system files not replaced on reboot!!!

Does anyone know how to diagnose the process that XP goes through to update
system files in use. During a Microsoft Update,there are sometimes files can
not be replaced and require a reboot.

My system does not complete the file updates after the reboot. If you read
the KB#.log file located in the Windows directory after the installation,
there will be a reference to a file and the tmp file that will be used to
replace the file upon reboot. If you check the versions of the file it was
to replace, it will still be the old version. If you check the version of the
..tmp file, it will be the newer version.

This tells me that the update process has not completed and the system has
some of the files updated but not all of them. It has really caused some
weird functionality. To temporarily fix some of the effects I have run PE
and renamed the .tmp files and over written the older versions with the
updates. This has helped, but the process is cumbersome and time consuming.

I have been looking for the reason that the system can't update files on
reboot. I suspect some form of trojan or spyware that has disabled this
functionality. Todate I haven't been able to resolve this.

--
MD

is there any error message in the Windows update log? To locate the file,
click "Start", "Run", type: %windir% and then press Enter.



"Mark D" wrote:

> Does anyone know how to diagnose the process that XP goes through to update
> system files in use. During a Microsoft Update,there are sometimes files can
> not be replaced and require a reboot.
>
> My system does not complete the file updates after the reboot. If you read
> the KB#.log file located in the Windows directory after the installation,
> there will be a reference to a file and the tmp file that will be used to
> replace the file upon reboot. If you check the versions of the file it was
> to replace, it will still be the old version. If you check the version of the
> .tmp file, it will be the newer version.
>
> This tells me that the update process has not completed and the system has
> some of the files updated but not all of them. It has really caused some
> weird functionality. To temporarily fix some of the effects I have run PE
> and renamed the .tmp files and over written the older versions with the
> updates. This has helped, but the process is cumbersome and time consuming.
>
> I have been looking for the reason that the system can't update files on
> reboot. I suspect some form of trojan or spyware that has disabled this
> functionality. Todate I haven't been able to resolve this.
>
> --
> MD

The following registry value should have the details on pending file
replacements that are scheduled to occur on the next reboot. You can take a
look after you install your next updates but before you reboot to see if it
is at least being populated correctly.

HKLM\System\CurrentControlSet\Control\Session Manager: REG_MULTI_SZ -
PendingFileRenameOperations


"Mark D" <> wrote in message
news:927CA051-01AB-4500-9E9A-...
> Does anyone know how to diagnose the process that XP goes through to
> update
> system files in use. During a Microsoft Update,there are sometimes files
> can
> not be replaced and require a reboot.
>
> My system does not complete the file updates after the reboot. If you
> read
> the KB#.log file located in the Windows directory after the installation,
> there will be a reference to a file and the tmp file that will be used to
> replace the file upon reboot. If you check the versions of the file it
> was
> to replace, it will still be the old version. If you check the version of
> the
> .tmp file, it will be the newer version.
>
> This tells me that the update process has not completed and the system has
> some of the files updated but not all of them. It has really caused some
> weird functionality. To temporarily fix some of the effects I have run PE
> and renamed the .tmp files and over written the older versions with the
> updates. This has helped, but the process is cumbersome and time
> consuming.
>
> I have been looking for the reason that the system can't update files on
> reboot. I suspect some form of trojan or spyware that has disabled this
> functionality. Todate I haven't been able to resolve this.
>
> --
> MD

Sorry for the long message but I thought the log file might assist. I also
checked the registry location suggested in another message
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contr ol\Session
Manager\FileRenameOperations" and there were no entries in the registry.
If you look at the bottom of the log file, there is a reference tothe
gdi32.dll that would be replaced on reboot. (atleast that is how I read it)

[KB912919.log]
10.465:
================================================== ==============================
10.465: 2006/01/25 19:21:31.239 (local)
10.475:
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\35fe7b19652e81d34148bc14421c553c\update\update. exe (version 6.2.29.0)
10.495: Hotfix started with following command line: /si
/ParentInfo:a16e609a58391c43b68cb0481d0deaeb
21.271: DoInstallation: CleanPFR failed: 0x2
21.331: SetProductTypes: InfProductBuildType=BuildType.IP
21.361: SetAltOsLoaderPath: No section uses DirId 65701; done.
22.022: CreateUninstall = 1,Directory = C:\WINDOWS\$NtUninstallKB912919$
22.022: LoadFileQueues: UpdSpGetSourceFileLocation for halacpi.dll failed:
0xe0000102
22.072: ref tag c:\windows\system32\sp4.cab does not exist
22.072: ref tag c:\windows\system32\sp3.cab does not exist
22.072: ref tag c:\windows\system32\sp2.cab does not exist
22.072: ref tag c:\windows\system32\sp1.cab does not exist
22.082: ref tag c:\windows\system32\driver.cab does not exist
22.082: ref tag c:\windows\system32\fp40ext.cab does not exist
22.082: ref tag c:\windows\system32\fp40ext1.cab does not exist
22.082: ref tag c:\windows\system32\wms4.cab does not exist
22.082: ref tag c:\windows\system32\wms41.cab does not exist
22.082: ref tag c:\windows\system32\ims.cab does not exist
22.082: ref tag c:\windows\system32\ims1.cab does not exist
22.082: ref tag c:\windows\system32\ins.cab does not exist
22.082: ref tag c:\windows\system32\ins1.cab does not exist
22.102: Starting AnalyzeComponents
22.102: AnalyzePhaseZero used 0 ticks
22.102: No c:\windows\INF\updtblk.inf file.
22.102: OEM file scan used 0 ticks
22.272: AnalyzePhaseOne: used 170 ticks
22.272: AnalyzeComponents: Hotpatch analysis disabled; skipping.
22.272: AnalyzeComponents: Hotpatching is disabled.
22.272: FindFirstFile c:\windows\$hf_mig$\*.*
24.656: KB912919 Setup encountered an error: The update.ver file is not
correct.
25.337: KB912919 Setup encountered an error: The update.ver file is not
correct.
26.278: KB912919 Setup encountered an error: The update.ver file is not
correct.
26.388: AnalyzeForBranching used 80 ticks.
26.398: AnalyzePhaseTwo used 10 ticks
26.398: AnalyzePhaseThree used 0 ticks
26.618: AnalyzePhaseFive used 220 ticks
26.618: AnalyzePhaseSix used 0 ticks
26.618: AnalyzeComponents used 4516 ticks
26.618: Downloading 2 files
26.618: bPatchMode = TRUE
26.618: Inventory complete: ReturnStatus=0, 4596 ticks
26.618: Num Ticks for invent : 4596
26.899: [dumpDownloadTask] Update.exe posting request file to download a
total of 75912 bytes (75912 bytes in patches and 0 bytes in fallbacks)
26.929: dumpDownloadTask returned 0xf200 (more files to download)
28.080: KB912919 installation did not complete.
28.080: Update.exe extended error code = 0xf200
7.581:
================================================== ==============================
7.591: 2006/01/25 19:22:05.208 (local)
7.591:
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\35fe7b19652e81d34148bc14421c553c\update\update. exe (version 6.2.29.0)
7.601: Hotfix started with following command line: /si
/ParentInfo:c7d09075b905dc4e89bec9a3fb2b8125
10.936: DoInstallation: CleanPFR failed: 0x2
10.976: SetProductTypes: InfProductBuildType=BuildType.IP
11.026: SetAltOsLoaderPath: No section uses DirId 65701; done.
11.156: Express: 75,912 bytes were downloaded.
11.867: [PatchFilesFromResponseBlob] returning STATUS_READY_TO_INSTALL
12.478: KB912919 installation did not complete.
12.478: Update.exe extended error code = 0xf201
10.425:
================================================== ==============================
10.465: 2006/01/25 19:24:52.899 (local)
10.465:
C:\WINDOWS\SoftwareDistribution\Download\7e9c3219e 54b43a6d50fc3202fbc3a2b\update\update.exe (version 6.2.29.0)
10.465: Failed To Enable SE_SHUTDOWN_PRIVILEGE
10.485: Hotfix started with following command line: -q /Z -ER
/ParentInfo:37c906e2c166164ba7a3451e71dc12b6
13.770: In Function TestVolatileFlag, line 11873, RegOpenKeyEx failed with
error 0x2
13.770: In Function TestVolatileFlag, line 11905, RegOpenKeyEx failed with
error 0x2
13.770: DoInstallation: CleanPFR failed: 0x2
13.820: SetProductTypes: InfProductBuildType=BuildType.IP
13.820: SetAltOsLoaderPath: No section uses DirId 65701; done.
14.130: CreateUninstall = 1,Directory = C:\WINDOWS\$NtUninstallKB912919$
14.130: LoadFileQueues: UpdSpGetSourceFileLocation for halacpi.dll failed:
0xe0000102
14.200: ref tag c:\windows\system32\sp4.cab does not exist
14.200: ref tag c:\windows\system32\sp3.cab does not exist
14.200: ref tag c:\windows\system32\sp2.cab does not exist
14.200: ref tag c:\windows\system32\sp1.cab does not exist
14.200: ref tag c:\windows\system32\driver.cab does not exist
14.200: ref tag c:\windows\system32\fp40ext.cab does not exist
14.200: ref tag c:\windows\system32\fp40ext1.cab does not exist
14.210: ref tag c:\windows\system32\wms4.cab does not exist
14.210: ref tag c:\windows\system32\wms41.cab does not exist
14.210: ref tag c:\windows\system32\ims.cab does not exist
14.210: ref tag c:\windows\system32\ims1.cab does not exist
14.210: ref tag c:\windows\system32\ins.cab does not exist
14.210: ref tag c:\windows\system32\ins1.cab does not exist
14.361: Starting AnalyzeComponents
14.361: AnalyzePhaseZero used 0 ticks
14.361: No c:\windows\INF\updtblk.inf file.
14.361: OEM file scan used 0 ticks
14.441: AnalyzePhaseOne: used 80 ticks
14.441: AnalyzeComponents: Hotpatch analysis disabled; skipping.
14.441: AnalyzeComponents: Hotpatching is disabled.
14.441: FindFirstFile c:\windows\$hf_mig$\*.*
16.344: KB912919 Setup encountered an error: The update.ver file is not
correct.
16.584: KB912919 Setup encountered an error: The update.ver file is not
correct.
16.734: KB912919 Setup encountered an error: The update.ver file is not
correct.
16.844: AnalyzeForBranching used 90 ticks.
16.844: AnalyzePhaseTwo used 0 ticks
16.844: AnalyzePhaseThree used 0 ticks
16.844: AnalyzePhaseFive used 0 ticks
16.844: AnalyzePhaseSix used 0 ticks
16.844: AnalyzeComponents used 2483 ticks
16.844: Downloading 0 files
16.844: bPatchMode = TRUE
16.844: Inventory complete: ReturnStatus=0, 2714 ticks
16.844: Num Ticks for invent : 2714
16.884: VerifyTargetFileSize: Unable to verify size as Source = NULL for
file c:\windows\inf\HFX5C.tmp
17.405: Copied file: c:\windows\inf\branches.inf
38.165: Allocation size of drive C: is 512 bytes, free space = 5608739840
bytes
38.175: AnalyzeDiskUsage: Skipping EstimateDiskUsageForUninstall.
38.175: Drive C: free 5348MB req: 11MB w/uninstall: NOT CALCULATED.
38.175: CabinetBuild complete
38.175: Num Ticks for Cabinet build : 21331
38.175: DynamicStrings section not defined or empty.
38.225: FileInUse:: Detection disabled.
39.226: LoadFileQueues: UpdSpGetSourceFileLocation for halacpi.dll failed:
0xe0000102
39.807: Num Ticks for Backup : 1632
41.660: Num Ticks for creating uninst inf : 1853
41.710: Registering Uninstall Program for -> KB912919, KB912919 , 0x0
41.710: LoadFileQueues: UpdSpGetSourceFileLocation for halacpi.dll failed:
0xe0000102
41.880: System Restore Point set.
42.541: Copied file: C:\WINDOWS\system32\spmsg.dll
42.621: PFE2: Not avoiding Per File Exceptions.
42.711: GetCatVersion: Failed to retrieve version information from
C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB912919.cat with error 0x57
44.144: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\update\update_SP2QFE.inf -> c:\windows\$hf_mig$\KB912919\update\update_SP2QFE. inf.
44.224: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\spuninst.exe -> c:\windows\$hf_mig$\KB912919\spuninst.exe.
44.354: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\spmsg.dll -> c:\windows\$hf_mig$\KB912919\spmsg.dll.
44.424: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\update\spcustom.dll -> c:\windows\$hf_mig$\KB912919\update\spcustom.dll.
44.444: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\update\KB912919.CAT -> c:\windows\$hf_mig$\KB912919\update\KB912919.CAT.
44.644: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\update\update.exe -> c:\windows\$hf_mig$\KB912919\update\update.exe.
44.814: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\update\updspapi.dll -> c:\windows\$hf_mig$\KB912919\update\updspapi.dll.
44.915: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\update\update.ver -> c:\windows\$hf_mig$\KB912919\update\update.ver.
44.925: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\update\updatebr.inf -> c:\windows\$hf_mig$\KB912919\update\updatebr.inf.
45.005: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\update\eula.txt -> c:\windows\$hf_mig$\KB912919\update\eula.txt.
45.005: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\update\branches.inf -> c:\windows\$hf_mig$\KB912919\update\branches.inf.
45.095: Copied file: C:\WINDOWS\system32\gdi32.dll
47.188: Copied file (delayed): C:\WINDOWS\system32\SET5D.tmp
47.228: Copied file: C:\WINDOWS\system32\DllCache\gdi32.dll
47.518: Copied file: c:\windows\$hf_mig$\KB912919\SP2QFE\gdi32.dll
47.889: DoInstallation: Installing assemblies with source root path:
c:\windows\softwaredistribution\download\7e9c3219e 54b43a6d50fc3202fbc3a2b\
47.889: Num Ticks for Copying files : 6229
47.999: Num Ticks for Reg update and deleting 0 size files : 110
48.039: ---- Old Information In The Registry ------
48.069: Source:C:\WINDOWS\system32\SET5D.tmp (5.1.2600.2818)
48.069: Destination:C:\WINDOWS\system32\gdi32.dll (5.1.2600.2770)
48.069: ---- New Information In The Registry ------
48.079: Source:C:\WINDOWS\system32\SET5D.tmp (5.1.2600.2818)
48.079: Destination:C:\WINDOWS\system32\gdi32.dll (5.1.2600.2770)
64.212: UpdateSpUpdSvcInf: Source [ProcessesToRunAfterReboot] section is
empty; nothing to do.
64.212: IsRebootRequiredForFileQueue: At least one file operation was
delayed; reboot is required.
If none are listed below, check above for
delayed deletes.
64.212: IsRebootRequiredForFileQueue: c:\windows\system32\gdi32.dll was
delayed; reboot is required.
64.212: DoInstallation: A reboot is required to complete the installation of
one or more files.
64.212: In Function SetVolatileFlag, line 11789, RegOpenKeyEx failed with
error 0x2
64.212: In Function SetVolatileFlag, line 11806, RegOpenKeyEx failed with
error 0x2
64.212: UpdateSpUpdSvcInf: Source
[ProcessesToRunAfterReboot.RebootNotRequired] section is empty; nothing to do.
68.589: RebootNecessary = 1,WizardInput = 1 , DontReboot = 1, ForceRestart = 0

--
MD


"Sam" wrote:

> is there any error message in the Windows update log? To locate the file,
> click "Start", "Run", type: %windir% and then press Enter.
>
>
>
> "Mark D" wrote:
>
> > Does anyone know how to diagnose the process that XP goes through to update
> > system files in use. During a Microsoft Update,there are sometimes files can
> > not be replaced and require a reboot.
> >
> > My system does not complete the file updates after the reboot. If you read
> > the KB#.log file located in the Windows directory after the installation,
> > there will be a reference to a file and the tmp file that will be used to
> > replace the file upon reboot. If you check the versions of the file it was
> > to replace, it will still be the old version. If you check the version of the
> > .tmp file, it will be the newer version.
> >
> > This tells me that the update process has not completed and the system has
> > some of the files updated but not all of them. It has really caused some
> > weird functionality. To temporarily fix some of the effects I have run PE
> > and renamed the .tmp files and over written the older versions with the
> > updates. This has helped, but the process is cumbersome and time consuming.
> >
> > I have been looking for the reason that the system can't update files on
> > reboot. I suspect some form of trojan or spyware that has disabled this
> > functionality. Todate I haven't been able to resolve this.
> >
> > --
> > MD

I did notice that the registry value was indeed populated with the
appropriate files.

\??\C:\WINDOWS\system32\SET5D.tmp
!\??\C:\WINDOWS\system32\gdi32.dll


Sorry to all for not seeing the registry value. I was looking in the
"filerenameoperations" key.

Now I will reboot to see if this is successful.
--
MD


"@echo off" wrote:

> The following registry value should have the details on pending file
> replacements that are scheduled to occur on the next reboot. You can take a
> look after you install your next updates but before you reboot to see if it
> is at least being populated correctly.
>
> HKLM\System\CurrentControlSet\Control\Session Manager: REG_MULTI_SZ -
> PendingFileRenameOperations
>
>
> "Mark D" <> wrote in message
> news:927CA051-01AB-4500-9E9A-...
> > Does anyone know how to diagnose the process that XP goes through to
> > update
> > system files in use. During a Microsoft Update,there are sometimes files
> > can
> > not be replaced and require a reboot.
> >
> > My system does not complete the file updates after the reboot. If you
> > read
> > the KB#.log file located in the Windows directory after the installation,
> > there will be a reference to a file and the tmp file that will be used to
> > replace the file upon reboot. If you check the versions of the file it
> > was
> > to replace, it will still be the old version. If you check the version of
> > the
> > .tmp file, it will be the newer version.
> >
> > This tells me that the update process has not completed and the system has
> > some of the files updated but not all of them. It has really caused some
> > weird functionality. To temporarily fix some of the effects I have run PE
> > and renamed the .tmp files and over written the older versions with the
> > updates. This has helped, but the process is cumbersome and time
> > consuming.
> >
> > I have been looking for the reason that the system can't update files on
> > reboot. I suspect some form of trojan or spyware that has disabled this
> > functionality. Todate I haven't been able to resolve this.
> >
> > --
> > MD
>
>
>