KB955759 installs fine, but is re-detected for installation

Microsoft Update keeps saying one of our XP Pro SP3 machines needs KB955759
installed. It installs successfully with no errors, but several minutes after
a reboot, the yellow alert is back to install it again. I've manually
downloaded the .exe and installed it with no errors as well. I've run
MicrosoftFixit50202.msi in normal and aggressive modes with no resolution.
Any tips?!

Aaron D. Priest wrote:

> Microsoft Update keeps saying one of our XP Pro SP3 machines needs KB955759
> installed. It installs successfully with no errors, but several minutes after
> a reboot, the yellow alert is back to install it again. I've manually
> downloaded the .exe and installed it with no errors as well. I've run
> MicrosoftFixit50202.msi in normal and aggressive modes with no resolution.
> Any tips?!

Aaron,

First try a clean boot of XP and see if the *manually* downloaded update
can install: http://support.microsoft.com/kb/310353


If no joy, please post the KB955759.log, located in WINDOWS.


MowGreen
===============
*-343-* FDNY
Never Forgotten
===============

banthecheck.com
"Security updates should *never* have *non-security content* prechecked"

Hide the d*** update. While it's security-related, it is NOT a criticial
security update. Instead of installing KB955759, just run the "unregister"
Fix It here: http://support.microsoft.com/kb/954157


Aaron D. Priest wrote:
> Microsoft Update keeps saying one of our XP Pro SP3 machines needs
> KB955759
> installed. It installs successfully with no errors, but several minutes
> after a reboot, the yellow alert is back to install it again. I've
> manually
> downloaded the .exe and installed it with no errors as well. I've run
> MicrosoftFixit50202.msi in normal and aggressive modes with no resolution.
> Any tips?!

Tried the clean boot tip, good idea, but didn't resolve it. I have K-Lite
installed if that matters. Here are the contents of KB955759.log:

[KB955759.log]
10.157:
================================================== ==============================
10.157: 2010/01/06 11:14:33.796 (local)
10.157:
C:\WINDOWS\SoftwareDistribution\Download\da7fee2d5 1e2e59bdd47cb9e03387bcc\update\update.exe (version 6.3.13.0)
10.157: Failed To Enable SE_SHUTDOWN_PRIVILEGE
10.157: Hotfix started with following command line: -q -z -er
/ParentInfo:4c761219d5f5b5498e2c4140abbca21b
10.172: In Function GetReleaseSet, line 1240, RegQueryValueEx failed with
error 0x2
11.985: In Function TestVolatileFlag, line 11825, RegOpenKeyEx failed with
error 0x2
11.985: In Function TestVolatileFlag, line 11857, RegOpenKeyEx failed with
error 0x2
11.985: DoInstallation: CleanPFR failed: 0x2
11.985: In Function GetReleaseSet, line 1240, RegQueryValueEx failed with
error 0x2
11.985: SetProductTypes: InfProductBuildType=BuildType.IP
12.000: SetAltOsLoaderPath: No section uses DirId 65701; done.
12.032: DoInstallation: FetchSourceURL for
c:\windows\softwaredistribution\download\da7fee2d5 1e2e59bdd47cb9e03387bcc\update\update_SP3GDR.inf failed
12.032: LoadFileQueues: UpdSpGetSourceFileLocation for halmacpi.dll failed:
0xe0000102
12.047: CreateUninstall = 0,Directory = C:\WINDOWS\$NtUninstallKB955759$
12.078: BuildCabinetManifest: update.url absent
12.078: Starting AnalyzeComponents
12.078: AnalyzePhaseZero used 0 ticks
12.078: No c:\windows\INF\updtblk.inf file.
12.094: OEM file scan used 16 ticks
12.313: AnalyzePhaseOne: used 235 ticks
12.313: AnalyzeComponents: Hotpatch analysis disabled; skipping.
12.313: AnalyzeComponents: Hotpatching is disabled.
12.313: FindFirstFile c:\windows\$hf_mig$\*.*
12.313: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target
file c:\windows\apppatch\aclayers.dll has branch sp3qfe which is greater than
branch for sp3gdr
12.328: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target
file c:\windows\system32\dllcache\aclayers.dll has branch sp3qfe which is
greater than branch for sp3gdr
12.328: AnalyzeForBranching used 15 ticks.
12.328: AnalyzeComponents: Branch sp3gdr is not applicable to target
workstation
12.328: AnalyzeComponents used 250 ticks
12.750: Inventory complete: ReturnStatus=61675, 718 ticks
12.750: Num Ticks for invent : 718
12.750: DoInstallation: Re-running Inventory.
12.750: LoadFileQueues: UpdSpGetSourceFileLocation for halmacpi.dll failed:
0xe0000102
12.750: BuildCabinetManifest: update.url absent
12.750: Starting AnalyzeComponents
12.750: AnalyzePhaseZero used 0 ticks
12.750: No c:\windows\INF\updtblk.inf file.
12.750: OEM file scan used 0 ticks
12.782: AnalyzePhaseOne: used 32 ticks
12.782: AnalyzeComponents: Hotpatch analysis disabled; skipping.
12.782: AnalyzeComponents: Hotpatching is disabled.
12.782: FindFirstFile c:\windows\$hf_mig$\*.*
12.782: AnalyzeForBranching used 0 ticks.
12.782: AnalyzePhaseTwo used 0 ticks
12.782: AnalyzePhaseThree used 0 ticks
12.782: AnalyzePhaseFive used 0 ticks
12.797: AnalyzePhaseSix used 15 ticks
12.797: AnalyzeComponents used 47 ticks
12.797: Downloading 0 files
12.797: bPatchMode = FALSE
12.797: Inventory complete: ReturnStatus=0, 47 ticks
12.797: Num Ticks for invent : 47
12.828: VerifyTargetFileSize: Unable to verify size as Source = NULL for
file c:\windows\inf\HFXA.tmp
12.828: Copied file: c:\windows\inf\branches.inf
12.828: Allocation size of drive C: is 4096 bytes, free space = 283229437952
bytes
12.828: Drive C: free 270108MB req: 5MB w/uninstall 0MB
12.828: CabinetBuild complete
12.828: Num Ticks for Cabinet build : 31
12.828: DynamicStrings section not defined or empty.
12.828: FileInUse:: Detection disabled.
13.828: LoadFileQueues: UpdSpGetSourceFileLocation for halmacpi.dll failed:
0xe0000102
13.844: System Restore Point set.
13.922: Copied file: C:\WINDOWS\system32\spmsg.dll
14.032: PFE2: Not avoiding Per File Exceptions.
14.125: DoInstallation: Installing assemblies with source root path:
c:\windows\softwaredistribution\download\da7fee2d5 1e2e59bdd47cb9e03387bcc\
14.125: Num Ticks for Copying files : 1297
14.125: Num Ticks for Reg update and deleting 0 size files : 0
14.125: Starting process: rundll32.exe apphelp.dll,ShimFlushCache
14.203: Return Code = 0
14.235: UpdateSpUpdSvcInf: Source [ProcessesToRunAfterReboot] section is
empty; nothing to do.
14.250: RebootNecessary = 0,WizardInput = 1 , DontReboot = 1, ForceRestart = 0

I ran MicrosoftFixit50326.msi and also removed any Indeo codecs that K-Lite
installed, but I'm still getting the same update notification. I finally just
told it not to notify me again on the two machines that now doing this so it
won't hassle the users, though that's a little unsettling to me. I'd rather
find the root cause why it keeps re-detecting.

Either a HotFix has previously been installed on this workstation, which
has switched the file to be replaced to the QFE branch, or the presence
of K-lite is 'fooling' the scan that determines the branch of the update

2.313: FindFirstFile c:\windows\$hf_mig$\*.*
12.313: AnalyzeForBranching: g_bRepeatInventory set to TRUE because
target file
c:\windows\apppatch\aclayers.dll has branch sp3qfe which is greater than
branch for sp3gdr

The log shows the update's Num Tick is way below what it should actually
be, the 0 byte .tmp files are never created, and the registry is not updated

14.125: Num Ticks for Copying files : 1297
14.125: Num Ticks for Reg update and deleting 0 size files : 0


Compare that to what's in the KB955759.log from my XP Pro box

23.594: Num Ticks for Copying files : 5138
23.614: Num Ticks for Reg update and deleting 0 size files : 20

You ran the Fixit to remove the Indeo codec, correct ?
Hide the update and save your sanity, Aaron.


MowGreen
===============
*-343-* FDNY
Never Forgotten
===============

banthecheck.com
"Security updates should *never* have *non-security content* prechecked"



Aaron D. Priest wrote:

> Tried the clean boot tip, good idea, but didn't resolve it. I have K-Lite
> installed if that matters. Here are the contents of KB955759.log:
>
> [KB955759.log]
> 10.157:
> ================================================== ==============================
> 10.157: 2010/01/06 11:14:33.796 (local)
> 10.157:
> C:\WINDOWS\SoftwareDistribution\Download\da7fee2d5 1e2e59bdd47cb9e03387bcc\update\update.exe (version 6.3.13.0)
> 10.157: Failed To Enable SE_SHUTDOWN_PRIVILEGE
> 10.157: Hotfix started with following command line: -q -z -er
> /ParentInfo:4c761219d5f5b5498e2c4140abbca21b
> 10.172: In Function GetReleaseSet, line 1240, RegQueryValueEx failed with
> error 0x2
> 11.985: In Function TestVolatileFlag, line 11825, RegOpenKeyEx failed with
> error 0x2
> 11.985: In Function TestVolatileFlag, line 11857, RegOpenKeyEx failed with
> error 0x2
> 11.985: DoInstallation: CleanPFR failed: 0x2
> 11.985: In Function GetReleaseSet, line 1240, RegQueryValueEx failed with
> error 0x2
> 11.985: SetProductTypes: InfProductBuildType=BuildType.IP
> 12.000: SetAltOsLoaderPath: No section uses DirId 65701; done.
> 12.032: DoInstallation: FetchSourceURL for
> c:\windows\softwaredistribution\download\da7fee2d5 1e2e59bdd47cb9e03387bcc\update\update_SP3GDR.inf failed
> 12.032: LoadFileQueues: UpdSpGetSourceFileLocation for halmacpi.dll failed:
> 0xe0000102
> 12.047: CreateUninstall = 0,Directory = C:\WINDOWS\$NtUninstallKB955759$
> 12.078: BuildCabinetManifest: update.url absent
> 12.078: Starting AnalyzeComponents
> 12.078: AnalyzePhaseZero used 0 ticks
> 12.078: No c:\windows\INF\updtblk.inf file.
> 12.094: OEM file scan used 16 ticks
> 12.313: AnalyzePhaseOne: used 235 ticks
> 12.313: AnalyzeComponents: Hotpatch analysis disabled; skipping.
> 12.313: AnalyzeComponents: Hotpatching is disabled.
> 12.313: FindFirstFile c:\windows\$hf_mig$\*.*
> 12.313: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target
> file c:\windows\apppatch\aclayers.dll has branch sp3qfe which is greater than
> branch for sp3gdr
> 12.328: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target
> file c:\windows\system32\dllcache\aclayers.dll has branch sp3qfe which is
> greater than branch for sp3gdr
> 12.328: AnalyzeForBranching used 15 ticks.
> 12.328: AnalyzeComponents: Branch sp3gdr is not applicable to target
> workstation
> 12.328: AnalyzeComponents used 250 ticks
> 12.750: Inventory complete: ReturnStatus=61675, 718 ticks
> 12.750: Num Ticks for invent : 718
> 12.750: DoInstallation: Re-running Inventory.
> 12.750: LoadFileQueues: UpdSpGetSourceFileLocation for halmacpi.dll failed:
> 0xe0000102
> 12.750: BuildCabinetManifest: update.url absent
> 12.750: Starting AnalyzeComponents
> 12.750: AnalyzePhaseZero used 0 ticks
> 12.750: No c:\windows\INF\updtblk.inf file.
> 12.750: OEM file scan used 0 ticks
> 12.782: AnalyzePhaseOne: used 32 ticks
> 12.782: AnalyzeComponents: Hotpatch analysis disabled; skipping.
> 12.782: AnalyzeComponents: Hotpatching is disabled.
> 12.782: FindFirstFile c:\windows\$hf_mig$\*.*
> 12.782: AnalyzeForBranching used 0 ticks.
> 12.782: AnalyzePhaseTwo used 0 ticks
> 12.782: AnalyzePhaseThree used 0 ticks
> 12.782: AnalyzePhaseFive used 0 ticks
> 12.797: AnalyzePhaseSix used 15 ticks
> 12.797: AnalyzeComponents used 47 ticks
> 12.797: Downloading 0 files
> 12.797: bPatchMode = FALSE
> 12.797: Inventory complete: ReturnStatus=0, 47 ticks
> 12.797: Num Ticks for invent : 47
> 12.828: VerifyTargetFileSize: Unable to verify size as Source = NULL for
> file c:\windows\inf\HFXA.tmp
> 12.828: Copied file: c:\windows\inf\branches.inf
> 12.828: Allocation size of drive C: is 4096 bytes, free space = 283229437952
> bytes
> 12.828: Drive C: free 270108MB req: 5MB w/uninstall 0MB
> 12.828: CabinetBuild complete
> 12.828: Num Ticks for Cabinet build : 31
> 12.828: DynamicStrings section not defined or empty.
> 12.828: FileInUse:: Detection disabled.
> 13.828: LoadFileQueues: UpdSpGetSourceFileLocation for halmacpi.dll failed:
> 0xe0000102
> 13.844: System Restore Point set.
> 13.922: Copied file: C:\WINDOWS\system32\spmsg.dll
> 14.032: PFE2: Not avoiding Per File Exceptions.
> 14.125: DoInstallation: Installing assemblies with source root path:
> c:\windows\softwaredistribution\download\da7fee2d5 1e2e59bdd47cb9e03387bcc\
> 14.125: Num Ticks for Copying files : 1297
> 14.125: Num Ticks for Reg update and deleting 0 size files : 0
> 14.125: Starting process: rundll32.exe apphelp.dll,ShimFlushCache
> 14.203: Return Code = 0
> 14.235: UpdateSpUpdSvcInf: Source [ProcessesToRunAfterReboot] section is
> empty; nothing to do.
> 14.250: RebootNecessary = 0,WizardInput = 1 , DontReboot = 1, ForceRestart = 0
>

Hide the update & you're good to go.


Aaron D. Priest wrote:
> I ran MicrosoftFixit50326.msi and also removed any Indeo codecs that
> K-Lite
> installed, but I'm still getting the same update notification. I finally
> just told it not to notify me again on the two machines that now doing
> this
> so it won't hassle the users, though that's a little unsettling to me. I'd
> rather find the root cause why it keeps re-detecting.