CAPICOM KB931906 - Continuously queued to install.

I've read several posts on this and have yet to see a reason/solution for the
issue. I have a workstation that WSUS contiuous to queue KB931906. Add/Remove
Programs list this update as being installed. Also, the WindowsUpdate.log
file indicates a successful install, followed shortly by a redetection of the
need to install the update. I can include the WindowsUpdate.log file for
reference if needed.

Any new ideas? I don't believe malware is at the root of this.

From : http://www.microsoft.com/technet/sec.../ms07-028.mspx

> General Information

> Security Update Information
> CAPICOM and BizTalk Server 2004

> File Name Version Date Time Size
>
> License.mht NA 26-Feb-2007 23:16 142,534
>
> License.rtf NA 26-Feb-2007 23:16 134,577
>
> CAPICOM.dll 2.1.0.2 11-Apr-2007 18:11 511,328


> Verifying that the Update Has Been Applied
> • File Version Verification
>
> Note Because there are several versions of Microsoft Windows, the following steps may be
> different on your computer. If they are, see your product documentation to complete these
> steps.
>
> 1. Click Start, and then click Search.
>
> 2. In the Search Results pane, click All files and folders under Search Companion.
>
> 3. In the All or part of the file name box, type a file name from the appropriate file
> information table, and then click Search.
>
> 4. In the list of files, right-click a file name from the appropriate file information
> table, and then click Properties.
>
> Note Depending on the version of the operating system or programs installed, some of the
> files that are listed in the file information table may not be installed.
>
> 5. On the Version tab, determine the version of the file that is installed on your
> computer by comparing it to the version that is documented in the appropriate file
> information table.
>
> Note Attributes other than the file version may change during installation. Comparing
> other file attributes to the information in the file information table is not a supported
> method of verifying that the update has been applied. Also, in certain cases, files may be
> renamed during installation. If the file or version information is not present, use one of
> the other available methods to verify update installation.

> • Registry Key Verification
>
> You may also be able to verify the files that this security update has installed by
> reviewing the following registry key:
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CAPICOM.Certif icates.4\CLSID

Check the file and registry key verification, please.

IF they are correct then there is a detection issue.

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============



chief123 wrote:

> I've read several posts on this and have yet to see a reason/solution for the
> issue. I have a workstation that WSUS contiuous to queue KB931906. Add/Remove
> Programs list this update as being installed. Also, the WindowsUpdate.log
> file indicates a successful install, followed shortly by a redetection of the
> need to install the update. I can include the WindowsUpdate.log file for
> reference if needed.
>
> Any new ideas? I don't believe malware is at the root of this.

I will give this a try and post back. Thanks for the response.

"MowGreen [MVP]" wrote:

> From : http://www.microsoft.com/technet/sec.../ms07-028.mspx
>
> > General Information
>
> > Security Update Information
> > CAPICOM and BizTalk Server 2004
>
> > File Name Version Date Time Size
> >
> > License.mht NA 26-Feb-2007 23:16 142,534
> >
> > License.rtf NA 26-Feb-2007 23:16 134,577
> >
> > CAPICOM.dll 2.1.0.2 11-Apr-2007 18:11 511,328
>
>
> > Verifying that the Update Has Been Applied
> > • File Version Verification
> >
> > Note Because there are several versions of Microsoft Windows, the following steps may be
> > different on your computer. If they are, see your product documentation to complete these
> > steps.
> >
> > 1. Click Start, and then click Search.
> >
> > 2. In the Search Results pane, click All files and folders under Search Companion.
> >
> > 3. In the All or part of the file name box, type a file name from the appropriate file
> > information table, and then click Search.
> >
> > 4. In the list of files, right-click a file name from the appropriate file information
> > table, and then click Properties.
> >
> > Note Depending on the version of the operating system or programs installed, some of the
> > files that are listed in the file information table may not be installed.
> >
> > 5. On the Version tab, determine the version of the file that is installed on your
> > computer by comparing it to the version that is documented in the appropriate file
> > information table.
> >
> > Note Attributes other than the file version may change during installation. Comparing
> > other file attributes to the information in the file information table is not a supported
> > method of verifying that the update has been applied. Also, in certain cases, files may be
> > renamed during installation. If the file or version information is not present, use one of
> > the other available methods to verify update installation.
>
> > • Registry Key Verification
> >
> > You may also be able to verify the files that this security update has installed by
> > reviewing the following registry key:
> >
> > HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CAPICOM.Certif icates.4\CLSID
>
> Check the file and registry key verification, please.
>
> IF they are correct then there is a detection issue.
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
>
> chief123 wrote:
>
> > I've read several posts on this and have yet to see a reason/solution for the
> > issue. I have a workstation that WSUS contiuous to queue KB931906. Add/Remove
> > Programs list this update as being installed. Also, the WindowsUpdate.log
> > file indicates a successful install, followed shortly by a redetection of the
> > need to install the update. I can include the WindowsUpdate.log file for
> > reference if needed.
> >
> > Any new ideas? I don't believe malware is at the root of this.
>

The file versions seem to check out; however, the registry shows either
HKLM\software\classes\capicom.certificates -OR- capicom.certificates.1 -OR-
capicom.certificates.2. There are no entries for a capicom.certicates.4.

Also, I found a second copy of capicom.dll on this workstation. It is part
of the HP System Diags installed by the HP printer software.. I think. Could
this be causing the update issue?

"MowGreen [MVP]" wrote:

> From : http://www.microsoft.com/technet/sec.../ms07-028.mspx
>
> > General Information
>
> > Security Update Information
> > CAPICOM and BizTalk Server 2004
>
> > File Name Version Date Time Size
> >
> > License.mht NA 26-Feb-2007 23:16 142,534
> >
> > License.rtf NA 26-Feb-2007 23:16 134,577
> >
> > CAPICOM.dll 2.1.0.2 11-Apr-2007 18:11 511,328
>
>
> > Verifying that the Update Has Been Applied
> > • File Version Verification
> >
> > Note Because there are several versions of Microsoft Windows, the following steps may be
> > different on your computer. If they are, see your product documentation to complete these
> > steps.
> >
> > 1. Click Start, and then click Search.
> >
> > 2. In the Search Results pane, click All files and folders under Search Companion.
> >
> > 3. In the All or part of the file name box, type a file name from the appropriate file
> > information table, and then click Search.
> >
> > 4. In the list of files, right-click a file name from the appropriate file information
> > table, and then click Properties.
> >
> > Note Depending on the version of the operating system or programs installed, some of the
> > files that are listed in the file information table may not be installed.
> >
> > 5. On the Version tab, determine the version of the file that is installed on your
> > computer by comparing it to the version that is documented in the appropriate file
> > information table.
> >
> > Note Attributes other than the file version may change during installation. Comparing
> > other file attributes to the information in the file information table is not a supported
> > method of verifying that the update has been applied. Also, in certain cases, files may be
> > renamed during installation. If the file or version information is not present, use one of
> > the other available methods to verify update installation.
>
> > • Registry Key Verification
> >
> > You may also be able to verify the files that this security update has installed by
> > reviewing the following registry key:
> >
> > HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CAPICOM.Certif icates.4\CLSID
>
> Check the file and registry key verification, please.
>
> IF they are correct then there is a detection issue.
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
>
> chief123 wrote:
>
> > I've read several posts on this and have yet to see a reason/solution for the
> > issue. I have a workstation that WSUS contiuous to queue KB931906. Add/Remove
> > Programs list this update as being installed. Also, the WindowsUpdate.log
> > file indicates a successful install, followed shortly by a redetection of the
> > need to install the update. I can include the WindowsUpdate.log file for
> > reference if needed.
> >
> > Any new ideas? I don't believe malware is at the root of this.
>

chief123 wrote:

> The file versions seem to check out; however, the registry shows either
> HKLM\software\classes\capicom.certificates -OR- capicom.certificates.1 -OR-
> capicom.certificates.2. There are no entries for a capicom.certicates.4.
>
> Also, I found a second copy of capicom.dll on this workstation. It is part
> of the HP System Diags installed by the HP printer software.. I think. Could
> this be causing the update issue?
>

That could very well be why the update is being redected as needed and
why capicom.certificates.4 is missing from the registry. Is the other
capicom.dll the same Version as the one in the update or at lesser V. ?
Perhaps HP offers a later or updated version of System Diags.
This wouldn't be the first time that some bloated HP software has caused
a redection or installation issue with an update, chief123.

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============

The HP version of CAPICOM is located at C:\Program
Files\Hewlett-Packard\eSupportDiags. I believe it is part of the HP All in
ONe software. He has a HP 6210 All-In-One. I ran the HP Update Software app
but no new software was queued up. The version of CAPICOM is 2.0.0.3.

"MowGreen [MVP]" wrote:

> chief123 wrote:
>
> > The file versions seem to check out; however, the registry shows either
> > HKLM\software\classes\capicom.certificates -OR- capicom.certificates.1 -OR-
> > capicom.certificates.2. There are no entries for a capicom.certicates.4.
> >
> > Also, I found a second copy of capicom.dll on this workstation. It is part
> > of the HP System Diags installed by the HP printer software.. I think. Could
> > this be causing the update issue?
> >
>
> That could very well be why the update is being redected as needed and
> why capicom.certificates.4 is missing from the registry. Is the other
> capicom.dll the same Version as the one in the update or at lesser V. ?
> Perhaps HP offers a later or updated version of System Diags.
> This wouldn't be the first time that some bloated HP software has caused
> a redection or installation issue with an update, chief123.
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
>
>

BTW - The "up to date" version of CAPICOM is located at C:\Program
Files\Microsoft CAPICOM 2.1.0.2\Lib\x86 on the workstation in question.


"chief123" wrote:

> The HP version of CAPICOM is located at C:\Program
> Files\Hewlett-Packard\eSupportDiags. I believe it is part of the HP All in
> ONe software. He has a HP 6210 All-In-One. I ran the HP Update Software app
> but no new software was queued up. The version of CAPICOM is 2.0.0.3.
>
> "MowGreen [MVP]" wrote:
>
> > chief123 wrote:
> >
> > > The file versions seem to check out; however, the registry shows either
> > > HKLM\software\classes\capicom.certificates -OR- capicom.certificates.1 -OR-
> > > capicom.certificates.2. There are no entries for a capicom.certicates.4.
> > >
> > > Also, I found a second copy of capicom.dll on this workstation. It is part
> > > of the HP System Diags installed by the HP printer software.. I think. Could
> > > this be causing the update issue?
> > >
> >
> > That could very well be why the update is being redected as needed and
> > why capicom.certificates.4 is missing from the registry. Is the other
> > capicom.dll the same Version as the one in the update or at lesser V. ?
> > Perhaps HP offers a later or updated version of System Diags.
> > This wouldn't be the first time that some bloated HP software has caused
> > a redection or installation issue with an update, chief123.
> >
> > MowGreen [MVP 2003-2007]
> > ===============
> > *-343-* FDNY
> > Never Forgotten
> > ===============
> >
> >
> >
> >

From the security bulletin:
http://www.microsoft.com/technet/sec.../ms07-028.mspx

> Prerequisites
> This security update requires that CAPICOM Certificates is installed and registered.
> BizTalk Server 2004 installs CAPICOM Certificates. This update will work for both
> standalone and BizTalk Server 2004 installations. ** Non-Microsoft products can redistribute
> and install CAPICOM.dll **. Refer to the FAQ “How do I know if I have Capicom.Certificates
> installed and registered?� for further details.

I find no such information in the FAQ. Not sure what the result would be
but, you could attempt replacing the older, vulnerable capicom.dll with
the updated one and hope it doesn't cause an issue with HP's Sys Diags.
Or, better yet, contact PSS for free support with this issue as it is a
Critical security update:
> Customers in the U.S. and Canada can receive technical support from Microsoft Product
> Support Services at 1-866-PCSAFETY. There is no charge for support calls that are
> associated with security updates.


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============



chief123 wrote:
> BTW - The "up to date" version of CAPICOM is located at C:\Program
> Files\Microsoft CAPICOM 2.1.0.2\Lib\x86 on the workstation in question.
>
>
> "chief123" wrote:
>
>
>>The HP version of CAPICOM is located at C:\Program
>>Files\Hewlett-Packard\eSupportDiags. I believe it is part of the HP All in
>>ONe software. He has a HP 6210 All-In-One. I ran the HP Update Software app
>>but no new software was queued up. The version of CAPICOM is 2.0.0.3.
>>
>>"MowGreen [MVP]" wrote:
>>
>>
>>>chief123 wrote:
>>>
>>>
>>>>The file versions seem to check out; however, the registry shows either
>>>>HKLM\software\classes\capicom.certificates -OR- capicom.certificates.1 -OR-
>>>>capicom.certificates.2. There are no entries for a capicom.certicates.4.
>>>>
>>>>Also, I found a second copy of capicom.dll on this workstation. It is part
>>>>of the HP System Diags installed by the HP printer software.. I think. Could
>>>>this be causing the update issue?
>>>>
>>>
>>>That could very well be why the update is being redected as needed and
>>>why capicom.certificates.4 is missing from the registry. Is the other
>>>capicom.dll the same Version as the one in the update or at lesser V. ?
>>>Perhaps HP offers a later or updated version of System Diags.
>>>This wouldn't be the first time that some bloated HP software has caused
>>>a redection or installation issue with an update, chief123.
>>>
>>>MowGreen [MVP 2003-2007]
>>>===============
>>> *-343-* FDNY
>>>Never Forgotten
>>>===============
>>>
>>>
>>>
>>>

I thought of that earlier when I was remoting into the computer in question.
I try replacing the out of date CAPICOM.DLL. Thanks for the help. I will post
a result.

"MowGreen [MVP]" wrote:

> From the security bulletin:
> http://www.microsoft.com/technet/sec.../ms07-028.mspx
>
> > Prerequisites
> > This security update requires that CAPICOM Certificates is installed and registered.
> > BizTalk Server 2004 installs CAPICOM Certificates. This update will work for both
> > standalone and BizTalk Server 2004 installations. ** Non-Microsoft products can redistribute
> > and install CAPICOM.dll **. Refer to the FAQ “How do I know if I have Capicom.Certificates
> > installed and registered?� for further details.
>
> I find no such information in the FAQ. Not sure what the result would be
> but, you could attempt replacing the older, vulnerable capicom.dll with
> the updated one and hope it doesn't cause an issue with HP's Sys Diags.
> Or, better yet, contact PSS for free support with this issue as it is a
> Critical security update:
> > Customers in the U.S. and Canada can receive technical support from Microsoft Product
> > Support Services at 1-866-PCSAFETY. There is no charge for support calls that are
> > associated with security updates.
>
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
>
> chief123 wrote:
> > BTW - The "up to date" version of CAPICOM is located at C:\Program
> > Files\Microsoft CAPICOM 2.1.0.2\Lib\x86 on the workstation in question.
> >
> >
> > "chief123" wrote:
> >
> >
> >>The HP version of CAPICOM is located at C:\Program
> >>Files\Hewlett-Packard\eSupportDiags. I believe it is part of the HP All in
> >>ONe software. He has a HP 6210 All-In-One. I ran the HP Update Software app
> >>but no new software was queued up. The version of CAPICOM is 2.0.0.3.
> >>
> >>"MowGreen [MVP]" wrote:
> >>
> >>
> >>>chief123 wrote:
> >>>
> >>>
> >>>>The file versions seem to check out; however, the registry shows either
> >>>>HKLM\software\classes\capicom.certificates -OR- capicom.certificates.1 -OR-
> >>>>capicom.certificates.2. There are no entries for a capicom.certicates.4.
> >>>>
> >>>>Also, I found a second copy of capicom.dll on this workstation. It is part
> >>>>of the HP System Diags installed by the HP printer software.. I think. Could
> >>>>this be causing the update issue?
> >>>>
> >>>
> >>>That could very well be why the update is being redected as needed and
> >>>why capicom.certificates.4 is missing from the registry. Is the other
> >>>capicom.dll the same Version as the one in the update or at lesser V. ?
> >>>Perhaps HP offers a later or updated version of System Diags.
> >>>This wouldn't be the first time that some bloated HP software has caused
> >>>a redection or installation issue with an update, chief123.
> >>>
> >>>MowGreen [MVP 2003-2007]
> >>>===============
> >>> *-343-* FDNY
> >>>Never Forgotten
> >>>===============
> >>>
> >>>
> >>>
> >>>
>

That didn't do it. I also tried the renaming of the
%windir%\softwaredistribution and WindowsUPdate.log procedure. Still queues
up. I even tried the following: msiexec.exe /fa capicom2.msi.

I noticed the KB931906.log is missing from the C:\windows directory. So,
even though Add/Remove programs has the update as being installed, it would
seem it is failing somewhere.

"chief123" wrote:

> I thought of that earlier when I was remoting into the computer in question.
> I try replacing the out of date CAPICOM.DLL. Thanks for the help. I will post
> a result.
>
> "MowGreen [MVP]" wrote:
>
> > From the security bulletin:
> > http://www.microsoft.com/technet/sec.../ms07-028.mspx
> >
> > > Prerequisites
> > > This security update requires that CAPICOM Certificates is installed and registered.
> > > BizTalk Server 2004 installs CAPICOM Certificates. This update will work for both
> > > standalone and BizTalk Server 2004 installations. ** Non-Microsoft products can redistribute
> > > and install CAPICOM.dll **. Refer to the FAQ “How do I know if I have Capicom.Certificates
> > > installed and registered?� for further details.
> >
> > I find no such information in the FAQ. Not sure what the result would be
> > but, you could attempt replacing the older, vulnerable capicom.dll with
> > the updated one and hope it doesn't cause an issue with HP's Sys Diags.
> > Or, better yet, contact PSS for free support with this issue as it is a
> > Critical security update:
> > > Customers in the U.S. and Canada can receive technical support from Microsoft Product
> > > Support Services at 1-866-PCSAFETY. There is no charge for support calls that are
> > > associated with security updates.
> >
> >
> > MowGreen [MVP 2003-2007]
> > ===============
> > *-343-* FDNY
> > Never Forgotten
> > ===============
> >
> >
> >
> > chief123 wrote:
> > > BTW - The "up to date" version of CAPICOM is located at C:\Program
> > > Files\Microsoft CAPICOM 2.1.0.2\Lib\x86 on the workstation in question.
> > >
> > >
> > > "chief123" wrote:
> > >
> > >
> > >>The HP version of CAPICOM is located at C:\Program
> > >>Files\Hewlett-Packard\eSupportDiags. I believe it is part of the HP All in
> > >>ONe software. He has a HP 6210 All-In-One. I ran the HP Update Software app
> > >>but no new software was queued up. The version of CAPICOM is 2.0.0.3.
> > >>
> > >>"MowGreen [MVP]" wrote:
> > >>
> > >>
> > >>>chief123 wrote:
> > >>>
> > >>>
> > >>>>The file versions seem to check out; however, the registry shows either
> > >>>>HKLM\software\classes\capicom.certificates -OR- capicom.certificates.1 -OR-
> > >>>>capicom.certificates.2. There are no entries for a capicom.certicates.4.
> > >>>>
> > >>>>Also, I found a second copy of capicom.dll on this workstation. It is part
> > >>>>of the HP System Diags installed by the HP printer software.. I think. Could
> > >>>>this be causing the update issue?
> > >>>>
> > >>>
> > >>>That could very well be why the update is being redected as needed and
> > >>>why capicom.certificates.4 is missing from the registry. Is the other
> > >>>capicom.dll the same Version as the one in the update or at lesser V. ?
> > >>>Perhaps HP offers a later or updated version of System Diags.
> > >>>This wouldn't be the first time that some bloated HP software has caused
> > >>>a redection or installation issue with an update, chief123.
> > >>>
> > >>>MowGreen [MVP 2003-2007]
> > >>>===============
> > >>> *-343-* FDNY
> > >>>Never Forgotten
> > >>>===============
> > >>>
> > >>>
> > >>>
> > >>>
> >