Windows update hangs on XP SP2 machine with error 0x000006b5

Booted an older XP home machine that has not connected to internet in about 6
months. Onecare update runs fine, then Windows update runs. Finds 32
updates, downloads 6, takes over 1 hour on 7th update download. Internet
connection is high speed cable. IE window and XP screen starts to show
signs of lack of resources, with icons and buttons disappearing off the
screen (reminded me of what W98 used to do). Finally after 2 hours I
canceled it. Cancel itself runs an hour. I have to powerswitch to turn off
machine.

I restart, I check log and find

CatalogDB: 11:21:13 PM 10/30/2008: File #3 at line #330 encountered error
0x000006b5
CatalogDB: 11:21:14 PM 10/30/2008: File #2 at line #2208 encountered error
0x000006b5

etc etc, (more lines with same error)

Restarting windows update does nothing. I get the first green dot in the
bottom of the IE status bar and then NOTHING... blank IE window, no list of
updates to install, just a blank screen hanging there for hour +. Have to
control alt delete to kill IE.

Any advice on how to reset windows update to get it to run??

Is your OneCare subscription current?

What's the 7th update?

Is Automatic Updates enabled and working?

You have many symptoms of a hijackware infection...

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjunction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://spywarehammer.com/simplemachi...php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or another appropriate forum for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

zigner wrote:
> Booted an older XP home machine that has not connected to internet in
> about
> 6 months. Onecare update runs fine, then Windows update runs. Finds 32
> updates, downloads 6, takes over 1 hour on 7th update download. Internet
> connection is high speed cable. IE window and XP screen starts to show
> signs of lack of resources, with icons and buttons disappearing off the
> screen (reminded me of what W98 used to do). Finally after 2 hours I
> canceled it. Cancel itself runs an hour. I have to powerswitch to turn
> off
> machine.
>
> I restart, I check log and find
>
> CatalogDB: 11:21:13 PM 10/30/2008: File #3 at line #330 encountered error
> 0x000006b5
> CatalogDB: 11:21:14 PM 10/30/2008: File #2 at line #2208 encountered error
> 0x000006b5
>
> etc etc, (more lines with same error)
>
> Restarting windows update does nothing. I get the first green dot in the
> bottom of the IE status bar and then NOTHING... blank IE window, no list
> of
> updates to install, just a blank screen hanging there for hour +. Have
> to
> control alt delete to kill IE.
>
> Any advice on how to reset windows update to get it to run??

"PA Bear [MS MVP]" wrote:

> Is your OneCare subscription current?

Yes, 8 months remaining.
>
> What's the 7th update?
>
I don't know which it was, I cannot even get to the point of seeing the WU
website.
> Is Automatic Updates enabled and working?

I have it set to manual updates, since it is sometimes used not with
internet connection.
>
> You have many symptoms of a hijackware infection...
>

MANY symptoms? Here is the last from that web page

• When you start your computer, or when your computer has been idle for many
minutes, your Internet browser opens to display Web site advertisements.

NEVER

• When you use your browser to view Web sites, other instances of your
browser open to display Web site advertisements.

NEVER

• Your Web browser's home page unexpectedly changes.
NEVER

• Web pages are unexpectedly added to your Favorites folder.
NEVER

• New toolbars are unexpectedly added to your Web browser.
NEVER

• You cannot start a program.
All programs I tried run fine.

• When you click a link in a program, the link does not work.
NO

• Your Web browser suddenly closes or stops responding.
ONLY when running windows update, and then ONLY the tab running WU stops
responding.

• It takes a much longer time to start or to resume your computer.
No, same as usual.

• Components of Windows or other programs no longer work.
Only WU has an issue


I ran a full windows one care scan and spysweeper and had no spyware hits.


> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> zigner wrote:
> > Booted an older XP home machine that has not connected to internet in
> > about
> > 6 months. Onecare update runs fine, then Windows update runs. Finds 32
> > updates, downloads 6, takes over 1 hour on 7th update download. Internet
> > connection is high speed cable. IE window and XP screen starts to show
> > signs of lack of resources, with icons and buttons disappearing off the
> > screen (reminded me of what W98 used to do). Finally after 2 hours I
> > canceled it. Cancel itself runs an hour. I have to powerswitch to turn
> > off
> > machine.
> >
> > I restart, I check log and find
> >
> > CatalogDB: 11:21:13 PM 10/30/2008: File #3 at line #330 encountered error
> > 0x000006b5
> > CatalogDB: 11:21:14 PM 10/30/2008: File #2 at line #2208 encountered error
> > 0x000006b5
> >
> > etc etc, (more lines with same error)
> >
> > Restarting windows update does nothing. I get the first green dot in the
> > bottom of the IE status bar and then NOTHING... blank IE window, no list
> > of
> > updates to install, just a blank screen hanging there for hour +. Have
> > to
> > control alt delete to kill IE.
> >
> > Any advice on how to reset windows update to get it to run??
>
>

>>Is Automatic Updates enabled and working?
>
>
> I have it set to manual updates, since it is sometimes used not with
> internet connection.

Manual in the Services console [the AU service] or is the AU applet in
Control Panel set to " Notify " ?

Suggest we check the WindowsUpdate.log for errors, zigner:

How to read the Windowsupdate.log file
http://support.microsoft.com/kb/902093

Start at the bottom of the log for the most recent entries. What you're
looking for are FATAL or WARNING entries. Please post back with the most
recent section of the log that contains those error codes.

The long download you describe sounds like XP SP3. What I suspect
occurred is that the system needed to be updated to the latest Version
of the Windows Update Agent and due to the amount of updates being
downloaded, something 'screwed the pooch' prior to the WUA being
updated. That fits with the lack of scan progress and blank IE page when
hitting WU.

Is Spysweeper actively monitoring the system at the same time OneCare
is ?


MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============





zigner wrote:

>
> "PA Bear [MS MVP]" wrote:
>
>
>>Is your OneCare subscription current?
>
>
> Yes, 8 months remaining.
>
>>What's the 7th update?
>>
>
> I don't know which it was, I cannot even get to the point of seeing the WU
> website.
>
>>Is Automatic Updates enabled and working?
>
>
> I have it set to manual updates, since it is sometimes used not with
> internet connection.
>
>>You have many symptoms of a hijackware infection...
>>
>
>
> MANY symptoms? Here is the last from that web page
>
> • When you start your computer, or when your computer has been idle for many
> minutes, your Internet browser opens to display Web site advertisements.
>
> NEVER
>
> • When you use your browser to view Web sites, other instances of your
> browser open to display Web site advertisements.
>
> NEVER
>
> • Your Web browser's home page unexpectedly changes.
> NEVER
>
> • Web pages are unexpectedly added to your Favorites folder.
> NEVER
>
> • New toolbars are unexpectedly added to your Web browser.
> NEVER
>
> • You cannot start a program.
> All programs I tried run fine.
>
> • When you click a link in a program, the link does not work.
> NO
>
> • Your Web browser suddenly closes or stops responding.
> ONLY when running windows update, and then ONLY the tab running WU stops
> responding.
>
> • It takes a much longer time to start or to resume your computer.
> No, same as usual.
>
> • Components of Windows or other programs no longer work.
> Only WU has an issue
>
>
> I ran a full windows one care scan and spysweeper and had no spyware hits.
>
>
>
>>~Robear Dyer (PA Bear)
>>MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>AumHa VSOP & Admin http://aumha.net
>>DTS-L http://dts-l.net/
>>
>>zigner wrote:
>>
>>>Booted an older XP home machine that has not connected to internet in
>>>about
>>>6 months. Onecare update runs fine, then Windows update runs. Finds 32
>>>updates, downloads 6, takes over 1 hour on 7th update download. Internet
>>>connection is high speed cable. IE window and XP screen starts to show
>>>signs of lack of resources, with icons and buttons disappearing off the
>>>screen (reminded me of what W98 used to do). Finally after 2 hours I
>>>canceled it. Cancel itself runs an hour. I have to powerswitch to turn
>>>off
>>>machine.
>>>
>>>I restart, I check log and find
>>>
>>>CatalogDB: 11:21:13 PM 10/30/2008: File #3 at line #330 encountered error
>>>0x000006b5
>>>CatalogDB: 11:21:14 PM 10/30/2008: File #2 at line #2208 encountered error
>>>0x000006b5
>>>
>>>etc etc, (more lines with same error)
>>>
>>>Restarting windows update does nothing. I get the first green dot in the
>>>bottom of the IE status bar and then NOTHING... blank IE window, no list
>>>of
>>>updates to install, just a blank screen hanging there for hour +. Have
>>>to
>>>control alt delete to kill IE.
>>>
>>>Any advice on how to reset windows update to get it to run??
>>
>>

> • Your Web browser suddenly closes or stops responding.
> ONLY when running windows update, and then ONLY the tab running WU stops
> responding.
> <snip>
> • Components of Windows or other programs no longer work.
> Only WU has an issue

Those are both possibly indicative of a hijackware infection.

Start | Run | (type) winver | OK => What WinXP version is displayed here?

>> Is Automatic Updates enabled and working?
>
> I have it set to manual updates, since it is sometimes used not with
> internet connection.

As Mow suggested:

1. Enable Automatic Updates and choose the "Notify me but..." option. See
http://support.microsoft.com/kb/306525

2. Examine your WindowsUpdate.log for recent errors (start at the bottom and
work your way up).


zigner wrote:
> "PA Bear [MS MVP]" wrote:
>
>> Is your OneCare subscription current?
>
> Yes, 8 months remaining.
>>
>> What's the 7th update?
>>
> I don't know which it was, I cannot even get to the point of seeing the WU
> website.
>> Is Automatic Updates enabled and working?
>
> I have it set to manual updates, since it is sometimes used not with
> internet connection.
>>
>> You have many symptoms of a hijackware infection...
>>
>
> MANY symptoms? Here is the last from that web page
>
> • When you start your computer, or when your computer has been idle for
> many
> minutes, your Internet browser opens to display Web site advertisements.
>
> NEVER
>
> • When you use your browser to view Web sites, other instances of your
> browser open to display Web site advertisements.
>
> NEVER
>
> • Your Web browser's home page unexpectedly changes.
> NEVER
>
> • Web pages are unexpectedly added to your Favorites folder.
> NEVER
>
> • New toolbars are unexpectedly added to your Web browser.
> NEVER
>
> • You cannot start a program.
> All programs I tried run fine.
>
> • When you click a link in a program, the link does not work.
> NO
>
> • Your Web browser suddenly closes or stops responding.
> ONLY when running windows update, and then ONLY the tab running WU stops
> responding.
>
> • It takes a much longer time to start or to resume your computer.
> No, same as usual.
>
> • Components of Windows or other programs no longer work.
> Only WU has an issue
>
>
> I ran a full windows one care scan and spysweeper and had no spyware hits.
>
>
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>> AumHa VSOP & Admin http://aumha.net
>> DTS-L http://dts-l.net/
>>
>> zigner wrote:
>>> Booted an older XP home machine that has not connected to internet in
>>> about
>>> 6 months. Onecare update runs fine, then Windows update runs. Finds 32
>>> updates, downloads 6, takes over 1 hour on 7th update download.
>>> Internet
>>> connection is high speed cable. IE window and XP screen starts to show
>>> signs of lack of resources, with icons and buttons disappearing off the
>>> screen (reminded me of what W98 used to do). Finally after 2 hours I
>>> canceled it. Cancel itself runs an hour. I have to powerswitch to turn
>>> off
>>> machine.
>>>
>>> I restart, I check log and find
>>>
>>> CatalogDB: 11:21:13 PM 10/30/2008: File #3 at line #330 encountered
>>> error
>>> 0x000006b5
>>> CatalogDB: 11:21:14 PM 10/30/2008: File #2 at line #2208 encountered
>>> error
>>> 0x000006b5
>>>
>>> etc etc, (more lines with same error)
>>>
>>> Restarting windows update does nothing. I get the first green dot in
>>> the
>>> bottom of the IE status bar and then NOTHING... blank IE window, no list
>>> of
>>> updates to install, just a blank screen hanging there for hour +. Have
>>> to
>>> control alt delete to kill IE.
>>>
>>> Any advice on how to reset windows update to get it to run??

"PA Bear [MS MVP]" wrote:

> > • Your Web browser suddenly closes or stops responding.
> > ONLY when running windows update, and then ONLY the tab running WU stops
> > responding.
> > <snip>
> > • Components of Windows or other programs no longer work.
> > Only WU has an issue
>
> Those are both possibly indicative of a hijackware infection.
>
> Start | Run | (type) winver | OK => What WinXP version is displayed here?
>
> >> Is Automatic Updates enabled and working?
> >
> > I have it set to manual updates, since it is sometimes used not with
> > internet connection.
>
> As Mow suggested:
>
> 1. Enable Automatic Updates and choose the "Notify me but..." option. See
> http://support.microsoft.com/kb/306525
>
> 2. Examine your WindowsUpdate.log for recent errors (start at the bottom and
> work your way up).
>
>
> zigner wrote:
> > "PA Bear [MS MVP]" wrote:
> >
> >> Is your OneCare subscription current?
> >
> > Yes, 8 months remaining.
> >>
> >> What's the 7th update?
> >>
> > I don't know which it was, I cannot even get to the point of seeing the WU
> > website.
> >> Is Automatic Updates enabled and working?
> >
> > I have it set to manual updates, since it is sometimes used not with
> > internet connection.
> >>
> >> You have many symptoms of a hijackware infection...
> >>
> >
> > MANY symptoms? Here is the last from that web page
> >
> > • When you start your computer, or when your computer has been idle for
> > many
> > minutes, your Internet browser opens to display Web site advertisements.
> >
> > NEVER
> >
> > • When you use your browser to view Web sites, other instances of your
> > browser open to display Web site advertisements.
> >
> > NEVER
> >
> > • Your Web browser's home page unexpectedly changes.
> > NEVER
> >
> > • Web pages are unexpectedly added to your Favorites folder.
> > NEVER
> >
> > • New toolbars are unexpectedly added to your Web browser.
> > NEVER
> >
> > • You cannot start a program.
> > All programs I tried run fine.
> >
> > • When you click a link in a program, the link does not work.
> > NO
> >
> > • Your Web browser suddenly closes or stops responding.
> > ONLY when running windows update, and then ONLY the tab running WU stops
> > responding.
> >
> > • It takes a much longer time to start or to resume your computer.
> > No, same as usual.
> >
> > • Components of Windows or other programs no longer work.
> > Only WU has an issue
> >
> >
> > I ran a full windows one care scan and spysweeper and had no spyware hits.
> >
> >
> >> ~Robear Dyer (PA Bear)
> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> >> AumHa VSOP & Admin http://aumha.net
> >> DTS-L http://dts-l.net/
> >>
> >> zigner wrote:
> >>> Booted an older XP home machine that has not connected to internet in
> >>> about
> >>> 6 months. Onecare update runs fine, then Windows update runs. Finds 32
> >>> updates, downloads 6, takes over 1 hour on 7th update download.
> >>> Internet
> >>> connection is high speed cable. IE window and XP screen starts to show
> >>> signs of lack of resources, with icons and buttons disappearing off the
> >>> screen (reminded me of what W98 used to do). Finally after 2 hours I
> >>> canceled it. Cancel itself runs an hour. I have to powerswitch to turn
> >>> off
> >>> machine.
> >>>
> >>> I restart, I check log and find
> >>>
> >>> CatalogDB: 11:21:13 PM 10/30/2008: File #3 at line #330 encountered
> >>> error
> >>> 0x000006b5
> >>> CatalogDB: 11:21:14 PM 10/30/2008: File #2 at line #2208 encountered
> >>> error
> >>> 0x000006b5
> >>>
> >>> etc etc, (more lines with same error)
> >>>
> >>> Restarting windows update does nothing. I get the first green dot in
> >>> the
> >>> bottom of the IE status bar and then NOTHING... blank IE window, no list
> >>> of
> >>> updates to install, just a blank screen hanging there for hour +. Have
> >>> to
> >>> control alt delete to kill IE.
> >>>
> >>> Any advice on how to reset windows update to get it to run??
>
>

Hi to answer the questions. No I only run spysweeper on demand. It is not
automatically started. As far as the log, I already did post the last lines
where there is an error. There are no other errors in the recent entries.
What does error 6b5 mean? I searched and found no references

""CatalogDB: 11:21:13 PM 10/30/2008: File #3 at line #330 encountered
>>> error
>>> 0x000006b5
>>> CatalogDB: 11:21:14 PM 10/30/2008: File #2 at line #2208 encountered
>>> error
>>> 0x000006b5

there are several more of these same errors.

What you say about SP3 may be true, it had gone for an hour plus, and my
network monitor showed VERY little activity. So perhaps the MS update server
was slow/ non responsive.

In that case, how should I proceed? I assume there is some way of resetting
the windows update information my machine so that it will re attempt the
downloads?

"zigner" <> wrote in message news:4A4F4AE1-C5CF-4A1F-AB8C-...

> As far as the log, I already did post the last lines where there is an error.
> There are no other errors in the recent entries.

> What does error 6b5 mean? I searched and found no references


<cmd_output OS="XPsp3">
E:\>set /a c = 0x6b5
1717
E:\>net helpmsg %c%

The interface is unknown.
</cmd_output>


Instead of just extracting records which contain the codes you
search for it would be more helpful to show their *context*.
E.g. *which* interface is "unknown". That is probably significant. ; )

Also, you could try searching all the files that the update wrote to
for *both* the hex and decimal values of the codes.
Sometimes you can see a better context from the decimal value;
then, for example, the hex string only has context in a summary
error report.


Good luck

Robert Aldwinckle
---


>
> ""CatalogDB: 11:21:13 PM 10/30/2008: File #3 at line #330 encountered
>>>> error
>>>> 0x000006b5
>>>> CatalogDB: 11:21:14 PM 10/30/2008: File #2 at line #2208 encountered
>>>> error
>>>> 0x000006b5
>
> there are several more of these same errors.
>
> What you say about SP3 may be true, it had gone for an hour plus, and my
> network monitor showed VERY little activity. So perhaps the MS update server
> was slow/ non responsive.
>
> In that case, how should I proceed? I assume there is some way of resetting
> the windows update information my machine so that it will re attempt the
> downloads?

zigner wrote:

>
> Hi to answer the questions. No I only run spysweeper on demand. It is not
> automatically started. As far as the log, I already did post the last lines
> where there is an error. There are no other errors in the recent entries.
> What does error 6b5 mean? I searched and found no references
>
> ""CatalogDB: 11:21:13 PM 10/30/2008: File #3 at line #330 encountered
>
>>>>error
>>>>0x000006b5
>>>>CatalogDB: 11:21:14 PM 10/30/2008: File #2 at line #2208 encountered
>>>>error
>>>>0x000006b5
>
>
> there are several more of these same errors.
>
> What you say about SP3 may be true, it had gone for an hour plus, and my
> network monitor showed VERY little activity. So perhaps the MS update server
> was slow/ non responsive.
>
> In that case, how should I proceed? I assume there is some way of resetting
> the windows update information my machine so that it will re attempt the
> downloads?

0x000006B5 - RPC_S_UNKNOWN_IF
The interface is unknown.


Either there is an add-on in IE that is causing this error, the contents
of the Catroot2 subfolder, or the DataBase.ebd file are corrupted. You
can replace both the subfolder and the DataBase.ebd by running the AU
Reset tool. This will delete all the history shown on the WU site,
though. That would eliminate Catroot2 and DataBase.edb as being the
cause of the issue:

AU Check (v78a)
http://www.codeplex.com/aureset/Rele...eleaseId=17263

Download and *save* au_check_v78a_codeplex.exe.
Once the download completes disable all processes and services of
OneCare related to antivirus/spyware, but ***leave the firewall
running**. You can disable that, too, but you will need to enable the
native Windows firewall as the system must be connected so that the tool
can download the required updating software components.

Now run au_check_v78a_codeplex.exe and allow it time to complete it's
operation.
Reboot afterwards.
Try to update.
If updating fails once more, post the last 50 or so lines of the
WindowsUpdate.log, please.

MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============

Well, I had put this old machine aside for a time, and finally today stumbled
on the fix. It appears that somehow Windows Live One Care was the cause of
my Windows Update problems. I am not 100% sure, but I believe a One Care
update was taking place when my Windows update was running.

Today I had so many issues with One Care's window popping up on the screen
repeatedly, that I uninstalled one care. As soon as I did that and rebooted,
Windows XP told me it was ready to install updates THAT HAD BEEN ALREADY
DOWNLOADED. So it appears that One Care was preventing the install and
causing the error.

Thanks to those who offered suggestions.

Perhaps my discovery will help someone else with this rare issue.

When I rebooted I see now it is now downloading and installing 48 additional
updates!