Win XP SP3 and Windows Update

[Pixel33]

I have been dealing with this problem all day.  I gave a church a spare SN95G5 V2 with a 3500+/250gb hdd/AGP Card/1gb of ram.  They had it for a while runnning power point presentations and song lists on a projector.  Everything was fine and it was working great.  It was running XP SP3 will all the updates (installed it about 2 months) ago.  Had IE7 WMP11 and all of that stuff.  Then they had a meltdown...pc wouldnt boot.  It doesn't have anti virus or a firewall installed and they were going on line with it (something I told them not to do).  We as of yesterday I reinstalled XP SP2 disc...everything is fine.  I put allt he latest drivers and it alreayd had the lastest bios.  I have SP3 full distribution and I installed that on it.  No problems.  I get on line go to windows update.  It shows no critial updates what so ever.  I has malicous spyware removal tool and 2 options (netframework 1 and 2.2) and 2 hardware options (amd and for onboard sound).

I just ran another XP SP3 disc 4 days ago with a E7200/610I board and it showed all kinds of critical updates and also gave me the option of putting IE7 and WMP11 on as well.  

I just got off the phone with M$ tech support for and hour and a half.  They took control of the SN95G5 V2 and went to windows update.  Same thing.....back and forth we talked.  And he said because the computer is "older" that it doesnt need the critical updates.  I explained to them that if it meets the minimum req. for XP then it doesnt really matter on the critical updates because thats OS patches and nothing really to do with software.

So anyone else have this problem or am I just simply wrong?  Is their server down on windows updates?  Virus on a fresh install causing it not to patch?  

Anyone please help.

[Pixel33]

Guess I am the only one experiencing this problem.  I just updated my main rig to SP3...same thing....no critical updates.  I already had IE7 and WMP11 installed so i didn't expect to see anything for them.

I just find it hard to believe that since SP3's release (v3264) that their are no critical updates to the OS.  Even though M$'s site under security shows several updates just for July alone.

[Pixel33]

Well on the 3rd fresh install it all seemed normal on Windows Update.  All the critical drivers showed up as well as the option for IE7 and WMP11.  The only thing I did differently was slipstreamed SP3 into the disc.   Installed XPC drivers then rrebooted and went to Windows Update.  I think it was something on their end seriously.  But to have their tech support tell me the OS didnt need any of its ciritical updates (all be it 6 months worth) because I was using an "Old" 3500+ made no sense to me what so ever.

[Intuit]

re the initial non-boot issue:  Was the system bootable in Safe Mode ?  Because the system runs a disk check in safe mode with no status displays, it can appear as though it has hung even though it hasn't.  HD activity light will be lit.  When I get a non-boot in Safe Mode, it's typically file corruption as a result of drive or/and RAM errors.

re Windows Update:  If I understand your explaination, you're saying that you installed SP3, reboot, go back to the WU site and find that it's still requiring some of the normal updates that are included in SP3 ?

1) Keep in mind that there have been several critical updates issued since SP3's release.  So when you install the offline redistributable version of SP3 while offline, you'll still find that there are some updates to be applied at update.microsoft.com.  IE7 redistributable as opposed to the SP3 redistrubtable, does attempt to go online and automatically install the latest browser-related updates.  Not sure but I don't think any of the critical updates are O/S related; only browser.

2)  The SP3 update, and updates in general can fail to install silently.  To verify the SP revision of the OS, simply open an explorer window, go to help menu then about.  (or right-click my computer, select properties) If it shows SP2 even though you installed SP3, then the SP3 install simply failed.  What I've found is that the update.microsoft.com site runs the update installers with parameters that prevents them from displaying any prompts, messages or errors.  So the installation *silently* fails, but requests that you reboot anyway and a portion of your system remains not updated.  Nearly everytime I've run into this situation, it has been the result of restrictive permissions that had been set on registry keys.  (It's possible that restrictive permissions on NTFS files will cause failure as well, but I've not yet run into that situation.)[/i]  Legitemate apps as well as and especially, malware are typically responsible for this.  The other time I've run into this, was because of corrupt and missing catalog files (+systemroot+\system32\catroot).  Permissions for the affected keys need to be corrected and the SP3 installer relaunched; or/and the missing catalog files replaced (and insure that the cyrptography service still runs properly).  The SP3 log file is unfortunately as good as useless and so the only way to tell which keys or files the installer is getting denied on (some are normal) is to use SysInternals.Com's Process Monitor on update.exe.  SubInACL and/or RegEdit can be used to correct those issues.

[Pixel33]

No what was happening was is I would install XP sp2....then boot into XP....install sp3...reboot....install drivers...reboot.....go to windows update only to have it show no critical updates, no optional updates other than netframework 1.1 and 2, and 2 hardware updates.  I know their are ciritical updates just to sp3 since its release but they would never show up.  I redid the above 2 times with the same results and I then slipstreamed sp3 into xp sp2 and reinstalled, installed drivers.....reboot.....went to Windows Update and bingo....all the ciritical updates were their as well as the options for IE7 WMP11 as well as a few others.

Its fixed now but not sure what the problem was.  I know it wasn't because I had a 3500+ and DDR ram like the tech support for M$ said.  May have just gotten timed out or it couldn't verify SP3 was installed correctly.

[Intuit]

If you were installing the standard SP3/IE7 update as opposed to the network redistributable, then in the process of updating it polled the WU servers and automatically downloaded+installed the latest updates.  So what you whitnessed was likely nothing more than expected behavior.  When you slipstreamed it didn't include the latest updates.  My laptop was fully updated and in the process of troubleshooting a few related issues, (caused by having disabled verclsid.exe, ctfmon.exe) reinstalled SP3 using the full redistributable download.  After doing so, I noticed that my laptop was no longer up-to-date and required that I redownload + install the same updates I had done prior.

[crosscourt]

I had issues getting SP3 installed on one pc and had to do it in safe mode. Everything went fine,most updates were included then when I rebooted windows update no longer worked and still doesnt. So I tried downloading the critical updates seperately from Microsoft not from update and all installed just fine.

[Intuit]

http://msdn.microsoft.com/en-us/library/aa387285(VS.85).aspx
(above link works, forum software just cuts it short -- use highlight, copy, paste)
http://update.microsoft.com/redist/wuredist.cab

Inside that cabinet file, there is an XML file.  Open the XML file with notepad and you'll see direct-download links to O/S dependant versions of the Windows Update Agent.

Using the appropriate link, download the most recent version for your O/S and install it.  WUA should then work fine.  I've known malware the set policies and registry parameters, plus sabotage the WUAUServ service in order to prevent WU from working.  If all else fails, then chances are the DNS has been hijacked.  Once the hijacker is removed, the DNS address can be changed back via Control Panel -> Network Connections, adapter properties.  While there, remove "Client for Microsoft Networks", "File and Print Sharing for Microsoft Networks".  Most people don't use these features.

[crosscourt]

Already tried that Intuit didnt work and the issue is know by microsoft but they havent designed a fix for it at present.

Out of the 5 pcs/laptops I added SP3 to only one had issues,very odd.

Updating can still be done just not thru auto update...

[Intuit]

Sometimes it's just necessary to review the logs and figure out what the problem is.  There's WindowsUpdate.log and also the EventViewer, which will list errors related to related services, such as the cryptography service.  Malware likes to cripple the scripting subsystems as well.  Registering jscript.dll and vbscript.dll resolved it for me in another instance where all else failed.  But certain webpages in general didn't pull right, as well as WMP9.  In any event, it's likely not a bug, but a dependency issue.

[Intuit]

Ironically I just ran into a problem with WU site on a new install.  
Following command sequence resolved the issue...  (in this case)
tskill explorer /a /v
sc stop wuauserv
rd /s /q "c:\windows\downloaded program files"
rd /s /q "c:\windows\softwaredistribution"
"c:\program files\internet explorer\iexplore.exe" http://update.microsoft.com/

It then prompted to install an updated version of WUA as it should've done in the first place.  Installing it manually (as described in a post above) should've resolved the issue as well... but don't know for sure.  It's possible it may have been necessary to wipe-out the softwaredistribution directory first.

In short, BUG.
In dependency issue cases, it would be nice if the program would just point to the particular subsystem (or policy) that's giving it issues.

[crosscourt]

I dont typically use auto update anyway so its not a huge issue but for customers its a minor problem.

I typically do all my updates manually thru seperate downloads to avoid a variety of issues.

I also use Vista and it hasnt had this issue so far.

[Intuit]

Ironically it just happened again on the same PC.  Get that seemingly indefinite green rolling bar.
Following sequence of commands resolved THEIR BUG it this time...

Code:

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoRestartShell" /t "REG_DWORD" /d "0x00000000" /f
tskill iexplore /a /v
tskill explorer /a /v
sc stop wuauserv

{delay a few moments}

rd /s /q "c:\windows\downloaded program files"
rd /s /q "c:\windows\softwaredistribution"

rd /s /q "c:\documents and settings\{USERNAME}\local settings\temp"
md "c:\documents and settings\{USERNAME}\local settings\Temp"
rd /s /q "c:\documents and settings\{USERNAME}\local settings\temporary internet files"

rd /s /q "c:\documents and settings\networkservice\local settings\temp"
md "c:\documents and settings\networkservice\local settings\Temp"
rd /s /q "c:\documents and settings\networkservice\local settings\temporary internet files"

rd /s /q "c:\documents and settings\localservice\local settings\temp"
md "c:\documents and settings\localservice\local settings\Temp"
rd /s /q "c:\documents and settings\localservice\local settings\temporary internet files"

rd /s /q "c:\windows\temp"
md c:\windows\Temp

{replace all "+" symbols with "%" symbols beyond this point -- forum software bug}
cd /d c:\windows\temp
for +a in (history cookies tempor~1 "temporary internet files") do rd /s /q "+~a" & type nul>"+~a" & attrib +r +h +s "+~a"
cd /d "+tmp+"
for +a in (history cookies tempor~1 "temporary internet files") do rd /s /q "+~a" & type nul>"+~a" & attrib +r +h +s "+~a"
cd /d "c:\documents and settings\networkservice\local settings\temp"
for +a in (history cookies tempor~1 "temporary internet files") do rd /s /q "+~a" & type nul>"+~a" & attrib +r +h +s "+~a"
cd /d "c:\documents and settings\localservice\local settings\temp"
for +a in (history cookies tempor~1 "temporary internet files") do rd /s /q "+~a" & type nul>"+~a" & attrib +r +h +s "+~a"

"c:\program files\internet explorer\iexplore.exe" http://update.microsoft.com/

Forum software bugs prevent me from using variables so there are some pathnames that have been assumed and may need to be corrected.

[crosscourt]

Outside of the auto update problem ala SP3 Ive had no other issues with that particular pc.

[Intuit]

One more to add for good measure...

Code:

rd /s /q "c:\windows\system32\config\systemprofile\local settings\temp"
md "c:\windows\system32\config\systemprofile\local settings\Temp"
rd /s /q "c:\windows\system32\config\systemprofile\local settings\temporary internet files"

cd /d "c:\windows\system32\config\systemprofile\local settings\temp"

{replace all "+" symbols with "%" symbols beyond this point -- forum software bug}
for +a in (history cookies tempor~1 "temporary internet files") do rd /s /q "+~a" & type nul>"+~a" & attrib +r +h +s "+~a"

[crosscourt]

Your on a roll Intuit!!

Just added the recent updates manually and had no issues whatsoever.......

[Intuit]

Thanks.  In addition to killing explorer, I should've added that iexplore should be killed as well...

Code:

tskill iexplore /a /v

[crosscourt]

Gotcha.....

[Intuit]

This particular installation had some malware on it but a Vista machine had issues with windows update as well.  (...and by the way the Acer Aspire T690 has a defective case design that overheats the harddrive...)[/size]

Before, the filesystem path-scheme in Vista seemed a little convoluted but think I now understand it better.  Anyway... the following must be performed from a fully, administrator privileged command prompt...

Code:

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoRestartShell" /t "REG_DWORD" /d "0x00000000" /f
taskkill /im iexplore.exe /t /f
taskkill /im explorer.exe /f
sc stop wuauserv

{delay a few moments}

rd /s /q "c:\windows\downloaded installation files"
rd /s /q "c:\windows\downloaded program files"
rd /s /q "c:\windows\softwaredistribution"

rd /s /q "c:\users\{USERNAME}\appdata\local\temp"
md "c:\users\{USERNAME}\appdata\local\Temp"
rd /s /q "c:\users\{USERNAME}\appdata\local\microsoft\windows\temporary internet files"

rd /s /q "c:\users\default\appdata\local\temp"
md "c:\users\default\appdata\local\Temp"
rd /s /q "c:\users\default\appdata\local\microsoft\windows\temporary internet files"

rd /s /q "c:\windows\serviceprofiles\networkservice\appdata\local\temp"
md "c:\windows\serviceprofiles\networkservice\appdata\local\Temp"
rd /s /q "c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files"

rd /s /q "c:\windows\serviceprofiles\localservice\appdata\local\temp"
md "c:\windows\serviceprofiles\localservice\appdata\local\Temp"
rd /s /q "c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files"

rd /s /q "c:\windows\system32\config\systemprofile\appdata\local\temp"
md "c:\windows\system32\config\systemprofile\appdata\local\Temp"
rd /s /q "c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\temporary internet files"

rd /s /q c:\windows\temp
md c:\windows\Temp

sc stop bits
rd /s /q c:\programdata\microsoft\network\downloader
md c:\programdata\microsoft\network\downloader
bitsadmin /cache /clear


{replace all "+" symbols with "%" symbols beyond this point -- forum software bug}
cd /d "c:\users\{USERNAME}\appdata\local\temp"
for +a in (history cookies tempor~1 "temporary internet files") do rd /s /q "+~a" & type nul>"+~a" & attrib +r +h +s "+~a"
cd "c:\users\default\appdata\local\temp"
for +a in (history cookies tempor~1 "temporary internet files") do rd /s /q "+~a" & type nul>"+~a" & attrib +r +h +s "+~a"
cd "c:\windows\serviceprofiles\networkservice\appdata\local\temp"
for +a in (history cookies tempor~1 "temporary internet files") do rd /s /q "+~a" & type nul>"+~a" & attrib +r +h +s "+~a"
cd "c:\windows\serviceprofiles\localservice\appdata\local\temp"
for +a in (history cookies tempor~1 "temporary internet files") do rd /s /q "+~a" & type nul>"+~a" & attrib +r +h +s "+~a"
cd "c:\windows\system32\config\systemprofile\appdata\local\temp"
for +a in (history cookies tempor~1 "temporary internet files") do rd /s /q "+~a" & type nul>"+~a" & attrib +r +h +s "+~a"
cd "c:\windows\temp"
for +a in (history cookies tempor~1 "temporary internet files") do rd /s /q "+~a" & type nul>"+~a" & attrib +r +h +s "+~a"

"c:\windows\system32\wuapp.exe"

[crosscourt]

Ive had few issues with malware but between Defender,Asquared free and Spybot Search and Destroy not to mention AVG 8.0 things have been fine.

[Intuit]

Unfortunately they all miss things.  Could be running ten malware scanners and still get infected.  Many people (not you) are given the impression that they're fully secured... as if to say "well I have xxx visus scanner I can go and install anything".  (get a lot of business that way) They help but that is all.  Folks shouldn't let anti-malware scanners lul them into a false sense of security.

[crosscourt]

They do miss things thus running a variety of programs give you the best chance of spotting problems.

Im very careful about what I install and I run some software on my test rig to be sure it wont creat problems.

Most people dont even take minor precautions and at least with Vista Defenders active scanning will help to a point.

[Intuit]

Part of the problem is if I got RRussell to program-up a piece of malware and put it on the net, depending upon how many people report to whom and when, several months may go by before it's flagged in most malware scanners and that's even if it is flagged.  Computers aren't powerful enough to scan for everything so only a limited number of signatures are kept in circulation.  That's one of the reasons for the global virus maps that companies use.  It's insanely easy to target and disable specific malware scanners if their programs haven't been made aware of the fact that the said code is malicious.  But with specific exceptions, you'll stay out of the anti-malware scanners' sites longer if you don't target them and concentrate your efforts on a limited number of PCs.

[crosscourt]

Ive had so few problems Im not particularly worried but you do as much as you can to protect yourself.

[Intuit]

Just ran into another system where none of the above resolved the issue... although I still hadn't tried the manual wuredist.cab method.

What resolved it was:

Code:

cd /d c:\windows\system32
for %a in (wu*) do regsvr32 /s "%~a"