Update installs but comes back

I have WSUS running on my network. I have one machine that says it needs to
install an update. I manually install the update, reboot the machine only for
the winndow update icon to pop back up and tell me I need to install the same
update I just installed and rebooted from. Any suggestions? Thanks in advance.

This morning I had the same issue. The item is MS05-013 (KB891781) but the
problem seems to be isolated to me; my co-workers haven't seen this issue. I
have followed the same procedures as you but I think the problem is not
necessarily related to the update but possibly to a piece of software that I
installed & then uninstalled yesterday. Where in the registry does automatic
updates look to see if this fix is installed or does it look for a file?
Finally, Add / Remove programs shows that this update is installed but MS
Baseline Security Analyzer states that is it *not* installed.

Oye!

"Steve" wrote:

> I have WSUS running on my network. I have one machine that says it needs to
> install an update. I manually install the update, reboot the machine only for
> the winndow update icon to pop back up and tell me I need to install the same
> update I just installed and rebooted from. Any suggestions? Thanks in advance.
>
>

"Matt" <> wrote in message
news:B8C72EFF-90FC-4AEB-AAC5-...
> This morning I had the same issue. The item is MS05-013 (KB891781) but the
> problem seems to be isolated to me; my co-workers haven't seen this issue. I
> have followed the same procedures as you but I think the problem is not
> necessarily related to the update but possibly to a piece of software that I
> installed & then uninstalled yesterday. Where in the registry does automatic
> updates look to see if this fix is installed or does it look for a file?
> Finally, Add / Remove programs shows that this update is installed but MS
> Baseline Security Analyzer states that is it *not* installed.


That suggests that the files involved were not copied,
a symptom which may be due to leaving security software
running during the install or copy phase of an update.
It could also be due to a problem with file permissions.
Etc.

Try uninstalling the problem update and then reinstalling it
under more controlled conditions. E.g. you shouldn't need
to be connected to the internet to install it so you could disable
your security programs while doing that after first disconnecting.

Looking at the Security Bulletin it appears that there is no verbose
logging option. So, if a more controlled install doesn't help and
there are insufficient clues in the install log about what happened
I would try using FileMon to supplement the log messages.
E.g. filter with just the name of the install program.

Neither of you has disclosed the OS involved so I can't be more specific
about what module versions you could be checking for, etc.


Good luck

Robert Aldwinckle
---

Thank you, Robert, for the reply back.

Sorry about not posting which OS I am using. I am using XP SP2 with all the
current updates. I will give your idea a whirl. I had already downloaded
the administrative installation package, uninstalled the old installation and
reinstalled without avail. I have not, however, disabled my antivirus nor
the MS Spyware Beta but will try that next.

My reasoning behind thinking the software I had installed yesterday caused
this issue is that my machine is kept completely up to date. This means that
this patch was installed last Feb or Mar when it came out and my machine has
been running fine until I booted up this morning. Now I have this one patch
that is giving me problems.

"Robert Aldwinckle" wrote:

> "Matt" <> wrote in message
> news:B8C72EFF-90FC-4AEB-AAC5-...
> > This morning I had the same issue. The item is MS05-013 (KB891781) but the
> > problem seems to be isolated to me; my co-workers haven't seen this issue. I
> > have followed the same procedures as you but I think the problem is not
> > necessarily related to the update but possibly to a piece of software that I
> > installed & then uninstalled yesterday. Where in the registry does automatic
> > updates look to see if this fix is installed or does it look for a file?
> > Finally, Add / Remove programs shows that this update is installed but MS
> > Baseline Security Analyzer states that is it *not* installed.
>
>
> That suggests that the files involved were not copied,
> a symptom which may be due to leaving security software
> running during the install or copy phase of an update.
> It could also be due to a problem with file permissions.
> Etc.
>
> Try uninstalling the problem update and then reinstalling it
> under more controlled conditions. E.g. you shouldn't need
> to be connected to the internet to install it so you could disable
> your security programs while doing that after first disconnecting.
>
> Looking at the Security Bulletin it appears that there is no verbose
> logging option. So, if a more controlled install doesn't help and
> there are insufficient clues in the install log about what happened
> I would try using FileMon to supplement the log messages.
> E.g. filter with just the name of the install program.
>
> Neither of you has disclosed the OS involved so I can't be more specific
> about what module versions you could be checking for, etc.
>
>
> Good luck
>
> Robert Aldwinckle
> ---
>
>
>

"Matt" <> wrote in message
news:1622BF13-B409-45FE-B3FC-
....
> Thank you, Robert, for the reply back.
>
> Sorry about not posting which OS I am using. I am using XP SP2 with all the
> current updates. I will give your idea a whirl. I had already downloaded
> the administrative installation package, uninstalled the old installation and
> reinstalled without avail. I have not, however, disabled my antivirus nor
> the MS Spyware Beta but will try that next.
>
> My reasoning behind thinking the software I had installed yesterday caused
> this issue is that my machine is kept completely up to date. This means that
> this patch was installed last Feb or Mar when it came out and my machine has
> been running fine until I booted up this morning. Now I have this one patch
> that is giving me problems.


>>> The item is MS05-013 (KB891781)

http://www.microsoft.com/technet/sec.../MS05-013.mspx

<extract>
Dhtmled.ocx 6.1.0.9232 11-Jan-2005 01:00 128,512 SP2GDR

Dhtmled.ocx 6.1.0.9232 11-Jan-2005 01:05 128,512 SP2QFE
</extract>


Did you move %ProgramFiles%?
That appears to be where dhtmled.ocx is located.

Also, notice that the version number is not a sufficient differentiator
for knowing what you have installed. Both SP2GDR and SP2QFE
are identical except for their timestamps (and presumably their checksums).
Best checked with filever /s /v dhtmled.ocx (e.g. in a cmd window)
Hint: filever is one of the XP Pro Support Tools.

Oops. There is no timestamp and no detailed version displayed
by that tool. Then the only other tool that I know of is
msinfo32 /category SWEnvLoadedModules
(providing you know how to make it appear loaded ; [ )


Hmm... somehow I have an even later version of that module...

Aha. Did you try the IE7 Beta by any chance? <eg>


HTH

Robert
---

Hi Robert -

I have not installed the IE7 beta. I checked the version of dhtmled.ocx on
my computer and it is older than the one included in the update. I have
located the location where the new version of dhtmled.ocx gets copied. I
have also located the registry keys that the update creates and found 2
problems. The first is that the dhtmled.ocx file does not get updated. The
second is that the registry key only gets half the entry. Their are 2
portions to the registry key: 1 that shows where the installer location is
and the second is the actual location of the file that is installed. The
latter entry is missing.

So, I tried to manually update my computer. I put the updated file in place
and created the registry entry that was missing. There was 1 snag, though
that I couldn't figure out how to overcome. Part of the registry entry is a
checksum for the file copied. I could not figure out how to generate the
checksum that would work. As such, I am still getting the message to install
this update.

Here is the registry key that was missing & that I created:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Wind ows
XP\SP3\KB891781\Filelist\0]
"BuildCheckSum"=""
"BuildDate"="Mon Jan 10 17:05:21 2005"
"FileName"="dhtmled.ocx"
"Location"="C:\\Program Files\\Common Files\\microsoft shared\\triedit"
"Version"="6.1.0.9232"

Here is the registry key that was there. I renamed the key from "0" to "1"
because the key above needed to be "0". I determined that because all the
other registry keys for updates are done this way:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Wind ows
XP\SP3\KB891781\Filelist\1]
"FileName"="dhtmled.ocx"
"Version"="6.1.0.9232"
"BuildDate"="Mon Jan 10 17:05:21 2005"
"BuildCheckSum"="1f997"
"Location"="c:\\windows\\$hf_mig$\\KB891781\\SP2QF E"

I checked permissions on the file & folders and didn't see anything wrong.
Administrators, Creator Owner & System have full permissions, Power Users has
modify & Users has read & execute. Registry keys have virtually the same
permissions. The difference: Users has only read permissions & my own
account has full permissions.

Again, thank you for the help.

Matt

"Robert Aldwinckle" wrote:

> "Matt" <> wrote in message
> news:1622BF13-B409-45FE-B3FC-
> ....
> > Thank you, Robert, for the reply back.
> >
> > Sorry about not posting which OS I am using. I am using XP SP2 with all the
> > current updates. I will give your idea a whirl. I had already downloaded
> > the administrative installation package, uninstalled the old installation and
> > reinstalled without avail. I have not, however, disabled my antivirus nor
> > the MS Spyware Beta but will try that next.
> >
> > My reasoning behind thinking the software I had installed yesterday caused
> > this issue is that my machine is kept completely up to date. This means that
> > this patch was installed last Feb or Mar when it came out and my machine has
> > been running fine until I booted up this morning. Now I have this one patch
> > that is giving me problems.
>
>
> >>> The item is MS05-013 (KB891781)
>
> http://www.microsoft.com/technet/sec.../MS05-013.mspx
>
> <extract>
> Dhtmled.ocx 6.1.0.9232 11-Jan-2005 01:00 128,512 SP2GDR
>
> Dhtmled.ocx 6.1.0.9232 11-Jan-2005 01:05 128,512 SP2QFE
> </extract>
>
>
> Did you move %ProgramFiles%?
> That appears to be where dhtmled.ocx is located.
>
> Also, notice that the version number is not a sufficient differentiator
> for knowing what you have installed. Both SP2GDR and SP2QFE
> are identical except for their timestamps (and presumably their checksums).
> Best checked with filever /s /v dhtmled.ocx (e.g. in a cmd window)
> Hint: filever is one of the XP Pro Support Tools.
>
> Oops. There is no timestamp and no detailed version displayed
> by that tool. Then the only other tool that I know of is
> msinfo32 /category SWEnvLoadedModules
> (providing you know how to make it appear loaded ; [ )
>
>
> Hmm... somehow I have an even later version of that module...
>
> Aha. Did you try the IE7 Beta by any chance? <eg>
>
>
> HTH
>
> Robert
> ---
>
>
>

"Matt" <> wrote in message
news:2F8EC42B-F003-4BA6-8941-
....
> So, I tried to manually update my computer. I put the updated file in place
> and created the registry entry that was missing.


I think a better tack would be *uninstalling* the update.
Then check that the old version of the module is what it
would be and the registry is back to normal for it not being
installed.

Then, try installing it again in the more consistent environment.
Turn on all traces (JIC <w>) but hopefully you won't need them.

BTW supposedly the uninstall when executed from
the command line has a verbose logging option too if that
seems useful. Of course, you could always use FileMon
and RegMon to supplement any logging it does anyway.


> I checked permissions on the file & folders and didn't see anything wrong.


Do you think that you would have had any security programs running
the first time the install was done? If so, they might have interfered
with the full update procedure and that would account for the partially
updated state. Before you do the actual update, especially one
which may involve a required reboot, I think it could be a good idea
to *disable* such programs to prevent the possibility of such interference.
You don't have to be connected in order to do the actual install
so there should be no exposure provided you leave the link stopped
as well.


Good luck

Robert
---