctly ((0xc000007b).  Click OK to close the application."

 

Ran both as administrator, but no luck yet.

 

Uninstalled and tries to reinstall, but got the same error.

 

Cannot find where I can download an older version and try it... that would be my next step.

 

 Edit: Also when to download.com and downloaded an older installer.  It ended up downloading 5.1, but got the same result.  Blah!  Hope to see a fix for this soon.  I appreciate all of the work that you all put into it.

 

Edit 2: Just saw in another thread that this could be caused by Sentinel One, which we use.  Hopefully a fix is out soon.

Edited November 19 by Ricky

[Rick Brewster]

39 minutes ago, Ricky said:

The application was unable to start correctly ((0xc000007b).  Click OK to close the application.

 

We've seen this caused by Sentinel One antivirus.

[Ricky]

How are y'all going back to an older version?  Where do you find the install file?

[lynxster4]

@Ricky  Go here and scroll down to 5.0.13 and click the triangle beside Assets.

 

[Pieter-Dewachter]

Hi everyone, I just got contacted by my IT department confirming SentinelOne has issued an update to fix the issue.

I have tested this personally using version 24.1.4.257 and can confirm Paint.NET 5.1 works correctly again.

[amattis]

4 hours ago, Pieter-Dewachter said:

Hi everyone, I just got contacted by my IT department confirming SentinelOne has issued an update to fix the issue.

I have tested this personally using version 24.1.4.257 and can confirm Paint.NET 5.1 works correctly again.

Hi everyone, i just found out, there is an even newer S1 version out there. On monday version 24.1.5.277 released, tagged as Service Pack. With this version, the start up bug can be seen again, and the manual exclusion has to be set again again. Adding to this, the exclusion only worked for me when defining it as Windows path (tested only the .exe, not the whole directory). Using the hash of paintdotnet.exe didnt work, so the problem might have something to do with one or more of the additional files in the directory. If the hash had worked, users of PDN installed from MS Store could have used that to create the exclusion.

[Luas]

7 hours ago, Pieter-Dewachter said:

Hi everyone, I just got contacted by my IT department confirming SentinelOne has issued an update to fix the issue.

I have tested this personally using version 24.1.4.257 and can confirm Paint.NET 5.1 works correctly again.

 

Paint.NET 5.1 still hangs for me with SentinelOne 24.1.4.257.
 

 

[JonC]

I'm having the same issue.  The SentinelOne update to 24.1.4.257 did not solve the problem either.

[BurnerHelp99]

On 11/15/2024 at 8:28 AM, DanielG said:

Creating a exclusion in Sentinel One (S1) solves the problem:

 

• Exclusion type = Path
• OS = Windows
• Path = C:\Program Files\Paint.NET
• Check Including Subfolders
• Check Exclude path for alerts and mitigation
• Select Interoperability

Needs to be done from S1 Console.

Had a client bring this to our attention today, just got off a troubleshooting call with them and used this post as a template, however I tweaked a few things and can verify that the below exclusion works.

Exclusion type = Path
OS = Windows
Path = C:\Program Files\Paint.NET\paintdotnet.exe
Make sure "As File" is showing. You'll find this below "Path" 
Check Exclude path for alerts and mitigation
Select Interoperability - extended

[Glennonline]

Had the same issue, upgrading the agent to 
24.1.5.277 didn't help, adding the exclusion as described did.

[L0g0ff]

On 11/20/2024 at 10:29 PM, BurnerHelp99 said:

Had a client bring this to our attention today, just got off a troubleshooting call with them and used this post as a template, however I tweaked a few things and can verify that the below exclusion works.

Exclusion type = Path
OS = Windows
Path = C:\Program Files\Paint.NET\paintdotnet.exe
Make sure "As File" is showing. You'll find this below "Path" 
Check Exclude path for alerts and mitigation
Select Interoperability - extended

Thanks, this solution works.

[nickm37]

I posted earlier (Sorry I didn't get a notification of reply) - I am also a Sentinel One user.  Downgraded and won't upgrade yet. 

[kedehern]

Mine is freezing up as well - no problems for years updating until now.  I removed it and reverted to 5.0.13 and it works again.

TIM

 

 

 

 

[Sir_Timbit]

On 11/20/2024 at 2:29 PM, BurnerHelp99 said:

Had a client bring this to our attention today, just got off a troubleshooting call with them and used this post as a template, however I tweaked a few things and can verify that the below exclusion works.

Exclusion type = Path
OS = Windows
Path = C:\Program Files\Paint.NET\paintdotnet.exe
Make sure "As File" is showing. You'll find this below "Path" 
Check Exclude path for alerts and mitigation
Select Interoperability - extended

 

Thanks for this! We were having the exact same problem, and excluding only the executable worked for us as well

[Rick Brewster]

After talking with someone from Sentinel One, I think I've been able to implement a workaround. I can't test this myself though, but here's a build that has the workaround for the problems we identified:

• Installer (x64): https://www.getpaint.net/files/zip/test/Paint.NET.5.101.9097.2045.install.x64.zip
   
• Portable (x64): https://www.getpaint.net/files/zip/test/Paint.NET.5.101.9097.2045.portable.x64.zip 

Part of the workaround involves disabling Async Present. This will have a detrimental affect on input latency/lag, but it won't be any worse than 5.0 was.

[painltd]

I had the exact same problem; the build provided in Rick's comment fixes the problem for me - Paint.NET completes start up quickly and no longer takes up to 20% of my CPU. Thank you!

[Tactilis]

7 hours ago, Rick Brewster said:

Part of the workaround involves disabling Async Present. This will have a detrimental affect on input latency/lag, but it won't be any worse than 5.0 was.

Does that mean that, because of Sentinel One, everyone will lose the gains you made by implementing Async Present?

 

Or is this something that can be applied only for SO users, assuming you can detect its presence?

Or is this a temporary workaround which can be removed after SO have fixed their software?

EDIT: I see from another thread that PDN diagnostics now includes in Flags:
 

IsSentinelOneLoaded          True

 

So I think that answers my questions with:
- No
- Yes
- Probably

 

[NomNomNomad]

The solution Rick provided also works on my side

[Rick Brewster]

8 hours ago, Tactilis said:

Does that mean that, because of Sentinel One, everyone will lose the gains you made by implementing Async Present?

No. Only when S1 is detected.

[Rick Brewster]

8 hours ago, Tactilis said:

Or is this a temporary workaround which can be removed after SO have fixed their software?

Yes, it's temporary.