Error 0x800704DD and kb910341

XP-Home Sp2 IE7
I do have all times the error message: 0x800704DD.

IE7 resetted to standard, no virus etc. found (different progs).
ZoneAlarm deinstalled totally (including registry)
Now i found this:
Error messages that you may receive when you try to download and install
updates from the Windows Update Web site, from the Microsoft Update Web
site, or from a WSUS server: "0x800704DD," "0x80240020," or both:
http://support.microsoft.com/kb/910341

it says in B step 2:
Expand the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\SensLogn
On my system in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\
i only have \crypt32chain and \cryptnet but no folder \Senslogn

But there is another Folder :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify_disabled
containing ...\Senslogn and al the items mentioned in kb910341.

Is this wrong and maybe the reason for the error 0x800704DD and what can i
do to fix the problem??
I dont feel happy to reinstall my system (takes about 2 weeks....:-((( )
Thanks for any help

Remi

Remi wrote:

> XP-Home Sp2 IE7
> I do have all times the error message: 0x800704DD.
>
> IE7 resetted to standard, no virus etc. found (different progs).
> ZoneAlarm deinstalled totally (including registry)
> Now i found this:
> Error messages that you may receive when you try to download and install
> updates from the Windows Update Web site, from the Microsoft Update Web
> site, or from a WSUS server: "0x800704DD," "0x80240020," or both:
> http://support.microsoft.com/kb/910341
>
> it says in B step 2:
> Expand the following registry subkey:
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify\SensLogn
> On my system in
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify\
> i only have \crypt32chain and \cryptnet but no folder \Senslogn
>
> But there is another Folder :
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify_disabled
> containing ...\Senslogn and al the items mentioned in kb910341.
>
> Is this wrong and maybe the reason for the error 0x800704DD and what can i
> do to fix the problem??
> I dont feel happy to reinstall my system (takes about 2 weeks....:-((( )
> Thanks for any help
>
> Remi
>
>
>
Apparently, that's what is causing the error message. Question is, how
did they get moved to Notify_disabled ?

You can open compare the keys in Notify_disabled to the keys from my XP
Pro box and see if they're the same:

"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

If they match, what you could do is create a .reg file with the above
but *FIRST*, export the keys in Notify_disabled by right clicking it and
choosing Export. Save them to the Desktop as Notify_disabled.

Next, open Notepad. Copy and paste ALL of the below into it making sure
that Windows Registry Editor Version 5.00 is at the very top:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

Then click File > Save as > and set the " Save as type: " to All Files.
Name it SensLogn.reg
Now click Save.
Close Notepad.

Delete Notify_disabled now. You still have a backup of it on the
Desktop, just in case <w>

*Right* click SensLogn.reg and choose Merge.
Restart the system and see if it can update now.

MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============

Chances are that you're seeing the affects of a hijackware infection (cf.
http://aumha.net/viewtopic.php?f=48&t=37919).

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/ma...e/default.mspx

2. Run this online scan (in safe mode w/networking, if need be):
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run additional checks for hijackware, including posting your hijackthis
log to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://spywarehammer.com/simplemachi...php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or another appropriate forum for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/de...spx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Remi wrote:
> XP-Home Sp2 IE7
> I do have all times the error message: 0x800704DD.
>
> IE7 resetted to standard, no virus etc. found (different progs).
> ZoneAlarm deinstalled totally (including registry)
> Now i found this:
> Error messages that you may receive when you try to download and install
> updates from the Windows Update Web site, from the Microsoft Update Web
> site, or from a WSUS server: "0x800704DD," "0x80240020," or both:
> http://support.microsoft.com/kb/910341
>
> it says in B step 2:
> Expand the following registry subkey:
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify\SensLogn
> On my system in
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify\
> i only have \crypt32chain and \cryptnet but no folder \Senslogn
>
> But there is another Folder :
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify_disabled
> containing ...\Senslogn and al the items mentioned in kb910341.
>
> Is this wrong and maybe the reason for the error 0x800704DD and what can
> i
> do to fix the problem??
> I dont feel happy to reinstall my system (takes about 2 weeks....:-((( )
> Thanks for any help
>
> Remi

Hello and thank you for your help!

> Apparently, that's what is causing the error message. Question is, how did
> they get moved to Notify_disabled ?

No idea how Notify_disabled came in there...

> You can open compare the keys in Notify_disabled to the keys from my XP
> Pro box and see if they're the same:
They are the same

> choosing Export. Save them to the Desktop as Notify_disabled.
ok.

> Next, open Notepad. Copy and paste ALL of the below into it making sure
> ....
> Then click File > Save as > and set the " Save as type: " to All Files.
> Name it SensLogn.reg
> Now click Save.
>..
> Delete Notify_disabled now. You still have a backup of it on the Desktop,
> just in case <w>
>
> *Right* click SensLogn.reg and choose Merge.
If i understand correctly i merge SensLogn into \Notify\
but what happens with the other (x) folders in Notify_Disabled ??:
(x)-crypt32chain
(x)-cryptnet
(x)-cscdll
(x)-ScCertProp
(x)-Schedule
(x)-sclgntfy
-SensLogn
(x)-termserv
(x)-wlballoon

Do i see it correct saying; export Notify_Disabled to the desktop as
Notify_Disabled.reg and make a security-copy of it.
Open Notify_Disabled.reg with Notepad and change all \Notify_Disabled to
\Notify
Save changes
Rename Notify_Disabled.reg in Notify.reg
Delete Notify_Disabled (registry)
Merge Notify.reg
Restart and wonder :-))

Remi

Merge SensLogn.reg
*Delete* 'Notify_disabled' by right clicking it and choosing Delete.
Restart.

There is no need to Edit 'Notify_disabled' if the Value Names and Value
Data match the ones in 'Notify_disabled', which you said they do.
And, it's safely backed up, just in case.

I'm not so sure that malware caused this issue as ZoneAlarm may have set
those subkeys to force WU to go through it rather then access WU without
bypassing ZA. The correct settings may have been included in ZA's reg
entries.


MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============



Remi wrote:

> Hello and thank you for your help!
>
>
>>Apparently, that's what is causing the error message. Question is, how did
>>they get moved to Notify_disabled ?
>
>
> No idea how Notify_disabled came in there...
>
>
>>You can open compare the keys in Notify_disabled to the keys from my XP
>>Pro box and see if they're the same:
>
> They are the same
>
>
>>choosing Export. Save them to the Desktop as Notify_disabled.
>
> ok.
>
>
>>Next, open Notepad. Copy and paste ALL of the below into it making sure
>>....
>>Then click File > Save as > and set the " Save as type: " to All Files.
>>Name it SensLogn.reg
>>Now click Save.
>>..
>>Delete Notify_disabled now. You still have a backup of it on the Desktop,
>>just in case <w>
>>
>>*Right* click SensLogn.reg and choose Merge.
>
> If i understand correctly i merge SensLogn into \Notify\
> but what happens with the other (x) folders in Notify_Disabled ??:
> (x)-crypt32chain
> (x)-cryptnet
> (x)-cscdll
> (x)-ScCertProp
> (x)-Schedule
> (x)-sclgntfy
> -SensLogn
> (x)-termserv
> (x)-wlballoon
>
> Do i see it correct saying; export Notify_Disabled to the desktop as
> Notify_Disabled.reg and make a security-copy of it.
> Open Notify_Disabled.reg with Notepad and change all \Notify_Disabled to
> \Notify
> Save changes
> Rename Notify_Disabled.reg in Notify.reg
> Delete Notify_Disabled (registry)
> Merge Notify.reg
> Restart and wonder :-))
>
> Remi
>
>

CORRECTION: There is no need to Edit the subkeys in 'Notify_disabled' if
the Value Names and Value Data match the ones in 'SensLogn' from my
system, which you said they do.


MowGreen [MVP] wrote:

> Merge SensLogn.reg
> *Delete* 'Notify_disabled' by right clicking it and choosing Delete.
> Restart.
>
> There is no need to Edit 'Notify_disabled' if the Value Names and Value
> Data match the ones in 'Notify_disabled', which you said they do.
> And, it's safely backed up, just in case.
>
> I'm not so sure that malware caused this issue as ZoneAlarm may have set
> those subkeys to force WU to go through it rather then access WU without
> bypassing ZA. The correct settings may have been included in ZA's reg
> entries.
>
>
> MowGreen [MVP 2003-2009]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
>
> Remi wrote:
>
>> Hello and thank you for your help!
>>
>>
>>> Apparently, that's what is causing the error message. Question is,
>>> how did they get moved to Notify_disabled ?
>>
>>
>>
>> No idea how Notify_disabled came in there...
>>
>>
>>> You can open compare the keys in Notify_disabled to the keys from my
>>> XP Pro box and see if they're the same:
>>
>>
>> They are the same
>>
>>
>>> choosing Export. Save them to the Desktop as Notify_disabled.
>>
>>
>> ok.
>>
>>
>>> Next, open Notepad. Copy and paste ALL of the below into it making
>>> sure ....
>>> Then click File > Save as > and set the " Save as type: " to All Files.
>>> Name it SensLogn.reg
>>> Now click Save.
>>> ..
>>> Delete Notify_disabled now. You still have a backup of it on the
>>> Desktop, just in case <w>
>>>
>>> *Right* click SensLogn.reg and choose Merge.
>>
>>
>> If i understand correctly i merge SensLogn into \Notify\
>> but what happens with the other (x) folders in Notify_Disabled ??:
>> (x)-crypt32chain
>> (x)-cryptnet
>> (x)-cscdll
>> (x)-ScCertProp
>> (x)-Schedule
>> (x)-sclgntfy
>> -SensLogn
>> (x)-termserv
>> (x)-wlballoon
>>
>> Do i see it correct saying; export Notify_Disabled to the desktop as
>> Notify_Disabled.reg and make a security-copy of it.
>> Open Notify_Disabled.reg with Notepad and change all \Notify_Disabled
>> to \Notify
>> Save changes
>> Rename Notify_Disabled.reg in Notify.reg
>> Delete Notify_Disabled (registry)
>> Merge Notify.reg
>> Restart and wonder :-))
>>
>> Remi
>>
>>

Hi "MowGreen".

I am very sorry but i am afraid i dont understand :-((.
In 'Notify' i only have two folders
-crypt32chain
-cryptnet

in 'Notify_disabled' i have the folders
-crypt32chain (same Value Data as in 'Notify')
-cryptnet (same Value Data as in 'Notify')
-cscdll
-ScCertProp
-Schedule
-sclgntfy
-SensLogn (Value Names and Value Data are o.k.)
-termserv
-wlballoon

after Merging SensLogn.reg i will have in 'Notify' the folders
-crypt32chain
-cryptnet and
-SensLogn

But what about those folders in 'Notify_disabled'
-cscdll
-ScCertProp
-Schedule
-sclgntfy
-termserv
-wlballoon
do i not need them in 'Notify' ???

Sorry, i hope not to waste your time to much with my stupid questions
(and my horrible english)

Remi


> MowGreen [MVP] wrote:

> CORRECTION: There is no need to Edit the subkeys in 'Notify_disabled' if
> the Value Names and Value Data match the ones in 'SensLogn' from my
> system, which you said they do.
>
>> Merge SensLogn.reg
>> *Delete* 'Notify_disabled' by right clicking it and choosing Delete.
>> Restart.
>>
>> There is no need to Edit 'Notify_disabled' if the Value Names and Value
>> Data match the ones in 'Notify_disabled', which you said they do.
>> And, it's safely backed up, just in case.
>>
>> I'm not so sure that malware caused this issue as ZoneAlarm may have set
>> those subkeys to force WU to go through it rather then access WU without
>> bypassing ZA. The correct settings may have been included in ZA's reg
>> entries.
>>
>>
>> MowGreen [MVP 2003-2009]
>> ===============
>> *-343-* FDNY
>> Never Forgotten
>> ===============
>>
>>
>>
>> Remi wrote:
>>
>>> Do i see it correct saying; export Notify_Disabled to the desktop as
>>> Notify_Disabled.reg and make a security-copy of it.
>>> Open Notify_Disabled.reg with Notepad and change all \Notify_Disabled to
>>> \Notify
>>> Save changes
>>> Rename Notify_Disabled.reg in Notify.reg
>>> Delete Notify_Disabled (registry)
>>> Merge Notify.reg
>>> Restart and wonder :-))

Hi "MowGreen".

I am very sorry but i am afraid i dont understand :-((.
In 'Notify' i only have two folders
-crypt32chain
-cryptnet

in 'Notify_disabled' i have the folders
-crypt32chain (same Value Data as in 'Notify')
-cryptnet (same Value Data as in 'Notify')
-cscdll
-ScCertProp
-Schedule
-sclgntfy
-SensLogn (Value Names and Value Data are o.k.)
-termserv
-wlballoon

after Merging SensLogn.reg i will have in 'Notify' the folders
-crypt32chain
-cryptnet and
-SensLogn

But what about those folders in 'Notify_disabled'
-cscdll
-ScCertProp
-Schedule
-sclgntfy
-termserv
-wlballoon
do i not need them in 'Notify' ???

Sorry, i hope not to waste your time to much with my stupid questions
(and my horrible english)

Remi


> MowGreen [MVP] wrote:

> CORRECTION: There is no need to Edit the subkeys in 'Notify_disabled' if
> the Value Names and Value Data match the ones in 'SensLogn' from my
> system, which you said they do.
>
>> Merge SensLogn.reg
>> *Delete* 'Notify_disabled' by right clicking it and choosing Delete.
>> Restart.
>>
>> There is no need to Edit 'Notify_disabled' if the Value Names and Value
>> Data match the ones in 'Notify_disabled', which you said they do.
>> And, it's safely backed up, just in case.
>>
>> I'm not so sure that malware caused this issue as ZoneAlarm may have set
>> those subkeys to force WU to go through it rather then access WU without
>> bypassing ZA. The correct settings may have been included in ZA's reg
>> entries.
>>
>>
>> MowGreen [MVP 2003-2009]
>> ===============
>> *-343-* FDNY
>> Never Forgotten
>> ===============
>>
>>
>>
>> Remi wrote:
>>
>>> Do i see it correct saying; export Notify_Disabled to the desktop as
>>> Notify_Disabled.reg and make a security-copy of it.
>>> Open Notify_Disabled.reg with Notepad and change all \Notify_Disabled to
>>> \Notify
>>> Save changes
>>> Rename Notify_Disabled.reg in Notify.reg
>>> Delete Notify_Disabled (registry)
>>> Merge Notify.reg
>>> Restart and wonder :-))

Hello "MowGreen".

Many many thanks for your help.
I took the risk and....it works fine.
what i did:
created a system recovery point

with regedit
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify_Disabled\Senslog n
controlled the keys in \Senslogn

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify
export "Notify" to the desktop as SafeNotify.reg

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify_Disabled
export "Notify_Disabled" to the desktop as Notify_Disabled.reg
make a security-copy of it (you never know).

with Notepad
open desktop Notify_Disabled.reg
replace all \Notify_Disabled to \Notify
Save changes by closing notepad

with regedit
select and delete Notify_Disabled

select desktop Notify_Disabled.reg
right click and Merge

with regedit
actualise and control if
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify
has all folders, keys and values
close regedit

Restart system, start WU
I got connected without error 0x800704DD !!!
After several downloads/changes like GDI...., validation... , installing
KB´s???.. etc. everything was working fine and i have back al functions of
WU and also MU.
I now can start cleaning up my system and will be very carefull BEFORE
installing "helpfull tools"

Have a nice time and thanks again

Remi

You're very, very welcome. Nice going, Remi. You took enough precautions
prior to fixing 'things' so that you could recover from any mistake.
Smart move !!

Sorry I've been tardy in replying but I've been playing with Windows 7
and got way too deep into it.
You did a fine job here. BUT, I'm still perplexed as to why the SensLogn
subkeys were Disabled. If it was caused by ZoneAlarm, or the uninstall
of it, then that's some really bad coding.
Suggest you do an online scan for malware so that we can completely rule
it out. Use Internet Explorer and go here:
http://onecare.live.com/site/en-us/center/howsafe.htm

The scan will take some time to complete but it's worth the wait. <w>

MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============


Remi wrote:

> Hello "MowGreen".
>
> Many many thanks for your help.
> I took the risk and....it works fine.
> what i did:
> created a system recovery point
>
> with regedit
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify_Disabled\Senslog n
> controlled the keys in \Senslogn
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify
> export "Notify" to the desktop as SafeNotify.reg
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify_Disabled
> export "Notify_Disabled" to the desktop as Notify_Disabled.reg
> make a security-copy of it (you never know).
>
> with Notepad
> open desktop Notify_Disabled.reg
> replace all \Notify_Disabled to \Notify
> Save changes by closing notepad
>
> with regedit
> select and delete Notify_Disabled
>
> select desktop Notify_Disabled.reg
> right click and Merge
>
> with regedit
> actualise and control if
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon\Notify
> has all folders, keys and values
> close regedit
>
> Restart system, start WU
> I got connected without error 0x800704DD !!!
> After several downloads/changes like GDI...., validation... , installing
> KB´s???.. etc. everything was working fine and i have back al functions of
> WU and also MU.
> I now can start cleaning up my system and will be very carefull BEFORE
> installing "helpfull tools"
>
> Have a nice time and thanks again
>
> Remi
>
>