Being prompted for Updates that have been installed???

I have 5 critical updates that do not seem to get installed properly. I have
tried one at a time, in numeric order, downloading and installing in safe
mode...

I don't get any errors, I get success messages for installs. Then when I
return the the update site or when the Automatic Update notification pops up,
the same 5 updates are there...

I have reset the Automatic Updates forlder by stopping the service and
removing the directory.

Nothing seems to work. I have Adaware, Spybot, and Spyblaster spyware
scanners running as well as McAfee Antivirus 8i. I have even scanned online
using Trend Micro's online scanner. Can't find any significant issues with
spyware or virus'.

I do get explorer.exe crashing after a reboot because it attempt to access
restricted memory. DEP seems to be configured correctly. After the crash, I
log off and on and usually everything works just fine.

Any suggestions welcome.
--
MD

Forgot to include the list of updates.

There was 6 on Friday, but somehow I have reduced it to 5... accidentally

Cumulative Security update for Internet Explorer for Windows XP (KB896688)
Security update for Windows XP(KB896424)
Security update for Windows XP(KB900725)
Security update for Windows XP(KB902400)
Security update for Windows XP(KB905749)

Security update for Windows XP(KB905414) Seems to have gone away finally.
--
MD


"Mark D" wrote:

> I have 5 critical updates that do not seem to get installed properly. I have
> tried one at a time, in numeric order, downloading and installing in safe
> mode...
>
> I don't get any errors, I get success messages for installs. Then when I
> return the the update site or when the Automatic Update notification pops up,
> the same 5 updates are there...
>
> I have reset the Automatic Updates forlder by stopping the service and
> removing the directory.
>
> Nothing seems to work. I have Adaware, Spybot, and Spyblaster spyware
> scanners running as well as McAfee Antivirus 8i. I have even scanned online
> using Trend Micro's online scanner. Can't find any significant issues with
> spyware or virus'.
>
> I do get explorer.exe crashing after a reboot because it attempt to access
> restricted memory. DEP seems to be configured correctly. After the crash, I
> log off and on and usually everything works just fine.
>
> Any suggestions welcome.
> --
> MD

Well, I seem to be the only one posting to my question.

Have done much more investigation and have discovered a resolution to the
Microsoft Update problem and will probably need to take this to another forum
for further discussion.

What I determined is that Microsoft Update is working just fine. What
appears to be broken is the reboot process that is supposed to put in the
system files that are in use during the update.

How did I determine this.... I looked at the KBxxxxxx.log files that are in
the Windows directory. In those near the end of the log, there is mention of
files that are (delayed) and they have names like SETx.tmp. If you check the
properties of the tmp files, you will notice that they directly correlate to
those files (delayed).

To FIX the symptoms of problem, I booted to Windows PE, renamed all the DLLs
that I wrote down to .tmp and then renamed each file named SETx.tmp to the
appropriate DLL name. The versions of the SETx.tmp files are those
referenced in the KB article.

This resulted in a MUCH more stable and functional OS. I carried it further
to other tmp files I located in Windows\system32\usmt

It is interesting to note that the creation of the SETx.tmp files are always
created with a unique name. If you try and install the update over and
over....... you get an additional copy of the files that are not installed.
Consequently you really start using up the storage space on the drive with
multiple copies with different names. In my case, there was 260 MB of tmp
files created.

--
MD


"Mark D" wrote:

> Forgot to include the list of updates.
>
> There was 6 on Friday, but somehow I have reduced it to 5... accidentally
>
> Cumulative Security update for Internet Explorer for Windows XP (KB896688)
> Security update for Windows XP(KB896424)
> Security update for Windows XP(KB900725)
> Security update for Windows XP(KB902400)
> Security update for Windows XP(KB905749)
>
> Security update for Windows XP(KB905414) Seems to have gone away finally.
> --
> MD
>
>
> "Mark D" wrote:
>
> > I have 5 critical updates that do not seem to get installed properly. I have
> > tried one at a time, in numeric order, downloading and installing in safe
> > mode...
> >
> > I don't get any errors, I get success messages for installs. Then when I
> > return the the update site or when the Automatic Update notification pops up,
> > the same 5 updates are there...
> >
> > I have reset the Automatic Updates forlder by stopping the service and
> > removing the directory.
> >
> > Nothing seems to work. I have Adaware, Spybot, and Spyblaster spyware
> > scanners running as well as McAfee Antivirus 8i. I have even scanned online
> > using Trend Micro's online scanner. Can't find any significant issues with
> > spyware or virus'.
> >
> > I do get explorer.exe crashing after a reboot because it attempt to access
> > restricted memory. DEP seems to be configured correctly. After the crash, I
> > log off and on and usually everything works just fine.
> >
> > Any suggestions welcome.
> > --
> > MD

"Mark D" <> wrote in message
news:0197E56B-C824-43B1-9FEA-
....
> What appears to be broken is the reboot process that is supposed
> to put in the system files that are in use during the update.


What is often thought in that case is that a user's security programs
if not disabled may be interfering with the renaming procedure.

Did you have your security programs disabled over the reboot
(or try rebooting in safe mode which would also probably prevent such
potential interference)?


---



> Well, I seem to be the only one posting to my question.
>
> Have done much more investigation and have discovered a resolution to the
> Microsoft Update problem and will probably need to take this to another forum
> for further discussion.
>
> What I determined is that Microsoft Update is working just fine. What
> appears to be broken is the reboot process that is supposed to put in the
> system files that are in use during the update.
>
> How did I determine this.... I looked at the KBxxxxxx.log files that are in
> the Windows directory. In those near the end of the log, there is mention of
> files that are (delayed) and they have names like SETx.tmp. If you check the
> properties of the tmp files, you will notice that they directly correlate to
> those files (delayed).
>
> To FIX the symptoms of problem, I booted to Windows PE, renamed all the DLLs
> that I wrote down to .tmp and then renamed each file named SETx.tmp to the
> appropriate DLL name. The versions of the SETx.tmp files are those
> referenced in the KB article.
>
> This resulted in a MUCH more stable and functional OS. I carried it further
> to other tmp files I located in Windows\system32\usmt
>
> It is interesting to note that the creation of the SETx.tmp files are always
> created with a unique name. If you try and install the update over and
> over....... you get an additional copy of the files that are not installed.
> Consequently you really start using up the storage space on the drive with
> multiple copies with different names. In my case, there was 260 MB of tmp
> files created.
>
> --
> MD
>
>
> "Mark D" wrote:
>
>> Forgot to include the list of updates.
>>
>> There was 6 on Friday, but somehow I have reduced it to 5... accidentally
>>
>> Cumulative Security update for Internet Explorer for Windows XP (KB896688)
>> Security update for Windows XP(KB896424)
>> Security update for Windows XP(KB900725)
>> Security update for Windows XP(KB902400)
>> Security update for Windows XP(KB905749)
>>
>> Security update for Windows XP(KB905414) Seems to have gone away finally.
>> --
>> MD
>>
>>
>> "Mark D" wrote:
>>
>> > I have 5 critical updates that do not seem to get installed properly. I have
>> > tried one at a time, in numeric order, downloading and installing in safe
>> > mode...
>> >
>> > I don't get any errors, I get success messages for installs. Then when I
>> > return the the update site or when the Automatic Update notification pops up,
>> > the same 5 updates are there...
>> >
>> > I have reset the Automatic Updates forlder by stopping the service and
>> > removing the directory.
>> >
>> > Nothing seems to work. I have Adaware, Spybot, and Spyblaster spyware
>> > scanners running as well as McAfee Antivirus 8i. I have even scanned online
>> > using Trend Micro's online scanner. Can't find any significant issues with
>> > spyware or virus'.
>> >
>> > I do get explorer.exe crashing after a reboot because it attempt to access
>> > restricted memory. DEP seems to be configured correctly. After the crash, I
>> > log off and on and usually everything works just fine.
>> >
>> > Any suggestions welcome.
>> > --
>> > MD

Thanks for responding.

I booted into safe mode to do each installation one at a time following up
with safe mode to complete the installation. Did not help.

The only thing I can think of doing is removing the spyware programs and
trying again.

Having installed the patches and then renaming the appropriate files via
Windows PE, the system is working fine right now. Still scratching my head
as to why the rename process doesn't function. Just looking for additonal
information that might help me determine what is broken or where to look.
--
MD


"Robert Aldwinckle" wrote:

> "Mark D" <> wrote in message
> news:0197E56B-C824-43B1-9FEA-
> ....
> > What appears to be broken is the reboot process that is supposed
> > to put in the system files that are in use during the update.
>
>
> What is often thought in that case is that a user's security programs
> if not disabled may be interfering with the renaming procedure.
>
> Did you have your security programs disabled over the reboot
> (or try rebooting in safe mode which would also probably prevent such
> potential interference)?
>
>
> ---
>
>
>
> > Well, I seem to be the only one posting to my question.
> >
> > Have done much more investigation and have discovered a resolution to the
> > Microsoft Update problem and will probably need to take this to another forum
> > for further discussion.
> >
> > What I determined is that Microsoft Update is working just fine. What
> > appears to be broken is the reboot process that is supposed to put in the
> > system files that are in use during the update.
> >
> > How did I determine this.... I looked at the KBxxxxxx.log files that are in
> > the Windows directory. In those near the end of the log, there is mention of
> > files that are (delayed) and they have names like SETx.tmp. If you check the
> > properties of the tmp files, you will notice that they directly correlate to
> > those files (delayed).
> >
> > To FIX the symptoms of problem, I booted to Windows PE, renamed all the DLLs
> > that I wrote down to .tmp and then renamed each file named SETx.tmp to the
> > appropriate DLL name. The versions of the SETx.tmp files are those
> > referenced in the KB article.
> >
> > This resulted in a MUCH more stable and functional OS. I carried it further
> > to other tmp files I located in Windows\system32\usmt
> >
> > It is interesting to note that the creation of the SETx.tmp files are always
> > created with a unique name. If you try and install the update over and
> > over....... you get an additional copy of the files that are not installed.
> > Consequently you really start using up the storage space on the drive with
> > multiple copies with different names. In my case, there was 260 MB of tmp
> > files created.
> >
> > --
> > MD
> >
> >
> > "Mark D" wrote:
> >
> >> Forgot to include the list of updates.
> >>
> >> There was 6 on Friday, but somehow I have reduced it to 5... accidentally
> >>
> >> Cumulative Security update for Internet Explorer for Windows XP (KB896688)
> >> Security update for Windows XP(KB896424)
> >> Security update for Windows XP(KB900725)
> >> Security update for Windows XP(KB902400)
> >> Security update for Windows XP(KB905749)
> >>
> >> Security update for Windows XP(KB905414) Seems to have gone away finally.
> >> --
> >> MD
> >>
> >>
> >> "Mark D" wrote:
> >>
> >> > I have 5 critical updates that do not seem to get installed properly. I have
> >> > tried one at a time, in numeric order, downloading and installing in safe
> >> > mode...
> >> >
> >> > I don't get any errors, I get success messages for installs. Then when I
> >> > return the the update site or when the Automatic Update notification pops up,
> >> > the same 5 updates are there...
> >> >
> >> > I have reset the Automatic Updates forlder by stopping the service and
> >> > removing the directory.
> >> >
> >> > Nothing seems to work. I have Adaware, Spybot, and Spyblaster spyware
> >> > scanners running as well as McAfee Antivirus 8i. I have even scanned online
> >> > using Trend Micro's online scanner. Can't find any significant issues with
> >> > spyware or virus'.
> >> >
> >> > I do get explorer.exe crashing after a reboot because it attempt to access
> >> > restricted memory. DEP seems to be configured correctly. After the crash, I
> >> > log off and on and usually everything works just fine.
> >> >
> >> > Any suggestions welcome.
> >> > --
> >> > MD
>
>
>

"Mark D" <> wrote in message
news:6A0255B5-85A1-44E0-91AF-...
> Thanks for responding.
>
> I booted into safe mode to do each installation one at a time following up
> with safe mode to complete the installation. Did not help.
>
> The only thing I can think of doing is removing the spyware programs and
> trying again.


Of course! If you had such Trojans active anything might be happening.


>
> Having installed the patches and then renaming the appropriate files via
> Windows PE, the system is working fine right now. Still scratching my head
> as to why the rename process doesn't function. Just looking for additonal
> information that might help me determine what is broken or where to look.


My next suggestion would be to use RegMon to see what is happening
with those renames. I'm not totally clear about the implementation but
I think that they get written to value PendingFileRenameOperations.
A simpler alternative I suppose would be just finding and inspecting
that value before doing the forced reboot. That way you would know
at least that they were all being listed there. After the boot you would
probably see that the value was empty or gone.

Checking what happens to that value during the boot is much harder.
One possibility would be to use RegMon's Log Boot option.
Another possibility I am even less familiar with would be setting up
an audit on the key where the PendingFileRenameOperations value
gets written. (I'm not even sure what all information that would capture.
If nothing else it would probably give you some timestamped records
for proof that something was happening with it.)


Good luck

Robert
---