Silent updates

I have my updates set to Download, and notify me, but not install. Today
when I booted up a notification was given of available updates. I went
about my business and after about 2 hours I looked at the task bar and
nothing! I opened windows update to see that the update was installed
silently. Any thoughts on how this happens?
--
Dave T.

Never put both feet in your mouth at the same time,
Because then you won't have a leg to stand on.

Go to Start > Run > type in

%windir%\windowsupdate.log
Click OK or press Enter

Going by today's date, locate the specific update that was installed and
post back with that section of the log, please.

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



Dave T. wrote:

> I have my updates set to Download, and notify me, but not install. Today
> when I booted up a notification was given of available updates. I went
> about my business and after about 2 hours I looked at the task bar and
> nothing! I opened windows update to see that the update was installed
> silently. Any thoughts on how this happens?

Windows version? What update? (Check your Update History at
http://windowsupdate.microsoft.com)
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L.ORG http://66.39.69.143/

Dave T. wrote:
> I have my updates set to Download, and notify me, but not install. Today
> when I booted up a notification was given of available updates. I went
> about my business and after about 2 hours I looked at the task bar and
> nothing! I opened windows update to see that the update was installed
> silently. Any thoughts on how this happens?

The log from your system shows that it was set to ' Download but do not
install ' with no minor updates allowed to install :

2007-12-05 18:25:31:538 1128 bb0 AU # Approval type:
Pre-install notify (User preference)
2007-12-05 18:25:31:538 1128 bb0 AU # Auto-install
minor updates: No (User preference)

The update to Windows Defender was then auto-approved to be downloaded
and started to do so :

2007-12-05 18:27:18:314 1128 10fc AU Auto-approving
update for download, updateId =
{B67B73A5-C879-4A49-A470-BB3DF8378AD0}.100, ForUx=0, IsOwnerUx=0,
HasDeadline=0, IsMinor=1
2007-12-05 18:27:18:314 1128 10fc AU Auto-approved 1
update(s) for download (NOT for Ux)
2007-12-05 18:27:18:384 1128 d68 DnldMgr * Updates to
download = 1
2007-12-05 18:27:18:384 1128 d68 Agent * Title =
Definition Update for Windows Defender - KB915597 (Definition 1.23.4485.0)
2007-12-05 18:27:18:384 1128 d68 Agent * UpdateId =
{B67B73A5-C879-4A49-A470-BB3DF8378AD0}.100

It then shows the download completed and awaiting approval to install it:

2007-12-05 18:28:17:173 1128 10fc AU AU setting pending
client directive to 'Install Approval'
2007-12-05 18:28:17:173 1128 10fc AU Changing existing AU
client directive from 'Download Progress' to 'Install Approval', session
id = 0x1

Then it shows the update installing without any approval by you :

2007-12-05 18:45:18:036 6020 1298 COMAPI <<-- SUBMITTED
-- COMAPI: Install [ClientId = Windows Defender]
2007-12-05 18:45:18:036 1128 13ec Agent ** START **
Agent: Installing updates [CallerId = Windows Defender]
2007-12-05 18:45:18:036 1128 13ec Agent *********
2007-12-05 18:45:18:036 1128 13ec Agent * Updates to
install = 1
2007-12-05 18:45:18:052 1128 13ec Agent * Title =
Definition Update for Windows Defender - KB915597 (Definition 1.23.4485.0)
2007-12-05 18:45:18:052 1128 13ec Agent * UpdateId =
{B67B73A5-C879-4A49-A470-BB3DF8378AD0}.100
2007-12-05 18:45:18:052 1128 13ec Agent * Bundles 1
updates:
2007-12-05 18:45:18:052 1128 13ec Agent *
{18EF7D89-CE25-422A-90BE-98D6ECEDFC13}.100
2007-12-05 18:45:22:872 1128 1080 Report REPORT EVENT:
{79DA1297-E52F-439F-8E82-60768A4E55CD} 2007-12-05 18:45:17:865-0800
1 147 101 {00000000-0000-0000-0000-000000000000} 0 0
Windows Defender Success Software Synchronization Windows
Update Client successfully detected 1 updates.
2007-12-05 18:46:03:036 1128 13ec DnldMgr Preparing
update for install, updateId = {18EF7D89-CE25-422A-90BE-98D6ECEDFC13}.100.

Then it shows the definition update was successful :

2007-12-05 18:46:53:466 1128 1080 Report REPORT EVENT:
{4F8428A7-9324-4AAE-9C30-24D2E32C8639} 2007-12-05 18:46:17:202-0800
1 183 101 {B67B73A5-C879-4A49-A470-BB3DF8378AD0} 100 0
Windows Defender Success Content Install Installation
Successful: Windows successfully installed the following update:
Definition Update for Windows Defender - KB915597 (Definition 1.23.4485.0)

Then it shows that the AU settings were changed through User Preference:

2007-12-05 20:13:53:617 1128 a18 AU ########### AU:
Setting new AU options ###########
2007-12-05 20:13:53:618 1128 a18 AU Setting AU Approval
Type to 2
2007-12-05 20:13:53:618 1128 a18 AU # Policy changed,
AU refresh required = No
2007-12-05 20:13:53:618 1128 a18 AU # Approval type:
Pre-download notify (User preference)
2007-12-05 20:13:53:618 1128 a18 AU AU settings changed
through User Preference.

You changed it to ' Notify me but do not automatically download nor
install ', correct ?
I fail to see where any approval to install is.

The log on my XP Pro SP2 system shows this after I approved WD's
definitions :

2007-12-06 12:27:25:346 984 ae8 AU AU setting pending client directive
to 'Install Approval'
2007-12-06 12:27:25:346 984 ae8 AU Changing existing AU client
directive from 'Download Progress' to 'Install Approval', session id = 0x0
2007-12-06 12:27:25:356 2428 e64 CltUI AU client got new directive =
'Install Approval', serviceId = {9482F4B4-E343-43B6-B170-9A65BC822C77},
return = 0x00000000
2007-12-06 12:27:25:356 2428 e64 CltUI AU client creating default
WU/WSUS UI plugin
2007-12-06 12:27:28:951 984 588 AU AU received install approval from
client for 1 updates
2007-12-06 12:27:28:951 984 588 AU #############
2007-12-06 12:27:28:951 984 588 AU ## START ## AU: Install updates
2007-12-06 12:27:28:951 984 588 AU #########
2007-12-06 12:27:28:951 984 588 AU # Initiating manual install
2007-12-06 12:27:28:951 984 588 AU # Approved updates = 1
2007-12-06 12:27:28:951 984 588 AU <<## SUBMITTED ## AU: Install
updates / installing updates [CallId =
{5683E5E5-9808-4083-8F41-E09849D13160}]

Conclusion : something is amiss with Vista's AU settings since you never
approved the update for installation.

If you'd like to pursue this, compress the windowsupdate.log to .zip
format and email to me at mowgreenATgmaildotcom. I know someone at MS
who needs/wants to see this <w>

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



Dave T. wrote:

> MowGreen [MVP] wrote:
>
>> Go to Start > Run > type in
>>
>> %windir%\windowsupdate.log
>> Click OK or press Enter
>>
>> Going by today's date, locate the specific update that was installed
>> and post back with that section of the log, please.
>>
>> MowGreen [MVP 2003-2008]
>> ===============
>> *-343-* FDNY
>> Never Forgotten
>> ===============
>>
>>
>>
>> Dave T. wrote:
>>
>>> I have my updates set to Download, and notify me, but not install.
>>> Today when I booted up a notification was given of available updates.
>>> I went about my business and after about 2 hours I looked at the task
>>> bar and nothing! I opened windows update to see that the update was
>>> installed silently. Any thoughts on how this happens?
>
>
> This is pretty long, I couldn't tell where the subject started or stopped;
>
> 2007-12-05 18:24:46:099 2316 960 Misc ===========
> Logging initialized (build: 7.0.6000.381, tz: -0800) ===========
> 2007-12-05 18:24:46:114 2316 960 Misc = Process:
> C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe
> 2007-12-05 18:24:46:114 2316 960 Misc = Module:
> C:\Windows\system32\wuapi.dll
> 2007-12-05 18:24:46:083 2316 960 COMAPI -------------
> 2007-12-05 18:24:46:114 2316 960 COMAPI -- START --
> COMAPI: Search [ClientId = <NULL>]
> 2007-12-05 18:24:46:114 2316 960 COMAPI ---------
> 2007-12-05 18:24:46:473 1128 bb0 Misc ===========
> Logging initialized (build: 7.0.6000.381, tz: -0800) ===========
> 2007-12-05 18:24:46:473 1128 bb0 Misc = Process:
> C:\Windows\system32\svchost.exe
> 2007-12-05 18:24:46:473 1128 bb0 Misc = Module:
> c:\windows\system32\wuaueng.dll
> 2007-12-05 18:24:46:473 1128 bb0 Service *************
> 2007-12-05 18:24:46:473 1128 bb0 Service ** START **
> Service: Service startup
> 2007-12-05 18:24:46:473 1128 bb0 Service *********
> 2007-12-05 18:24:46:504 1128 bb0 Agent * WU client
> version 7.0.6000.381
> 2007-12-05 18:24:46:504 1128 bb0 Agent * Base
> directory: C:\Windows\SoftwareDistribution
> 2007-12-05 18:24:46:504 1128 bb0 Agent * Access type:
> No proxy
> 2007-12-05 18:24:46:504 1128 bb0 Agent * Network state:
> Connected
> 2007-12-05 18:24:46:567 1128 4f4 Agent ***********
> Agent: Initializing Windows Update Agent ***********
> 2007-12-05 18:24:46:567 1128 4f4 Agent ***********
> Agent: Initializing global settings cache ***********
> 2007-12-05 18:24:46:567 1128 4f4 Agent * WSUS server:
> <NULL>
> 2007-12-05 18:24:46:567 1128 4f4 Agent * WSUS status
> server: <NULL>
> 2007-12-05 18:24:46:567 1128 4f4 Agent * Target group:
> (Unassigned Computers)
> 2007-12-05 18:24:46:567 1128 4f4 Agent * Windows Update
> access disabled: No
> 2007-12-05 18:24:47:612 1128 4f4 DnldMgr Download manager
> restoring 0 downloads
> 2007-12-05 18:24:47:628 2316 960 COMAPI <<-- SUBMITTED --
> COMAPI: Search [ClientId = <NULL>]
> 2007-12-05 18:24:48:907 1128 bb0 Report ***********
> Report: Initializing static reporting data ***********
> 2007-12-05 18:24:48:907 1128 bb0 Report * OS Version =
> 6.0.6000.0.0.66304
> 2007-12-05 18:24:48:907 1128 bb0 Report * OS Product
> Type = 0x00000003
> 2007-12-05 18:24:49:188 1128 bb0 Report * Computer
> Brand = HP-Pavilion
> 2007-12-05 18:24:49:188 1128 bb0 Report * Computer
> Model = GC515AA-ABA a6009n
> 2007-12-05 18:24:49:234 1128 bb0 Report * Bios Revision
> = 5.11
> 2007-12-05 18:24:49:234 1128 bb0 Report * Bios Name =
> Phoenix - AwardBIOS v6.00PG
> 2007-12-05 18:24:49:234 1128 bb0 Report * Bios Release
> Date = 2007-07-16T00:00:00
> 2007-12-05 18:24:49:234 1128 bb0 Report * Locale ID = 1033
> 2007-12-05 18:24:49:375 1128 d68 Agent *************
> 2007-12-05 18:24:49:375 1128 d68 Agent ** START **
> Agent: Finding updates [CallerId = ]
> 2007-12-05 18:24:49:375 1128 d68 Agent *********
> 2007-12-05 18:24:49:375 1128 d68 Agent * Online = Yes;
> Ignore download priority = No
> 2007-12-05 18:24:49:375 1128 d68 Agent * Criteria = "(
> IsInstalled = 0 and IsHidden = 0 and IsAssigned = 1 and Type='Software' )"
> 2007-12-05 18:24:49:375 1128 d68 Agent * ServiceID =
> {00000000-0000-0000-0000-000000000000}
> 2007-12-05 18:24:49:734 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
>
> 2007-12-05 18:24:49:812 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:24:53:524 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
>
> 2007-12-05 18:24:53:540 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:24:53:602 1128 d68 Agent Checking for
> updated auth cab for service 7971f918-a847-4430-9279-4a52d1efe18d at
> http://www.update.microsoft.com/v7/m...dir/muauth.cab
> 2007-12-05 18:24:53:602 1128 d68 Misc Validating
> signature for C:\Windows\SoftwareDistribution\AuthCabs\authcab.c ab:
> 2007-12-05 18:24:53:618 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:24:56:293 1128 d68 Misc Validating
> signature for C:\Windows\SoftwareDistribution\AuthCabs\authcab.c ab:
> 2007-12-05 18:24:56:354 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:25:09:152 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
>
> 2007-12-05 18:25:09:168 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:25:13:739 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
>
> 2007-12-05 18:25:13:754 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:25:13:770 1128 d68 PT +++++++++++ PT:
> Synchronizing server updates +++++++++++
> 2007-12-05 18:25:13:770 1128 d68 PT + ServiceId =
> {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL =
> https://www.update.microsoft.com/v6/...ce/client.asmx
> 2007-12-05 18:25:31:523 1128 bb0 AU ########### AU:
> Initializing Automatic Updates ###########
> 2007-12-05 18:25:31:523 1128 bb0 AU AU setting next
> detection timeout to 2007-12-06 02:25:31
> 2007-12-05 18:25:31:538 1128 bb0 AU # Approval type:
> Pre-install notify (User preference)
> 2007-12-05 18:25:31:538 1128 bb0 AU # Auto-install
> minor updates: No (User preference)
> 2007-12-05 18:25:31:554 1128 bb0 AU AU finished delayed
> initialization
> 2007-12-05 18:25:31:554 1128 bb0 AU #############
> 2007-12-05 18:25:31:554 1128 bb0 AU ## START ## AU:
> Search for updates
> 2007-12-05 18:25:31:554 1128 bb0 AU #########
> 2007-12-05 18:25:31:554 1128 bb0 AU <<## SUBMITTED ## AU:
> Search for updates [CallId = {AD88960D-81A0-40E3-96DB-60EF378D496E}]
> 2007-12-05 18:26:38:520 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
>
> 2007-12-05 18:26:38:536 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:38:630 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
>
> 2007-12-05 18:26:38:645 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:38:661 1128 d68 PT +++++++++++ PT:
> Synchronizing extended update info +++++++++++
> 2007-12-05 18:26:38:661 1128 d68 PT + ServiceId =
> {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL =
> https://www.update.microsoft.com/v6/...ce/client.asmx
> 2007-12-05 18:26:40:002 1128 bb0 AU Piggybacking on an AU
> detection already in progress
> 2007-12-05 18:26:40:689 1128 d68 Agent Update
> {9CCCA86F-8378-441A-A962-C4484AF2F2D0}.100 is pruned out due to
> potential supersedence
> 2007-12-05 18:26:40:689 1128 d68 Agent * Added update
> {B67B73A5-C879-4A49-A470-BB3DF8378AD0}.100 to search result
> 2007-12-05 18:26:40:689 1128 d68 Agent * Found 1
> updates and 38 categories in search; evaluated appl. rules of 686 out of
> 825 deployed entities
> 2007-12-05 18:26:40:720 1128 d68 Agent *********
> 2007-12-05 18:26:40:720 1128 d68 Agent ** END **
> Agent: Finding updates [CallerId = ]
> 2007-12-05 18:26:40:720 1128 d68 Agent *************
> 2007-12-05 18:26:40:736 1128 d68 Agent *************
> 2007-12-05 18:26:40:736 1128 d68 Agent ** START **
> Agent: Finding updates [CallerId = AutomaticUpdates]
> 2007-12-05 18:26:40:736 1128 d68 Agent *********
> 2007-12-05 18:26:40:736 1128 d68 Agent * Online = Yes;
> Ignore download priority = No
> 2007-12-05 18:26:40:736 1128 d68 Agent * Criteria =
> "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and
> DeploymentAction='Uninstallation' or IsInstalled=1 and
> DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0
> and DeploymentAction='Uninstallation' and RebootRequired=1"
> 2007-12-05 18:26:40:736 1128 d68 Agent * ServiceID =
> {7971F918-A847-4430-9279-4A52D1EFE18D}
> 2007-12-05 18:26:40:736 1128 d68 Setup Checking for agent
> SelfUpdate
> 2007-12-05 18:26:40:736 1128 d68 Setup Client version:
> Core: 7.0.6000.381 Aux: 7.0.6000.381
> 2007-12-05 18:26:40:736 2316 1104 COMAPI >>-- RESUMED
> -- COMAPI: Search [ClientId = <NULL>]
> 2007-12-05 18:26:40:751 2316 1104 COMAPI - Updates
> found = 1
> 2007-12-05 18:26:40:751 2316 1104 COMAPI ---------
> 2007-12-05 18:26:40:751 2316 1104 COMAPI -- END --
> COMAPI: Search [ClientId = <NULL>]
> 2007-12-05 18:26:40:751 2316 1104 COMAPI -------------
> 2007-12-05 18:26:40:767 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
>
> 2007-12-05 18:26:40:782 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:40:814 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
>
> 2007-12-05 18:26:40:829 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:40:860 1128 d68 Agent Checking for
> updated auth cab for service 7971f918-a847-4430-9279-4a52d1efe18d at
> http://www.update.microsoft.com/v7/m...dir/muauth.cab
> 2007-12-05 18:26:40:860 1128 d68 Misc Validating
> signature for C:\Windows\SoftwareDistribution\AuthCabs\authcab.c ab:
> 2007-12-05 18:26:40:860 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:40:954 1128 d68 Misc Validating
> signature for C:\Windows\SoftwareDistribution\AuthCabs\authcab.c ab:
> 2007-12-05 18:26:40:954 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:40:970 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
>
> 2007-12-05 18:26:40:970 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:41:016 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
>
> 2007-12-05 18:26:41:032 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:41:048 1128 d68 Misc Validating
> signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident .cab:
> 2007-12-05 18:26:41:048 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:41:094 1128 d68 Misc Validating
> signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident .cab:
> 2007-12-05 18:26:41:110 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:41:110 1128 d68 Misc Validating
> signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3se tup.cab:
> 2007-12-05 18:26:41:126 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:41:157 1128 d68 Misc Validating
> signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3se tup.cab:
> 2007-12-05 18:26:41:157 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:41:204 1128 d68 Setup Determining
> whether a new setup handler needs to be downloaded
> 2007-12-05 18:26:41:235 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\SelfUpdate\Handler \WuSetupV.exe:
> 2007-12-05 18:26:41:250 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:41:250 1128 d68 Setup SelfUpdate handler
> update NOT required: Current version: 7.0.6000.381, required version:
> 7.0.6000.381
> 2007-12-05 18:26:41:250 1128 d68 Setup Evaluating
> applicability of setup package
> "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.0.6000.381"
> 2007-12-05 18:26:41:344 1128 d68 Setup Setup package
> "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.0.6000.381" is
> already installed.
> 2007-12-05 18:26:41:344 1128 d68 Setup Evaluating
> applicability of setup package
> "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.0.6000.381"
> 2007-12-05 18:26:43:107 1128 d68 Setup Setup package
> "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.0.6000.381" is
> already installed.
> 2007-12-05 18:26:43:107 1128 d68 Setup Evaluating
> applicability of setup package
> "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.0.6000.381"
> 2007-12-05 18:26:45:322 1128 d68 Setup Setup package
> "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.0.6000.381"
> is already installed.
> 2007-12-05 18:26:45:322 1128 d68 Setup SelfUpdate check
> completed. SelfUpdate is NOT required.
> 2007-12-05 18:26:49:893 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
>
> 2007-12-05 18:26:49:924 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:49:986 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
>
> 2007-12-05 18:26:50:002 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:26:50:018 1128 d68 PT +++++++++++ PT:
> Synchronizing server updates +++++++++++
> 2007-12-05 18:26:50:018 1128 d68 PT + ServiceId =
> {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL =
> https://www.update.microsoft.com/v6/...ce/client.asmx
> 2007-12-05 18:27:17:530 1128 d68 Driver DriverUtil
> marking {BFBC092A-597F-4810-869E-A7EE3E87C71C}.100
> e_detectionStateInstallable
> 2007-12-05 18:27:17:530 1128 d68 Driver Matched driver to
> device PCI\VEN_10DE&DEV_03F6&SUBSYS_2A58103C&REV_A2
> 2007-12-05 18:27:17:530 1128 d68 Driver Status:
> 0x180000a, ProblemNumber: 00000000
> 2007-12-05 18:27:17:530 1128 d68 Driver Calculated driver
> attributes as 0x00000000
> 2007-12-05 18:27:17:530 1128 d68 Driver DriverUtil
> marking {873079B0-4EF0-493D-8226-07141EB98268}.101
> e_detectionStateInstallable
> 2007-12-05 18:27:17:530 1128 d68 Driver Matched driver to
> device PCI\VEN_10DE&DEV_03D0&SUBSYS_2A58103C&REV_A2
> 2007-12-05 18:27:17:530 1128 d68 Driver Status:
> 0x180200a, ProblemNumber: 00000000
> 2007-12-05 18:27:17:530 1128 d68 Driver Calculated driver
> attributes as 0x00000000
> 2007-12-05 18:27:18:250 1128 d68 Agent * Added update
> {873079B0-4EF0-493D-8226-07141EB98268}.101 to search result
> 2007-12-05 18:27:18:250 1128 d68 Agent * Added update
> {BFBC092A-597F-4810-869E-A7EE3E87C71C}.100 to search result
> 2007-12-05 18:27:18:250 1128 d68 Agent Update
> {9CCCA86F-8378-441A-A962-C4484AF2F2D0}.100 is pruned out due to
> potential supersedence
> 2007-12-05 18:27:18:251 1128 d68 Agent * Added update
> {B67B73A5-C879-4A49-A470-BB3DF8378AD0}.100 to search result
> 2007-12-05 18:27:18:251 1128 d68 Agent * Found 3
> updates and 38 categories in search; evaluated appl. rules of 684 out of
> 825 deployed entities
> 2007-12-05 18:27:18:308 1128 d68 Agent *********
> 2007-12-05 18:27:18:308 1128 d68 Agent ** END **
> Agent: Finding updates [CallerId = AutomaticUpdates]
> 2007-12-05 18:27:18:308 1128 d68 Agent *************
> 2007-12-05 18:27:18:312 1128 10fc AU >>## RESUMED ##
> AU: Search for updates [CallId = {AD88960D-81A0-40E3-96DB-60EF378D496E}]
> 2007-12-05 18:27:18:313 1128 10fc AU # 3 updates detected
> 2007-12-05 18:27:18:313 1128 10fc AU #########
> 2007-12-05 18:27:18:313 1128 10fc AU ## END ## AU:
> Search for updates [CallId = {AD88960D-81A0-40E3-96DB-60EF378D496E}]
> 2007-12-05 18:27:18:313 1128 10fc AU #############
> 2007-12-05 18:27:18:314 1128 10fc AU AU setting next
> detection timeout to 2007-12-06 20:32:39
> 2007-12-05 18:27:18:314 1128 10fc AU Auto-approving
> update for download, updateId =
> {B67B73A5-C879-4A49-A470-BB3DF8378AD0}.100, ForUx=0, IsOwnerUx=0,
> HasDeadline=0, IsMinor=1
> 2007-12-05 18:27:18:314 1128 10fc AU Auto-approved 1
> update(s) for download (NOT for Ux)
> 2007-12-05 18:27:18:315 1128 10fc AU #############
> 2007-12-05 18:27:18:315 1128 10fc AU ## START ## AU:
> Download updates
> 2007-12-05 18:27:18:315 1128 10fc AU #########
> 2007-12-05 18:27:18:315 1128 10fc AU # Approved updates
> = 1
> 2007-12-05 18:27:18:328 1128 10fc AU AU initiated
> download, updateId = {B67B73A5-C879-4A49-A470-BB3DF8378AD0}.100, callId
> = {4ABD5896-575B-44CE-B989-EF99E93C7B23}
> 2007-12-05 18:27:18:328 1128 10fc AU AU setting pending
> client directive to 'Download Progress'
> 2007-12-05 18:27:18:352 1128 10fc AU # Pending download
> calls = 1
> 2007-12-05 18:27:18:352 1128 10fc AU <<## SUBMITTED ##
> AU: Download updates
> 2007-12-05 18:27:18:379 1128 d68 Report REPORT EVENT:
> {B7DC3513-6F4F-4E20-8DF0-6CD50057CF38} 2007-12-05
> 18:26:40:720-0800 1 147 101
> {00000000-0000-0000-0000-000000000000} 0 0 Success
> Software Synchronization Windows Update Client successfully detected
> 1 updates.
> 2007-12-05 18:27:18:383 1128 d68 DnldMgr *************
> 2007-12-05 18:27:18:383 1128 d68 DnldMgr ** START **
> DnldMgr: Downloading updates [CallerId = AutomaticUpdates]
> 2007-12-05 18:27:18:383 1128 d68 DnldMgr *********
> 2007-12-05 18:27:18:383 1128 d68 DnldMgr * Call ID =
> {4ABD5896-575B-44CE-B989-EF99E93C7B23}
> 2007-12-05 18:27:18:384 1128 d68 DnldMgr * Priority =
> 2, Interactive = 0, Owner is system = 1, Explicit proxy = 0, Proxy
> session id = -1, ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}
> 2007-12-05 18:27:18:384 1128 d68 DnldMgr * Updates to
> download = 1
> 2007-12-05 18:27:18:384 1128 d68 Agent * Title =
> Definition Update for Windows Defender - KB915597 (Definition 1.23.4485.0)
> 2007-12-05 18:27:18:384 1128 d68 Agent * UpdateId =
> {B67B73A5-C879-4A49-A470-BB3DF8378AD0}.100
> 2007-12-05 18:27:18:384 1128 d68 Agent * Bundles 1
> updates:
> 2007-12-05 18:27:18:384 1128 d68 Agent *
> {18EF7D89-CE25-422A-90BE-98D6ECEDFC13}.100
> 2007-12-05 18:27:18:386 1128 d68 DnldMgr ***********
> DnldMgr: Regulation Refresh [Svc:
> {7971F918-A847-4430-9279-4A52D1EFE18D}] ***********
> 2007-12-05 18:27:18:386 1128 d68 DnldMgr Contacting
> regulation server for 1 updates.
> 2007-12-05 18:27:18:387 1128 d68 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab:
>
> 2007-12-05 18:27:18:399 1128 d68 Misc Microsoft signed: Yes
> 2007-12-05 18:27:18:407 1128 d68 DnldMgr Regulation
> server path:
> http://www.update.microsoft.com/v6/U...egulation.asmx.
>
> 2007-12-05 18:27:18:510 1128 d68 DnldMgr * Regulation
> call complete. 0x00000000
> 2007-12-05 18:27:18:513 1128 d68 DnldMgr ***********
> DnldMgr: New download job [UpdateId =
> {18EF7D89-CE25-422A-90BE-98D6ECEDFC13}.100] ***********
> 2007-12-05 18:27:20:855 1128 d68 DnldMgr * BITS job
> initialized, JobId = {11CDE4C0-E5BF-425F-A723-535BE3CF8004}
> 2007-12-05 18:27:20:870 1128 d68 DnldMgr * Downloading
> from
> http://au.download.windowsupdate.com...b614ec80ce.exe
> to
> C:\Windows\SoftwareDistribution\Download\0ea0eab48 7b42f1d4463fefa485ed101\c3d22fe96c8a2644d491f10a1c 384ab614ec80ce
> (full file).
> 2007-12-05 18:27:20:902 1128 d68 Agent *********
> 2007-12-05 18:27:20:902 1128 d68 Agent ** END **
> Agent: Downloading updates [CallerId = AutomaticUpdates]
> 2007-12-05 18:27:20:902 1128 d68 Agent *************
> 2007-12-05 18:27:23:320 1128 d68 Report REPORT EVENT:
> {7307C7D0-7A3B-4C20-A670-857712AD31D1} 2007-12-05
> 18:27:18:308-0800 1 147 101
> {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates
> Success Software Synchronization Windows Update Client successfully
> detected 3 updates.
> 2007-12-05 18:27:33:431 1128 bb0 AU Launched new AU
> client for directive 'Download Progress', session id = 0x1
> 2007-12-05 18:28:17:064 1128 1398 DnldMgr BITS job
> {11CDE4C0-E5BF-425F-A723-535BE3CF8004} completed successfully
> 2007-12-05 18:28:17:111 1128 1398 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\Download\0ea0eab48 7b42f1d4463fefa485ed101\c3d22fe96c8a2644d491f10a1c 384ab614ec80ce:
>
> 2007-12-05 18:28:17:126 1128 1398 Misc Microsoft signed:
> Yes
> 2007-12-05 18:28:17:142 1128 1398 DnldMgr Download job
> bytes total = 184896, bytes transferred = 184896
> 2007-12-05 18:28:17:157 1128 1398 DnldMgr ***********
> DnldMgr: New download job [UpdateId =
> {18EF7D89-CE25-422A-90BE-98D6ECEDFC13}.100] ***********
> 2007-12-05 18:28:17:157 1128 1398 DnldMgr * All files
> for update were already downloaded and are valid.
> 2007-12-05 18:28:17:157 1128 10fc AU >>## RESUMED ##
> AU: Download update [UpdateId = {B67B73A5-C879-4A49-A470-BB3DF8378AD0},
> succeeded]
> 2007-12-05 18:28:17:157 1128 10fc AU #########
> 2007-12-05 18:28:17:157 1128 10fc AU ## END ## AU:
> Download updates
> 2007-12-05 18:28:17:157 1128 10fc AU #############
> 2007-12-05 18:28:17:173 1128 10fc AU AU setting pending
> client directive to 'Install Approval'
> 2007-12-05 18:28:17:173 1128 10fc AU Changing existing AU
> client directive from 'Download Progress' to 'Install Approval', session
> id = 0x1
> 2007-12-05 18:28:22:128 1128 d68 Report REPORT EVENT:
> {4B17CA59-934B-4A30-BC3D-66489FA74D35} 2007-12-05
> 18:28:17:157-0800 1 162 101
> {B67B73A5-C879-4A49-A470-BB3DF8378AD0} 100 0
> AutomaticUpdates Success Content Download Download succeeded.
> 2007-12-05 18:28:22:128 1128 d68 Report REPORT EVENT:
> {34F7CF4F-8819-41B9-808A-5C115B8A16CE} 2007-12-05
> 18:28:17:157-0800 1 189 102
> {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates
> Success Content Install Installation Ready: The following updates are
> downloaded and ready for installation. To install the updates, an
> administrator should log on to this computer and Windows will prompt
> with further instructions: - Definition Update for Windows Defender -
> KB915597 (Definition 1.23.4485.0)
> 2007-12-05 18:44:25:464 6020 112c Misc ===========
> Logging initialized (build: 7.0.6000.381, tz: -0800) ===========
> 2007-12-05 18:44:25:464 6020 112c Misc = Process:
> c:\program files\windows defender\MpCmdRun.exe
> 2007-12-05 18:44:25:464 6020 112c Misc = Module:
> C:\Windows\system32\wuapi.dll
> 2007-12-05 18:44:24:357 6020 112c COMAPI -------------
> 2007-12-05 18:44:25:464 6020 112c COMAPI -- START --
> COMAPI: Search [ClientId = Windows Defender]
> 2007-12-05 18:44:25:464 6020 112c COMAPI ---------
> 2007-12-05 18:44:25:495 1128 1080 Agent *************
> 2007-12-05 18:44:25:495 1128 1080 Agent ** START **
> Agent: Finding updates [CallerId = Windows Defender]
> 2007-12-05 18:44:25:495 1128 1080 Agent *********
> 2007-12-05 18:44:25:495 1128 1080 Agent * Online = Yes;
> Ignore download priority = No
> 2007-12-05 18:44:25:495 6020 112c COMAPI <<-- SUBMITTED
> -- COMAPI: Search [ClientId = Windows Defender]
> 2007-12-05 18:44:25:495 1128 1080 Agent * Criteria =
> "(IsInstalled = 0 and IsHidden = 0 and CategoryIDs contains
> '0a487050-8b0f-4f81-b401-be4ceacd61cd') or (IsInstalled = 0 and IsHidden
> = 0 and CategoryIDs contains '8c3fcc84-7410-4a95-8b89-a166a0190486')"
> 2007-12-05 18:44:25:495 1128 1080 Agent * ServiceID =
> {00000000-0000-0000-0000-000000000000}
> 2007-12-05 18:44:25:651 1128 1080 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
>
> 2007-12-05 18:44:25:667 1128 1080 Misc Microsoft signed:
> Yes
> 2007-12-05 18:44:25:745 1128 1080 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
>
> 2007-12-05 18:44:25:761 1128 1080 Misc Microsoft signed:
> Yes
> 2007-12-05 18:44:25:792 1128 1080 Agent Checking for
> updated auth cab for service 7971f918-a847-4430-9279-4a52d1efe18d at
> http://www.update.microsoft.com/v7/m...dir/muauth.cab
> 2007-12-05 18:44:25:792 1128 1080 Misc Validating
> signature for C:\Windows\SoftwareDistribution\AuthCabs\authcab.c ab:
> 2007-12-05 18:44:25:807 1128 1080 Misc Microsoft signed:
> Yes
> 2007-12-05 18:44:25:885 1128 1080 Misc Validating
> signature for C:\Windows\SoftwareDistribution\AuthCabs\authcab.c ab:
> 2007-12-05 18:44:25:901 1128 1080 Misc Microsoft signed:
> Yes
> 2007-12-05 18:44:30:035 1128 1080 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
>
> 2007-12-05 18:44:30:035 1128 1080 Misc Microsoft signed:
> Yes
> 2007-12-05 18:44:30:082 1128 1080 Misc Validating
> signature for
> C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\muredir.cab:
>
> 2007-12-05 18:44:30:082 1128 1080 Misc Microsoft signed:
> Yes
> 2007-12-05 18:44:30:144 1128 1080 PT +++++++++++ PT:
> Synchronizing server updates +++++++++++
> 2007-12-05 18:44:30:144 1128 1080 PT + ServiceId =
> {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL =
> https://www.update.microsoft.com/v6/...ce/client.asmx
> 2007-12-05 18:45:16:492 1128 1080 Driver DriverUtil
> marking {BFBC092A-597F-4810-869E-A7EE3E87C71C}.100
> e_detectionStateInstallable
> 2007-12-05 18:45:16:492 1128 1080 Driver Matched driver
> to device PCI\VEN_10DE&DEV_03F6&SUBSYS_2A58103C&REV_A2
> 2007-12-05 18:45:16:492 1128 1080 Driver Status:
> 0x180000a, ProblemNumber: 00000000
> 2007-12-05 18:45:16:492 1128 1080 Driver Calculated
> driver attributes as 0x00000000
> 2007-12-05 18:45:16:492 1128 1080 Driver DriverUtil
> marking {873079B0-4EF0-493D-8226-07141EB98268}.101
> e_detectionStateInstallable
> 2007-12-05 18:45:16:492 1128 1080 Driver Matched driver
> to device PCI\VEN_10DE&DEV_03D0&SUBSYS_2A58103C&REV_A2
> 2007-12-05 18:45:16:492 1128 1080 Driver Status:
> 0x180200a, ProblemNumber: 00000000
> 2007-12-05 18:45:16:492 1128 1080 Driver Calculated
> driver attributes as 0x00000000
> 2007-12-05 18:45:17:771 1128 1080 Agent Update
> {9CCCA86F-8378-441A-A962-C4484AF2F2D0}.100 is pruned out due to
> potential supersedence
> 2007-12-05 18:45:17:771 1128 1080 Agent * Added update
> {B67B73A5-C879-4A49-A470-BB3DF8378AD0}.100 to search result
> 2007-12-05 18:45:17:771 1128 1080 Agent * Found 1
> updates and 38 categories in search; evaluated appl. rules of 684 out of
> 825 deployed entities
> 2007-12-05 18:45:17:865 1128 1080 Agent *********
> 2007-12-05 18:45:17:865 1128 1080 Agent ** END **
> Agent: Finding updates [CallerId = Windows Defender]
> 2007-12-05 18:45:17:865 1128 1080 Agent *************
> 2007-12-05 18:45:17:880 6020 129c COMAPI >>-- RESUMED
> -- COMAPI: Search [ClientId = Windows Defender]
> 2007-12-05 18:45:17:896 6020 129c COMAPI - Updates
> found = 1
> 2007-12-05 18:45:17:896 6020 129c COMAPI ---------
> 2007-12-05 18:45:17:896 6020 129c COMAPI -- END --
> COMAPI: Search [ClientId = Windows Defender]
> 2007-12-05 18:45:17:896 6020 129c COMAPI -------------
> 2007-12-05 18:45:17:974 6020 2c8 COMAPI -------------
> 2007-12-05 18:45:17:974 6020 2c8 COMAPI -- START --
> COMAPI: Download [ClientId = Windows Defender]
> 2007-12-05 18:45:17:974 6020 2c8 COMAPI ---------
> 2007-12-05 18:45:17:974 6020 2c8 COMAPI - Forced: No;
> Download priority: 3
> 2007-12-05 18:45:17:974 6020 2c8 COMAPI - Updates in
> request: 1
> 2007-12-05 18:45:17:974 6020 2c8 COMAPI - ServiceID =
> {7971F918-A847-4430-9279-4A52D1EFE18D}
> 2007-12-05 18:45:17:974 6020 2c8 COMAPI <<-- SUBMITTED --
> COMAPI: Download [ClientId = Windows Defender]
> 2007-12-05 18:45:18:005 1128 1080 DnldMgr *************
> 2007-12-05 18:45:18:005 1128 1080 DnldMgr ** START **
> DnldMgr: Downloading updates [CallerId = Windows Defender]
> 2007-12-05 18:45:18:005 1128 1080 DnldMgr *********
> 2007-12-05 18:45:18:005 1128 1080 DnldMgr * Call ID =
> {6712F928-657B-4B62-B05D-413471D4B447}
> 2007-12-05 18:45:18:005 1128 1080 DnldMgr * Priority =
> 3, Interactive = 1, Owner is system = 1, Explicit proxy = 1, Proxy
> session id = -1, ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}
> 2007-12-05 18:45:18:005 1128 1080 DnldMgr * Updates to
> download = 1
> 2007-12-05 18:45:18:005 1128 1080 Agent * Title =
> Definition Update for Windows Defender - KB915597 (Definition 1.23.4485.0)
> 2007-12-05 18:45:18:005 1128 1080 Agent * UpdateId =
> {B67B73A5-C879-4A49-A470-BB3DF8378AD0}.100
> 2007-12-05 18:45:18:005 1128 1080 Agent * Bundles 1
> updates:
> 2007-12-05 18:45:18:005 1128 1080 Agent *
> {18EF7D89-CE25-422A-90BE-98D6ECEDFC13}.100
> 2007-12-05 18:45:18:005 1128 1080 DnldMgr ***********
> DnldMgr: New download job [UpdateId =
> {18EF7D89-CE25-422A-90BE-98D6ECEDFC13}.100] ***********
> 2007-12-05 18:45:18:036 1128 1080 DnldMgr * All files
> for update were already downloaded and are valid.
> 2007-12-05 18:45:18:036 1128 1080 Agent *********
> 2007-12-05 18:45:18:036 1128 1080 Agent ** END **
> Agent: Downloading updates [CallerId = Windows Defender]
> 2007-12-05 18:45:18:036 1128 1080 Agent *************
> 2007-12-05 18:45:18:036 6020 129c COMAPI >>-- RESUMED
> -- COMAPI: Download [ClientId = Windows Defender]
> 2007-12-05 18:45:18:036 6020 129c COMAPI - Download
> call complete (succeeded = 1, succeeded with errors = 0, failed = 0,
> unaccounted = 0)
> 2007-12-05 18:45:18:036 6020 129c COMAPI ---------
> 2007-12-05 18:45:18:036 6020 129c COMAPI -- END --
> COMAPI: Download [ClientId = Windows Defender]
> 2007-12-05 18:45:18:036 6020 129c COMAPI -------------
> 2007-12-05 18:45:18:036 6020 1298 COMAPI -------------
> 2007-12-05 18:45:18:036 6020 1298 COMAPI -- START --
> COMAPI: Install [ClientId = Windows Defender]
> 2007-12-05 18:45:18:036 6020 1298 COMAPI ---------
> 2007-12-05 18:45:18:036 6020 1298 COMAPI - Allow source
> prompts: Yes; Forced: No; Force quiet: Yes
> 2007-12-05 18:45:18:036 6020 1298 COMAPI - Updates in
> request: 1
> 2007-12-05 18:45:18:036 6020 1298 COMAPI - ServiceID =
> {7971F918-A847-4430-9279-4A52D1EFE18D}
> 2007-12-05 18:45:18:036 6020 1298 COMAPI - Updates to
> install = 1
> 2007-12-05 18:45:18:036 1128 13ec Agent *************
> 2007-12-05 18:45:18:036 6020 1298 COMAPI <<-- SUBMITTED
> -- COMAPI: Install [ClientId = Windows Defender]
> 2007-12-05 18:45:18:036 1128 13ec Agent ** START **
> Agent: Installing updates [CallerId = Windows Defender]
> 2007-12-05 18:45:18:036 1128 13ec Agent *********
> 2007-12-05 18:45:18:036 1128 13ec Agent * Updates to
> install = 1
> 2007-12-05 18:45:18:052 1128 13ec Agent * Title =
> Definition Update for Windows Defender - KB915597 (Definition 1.23.4485.0)
> 2007-12-05 18:45:18:052 1128 13ec Agent * UpdateId =
> {B67B73A5-C879-4A49-A470-BB3DF8378AD0}.100
> 2007-12-05 18:45:18:052 1128 13ec Agent * Bundles 1
> updates:
> 2007-12-05 18:45:18:052 1128 13ec Agent *
> {18EF7D89-CE25-422A-90BE-98D6ECEDFC13}.100
> 2007-12-05 18:45:22:872 1128 1080 Report REPORT EVENT:
> {79DA1297-E52F-439F-8E82-60768A4E55CD} 2007-12-05
> 18:45:17:865-0800 1 147 101
> {00000000-0000-0000-0000-000000000000} 0 0 Windows Defender
> Success Software Synchronization Windows Update Client
> successfully detected 1 updates.
> 2007-12-05 18:46:03:036 1128 13ec DnldMgr Preparing
> update for install, updateId = {18EF7D89-CE25-422A-90BE-98D6ECEDFC13}.100.
> 2007-12-05 18:46:03:550 5364 1764 Misc ===========
> Logging initialized (build: 7.0.6000.381, tz: -0800) ===========
> 2007-12-05 18:46:03:550 5364 1764 Misc = Process:
> C:\Windows\system32\wuauclt.exe
> 2007-12-05 18:46:03:566 5364 1764 Misc = Module:
> C:\Windows\system32\wuaueng.dll
> 2007-12-05 18:46:03:441 5364 1764 Handler :::::::::::::
> 2007-12-05 18:46:03:566 5364 1764 Handler :: START ::
> Handler: Command Line Install
> 2007-12-05 18:46:03:566 5364 1764 Handler :::::::::
> 2007-12-05 18:46:03:566 5364 1764 Handler : Updates to
> install = 1
> 2007-12-05 18:46:16:797 5364 1764 Handler : Command
> line install completed. Return code = 0x00000000, Result = Succeeded,
> Reboot required = false
> 2007-12-05 18:46:16:797 5364 1764 Handler :::::::::
> 2007-12-05 18:46:16:797 5364 1764 Handler :: END ::
> Handler: Command Line Install
> 2007-12-05 18:46:16:797 5364 1764 Handler :::::::::::::
> 2007-12-05 18:46:17:343 1128 13ec Agent *********
> 2007-12-05 18:46:17:343 1128 bb0 AU Triggering Offline
> detection (non-interactive)
> 2007-12-05 18:46:17:343 1128 13ec Agent ** END **
> Agent: Installing updates [CallerId = Windows Defender]
> 2007-12-05 18:46:17:343 1128 13ec Agent *************
> 2007-12-05 18:46:17:343 6020 15e0 COMAPI >>-- RESUMED
> -- COMAPI: Install [ClientId = Windows Defender]
> 2007-12-05 18:46:17:343 6020 15e0 COMAPI - Install call
> complete (succeeded = 1, succeeded with errors = 0, failed = 0,
> unaccounted = 0)
> 2007-12-05 18:46:17:343 6020 15e0 COMAPI - Reboot
> required = No
> 2007-12-05 18:46:17:343 6020 15e0 COMAPI ---------
> 2007-12-05 18:46:17:343 6020 15e0 COMAPI -- END --
> COMAPI: Install [ClientId = Windows Defender]
> 2007-12-05 18:46:17:343 6020 15e0 COMAPI -------------
> 2007-12-05 18:46:17:343 1128 bb0 AU #############
> 2007-12-05 18:46:17:343 1128 bb0 AU ## START ## AU:
> Search for updates
> 2007-12-05 18:46:17:343 1128 bb0 AU #########
> 2007-12-05 18:46:17:343 1128 bb0 AU <<## SUBMITTED ## AU:
> Search for updates [CallId = {8A34CF6C-B38B-45FF-BF77-9E9623D707B0}]
> 2007-12-05 18:46:17:343 1128 1080 Agent *************
> 2007-12-05 18:46:17:343 1128 1080 Agent ** START **
> Agent: Finding updates [CallerId = AutomaticUpdates]
> 2007-12-05 18:46:17:343 1128 1080 Agent *********
> 2007-12-05 18:46:17:343 1128 1080 Agent * Online = No;
> Ignore download priority = No
> 2007-12-05 18:46:17:343 1128 1080 Agent * Criteria =
> "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and
> DeploymentAction='Uninstallation' or IsInstalled=1 and
> DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0
> and DeploymentAction='Uninstallation' and RebootRequired=1"
> 2007-12-05 18:46:17:343 1128 1080 Agent * ServiceID =
> {7971F918-A847-4430-9279-4A52D1EFE18D}
> 2007-12-05 18:46:52:536 1128 1080 Driver DriverUtil
> marking {BFBC092A-597F-4810-869E-A7EE3E87C71C}.100
> e_detectionStateInstallable
> 2007-12-05 18:46:52:536 1128 1080 Driver Matched driver
> to device PCI\VEN_10DE&DEV_03F6&SUBSYS_2A58103C&REV_A2
> 2007-12-05 18:46:52:536 1128 1080 Driver Status:
> 0x180000a, ProblemNumber: 00000000
> 2007-12-05 18:46:52:536 1128 1080 Driver Calculated
> driver attributes as 0x00000000
> 2007-12-05 18:46:52:536 1128 1080 Driver DriverUtil
> marking {873079B0-4EF0-493D-8226-07141EB98268}.101
> e_detectionStateInstallable
> 2007-12-05 18:46:52:536 1128 1080 Driver Matched driver
> to device PCI\VEN_10DE&DEV_03D0&SUBSYS_2A58103C&REV_A2
> 2007-12-05 18:46:52:536 1128 1080 Driver Status:
> 0x180200a, ProblemNumber: 00000000
> 2007-12-05 18:46:52:536 1128 1080 Driver Calculated
> driver attributes as 0x00000000
> 2007-12-05 18:46:53:388 1128 1080 Agent * Added update
> {873079B0-4EF0-493D-8226-07141EB98268}.101 to search result
> 2007-12-05 18:46:53:388 1128 1080 Agent * Added update
> {BFBC092A-597F-4810-869E-A7EE3E87C71C}.100 to search result
> 2007-12-05 18:46:53:388 1128 1080 Agent * Found 2
> updates and 38 categories in search; evaluated appl. rules of 684 out of
> 825 deployed entities
> 2007-12-05 18:46:53:466 1128 1080 Agent *********
> 2007-12-05 18:46:53:466 1128 1080 Agent ** END **
> Agent: Finding updates [CallerId = AutomaticUpdates]
> 2007-12-05 18:46:53:466 1128 1080 Agent *************
> 2007-12-05 18:46:53:466 1128 1014 AU >>## RESUMED ##
> AU: Search for updates [CallId = {8A34CF6C-B38B-45FF-BF77-9E9623D707B0}]
> 2007-12-05 18:46:53:466 1128 1080 Report REPORT EVENT:
> {4F8428A7-9324-4AAE-9C30-24D2E32C8639} 2007-12-05
> 18:46:17:202-0800 1 183 101
> {B67B73A5-C879-4A49-A470-BB3DF8378AD0} 100 0 Windows Defender
> Success Content Install Installation Successful: Windows
> successfully installed the following update: Definition Update for
> Windows Defender - KB915597 (Definition 1.23.4485.0)
> 2007-12-05 18:46:53:466 1128 1014 AU # 2 updates detected
> 2007-12-05 18:46:53:466 1128 1014 AU #########
> 2007-12-05 18:46:53:466 1128 1014 AU ## END ## AU:
> Search for updates [CallId = {8A34CF6C-B38B-45FF-BF77-9E9623D707B0}]
> 2007-12-05 18:46:53:466 1128 1014 AU #############
> 2007-12-05 18:46:53:529 1128 bb0 AU AU received handle event
> 2007-12-05 20:13:53:617 1128 a18 AU ########### AU:
> Setting new AU options ###########
> 2007-12-05 20:13:53:618 1128 a18 AU Setting AU Approval
> Type to 2
> 2007-12-05 20:13:53:618 1128 a18 AU # Policy changed,
> AU refresh required = No
> 2007-12-05 20:13:53:618 1128 a18 AU # Approval type:
> Pre-download notify (User preference)
> 2007-12-05 20:13:53:618 1128 a18 AU AU settings changed
> through User Preference.
> 2007-12-05 20:17:18:509 1128 d8c DnldMgr ***********
> DnldMgr: Regulation Refresh [Svc:
> {7971F918-A847-4430-9279-4A52D1EFE18D}] ***********
> 2007-12-05 20:17:18:509 1128 d8c DnldMgr * Regulation
> call complete. 0x00000000
> 2007-12-05 20:22:58:247 1128 bb0 Shutdwn user declined
> update at shutdown
> 2007-12-05 20:22:58:247 1128 bb0 AU AU initiates service
> shutdown
> 2007-12-05 20:22:58:247 1128 bb0 AU ########### AU:
> Uninitializing Automatic Updates ###########
> 2007-12-05 20:22:58:606 1128 bb0 Agent Sending shutdown
> notification to client
> 2007-12-05 20:22:58:622 2316 b48 COMAPI WARNING: Received
> service shutdown/self-update notification.
> 2007-12-05 20:22:58:653 1128 bb0 Service *********
> 2007-12-05 20:22:58:653 1128 bb0 Service ** END **
> Service: Service exit [Exit code = 0x240001]
> 2007-12-05 20:22:58:653 1128 bb0 Service *************
>

See MowGreen's reply: The Defender update most definitely installed without
your approval. I strongly recommend zipping up your windowsupdate.log and
sending it to MowGreenATgmailDOTcom. He'll then pass it on to Microsoft for
analysis.

Are you running OneCare by any chance?
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L.ORG http://66.39.69.143/

Dave T. wrote:
> PA Bear wrote:
>> Windows version? What update? (Check your Update History at
>> http://windowsupdate.microsoft.com)
>
> I was windows defender update, 12/5/07. I'm running Vista Home Premium
> 32 bit.