Being prompted for Updates that have been installed???

Discussion in 'Windows Update' started by Mark D, Nov 28, 2005.

  1. Mark D

    Mark D Guest

    I have 5 critical updates that do not seem to get installed properly. I have
    tried one at a time, in numeric order, downloading and installing in safe

    I don't get any errors, I get success messages for installs. Then when I
    return the the update site or when the Automatic Update notification pops up,
    the same 5 updates are there...

    I have reset the Automatic Updates forlder by stopping the service and
    removing the directory.

    Nothing seems to work. I have Adaware, Spybot, and Spyblaster spyware
    scanners running as well as McAfee Antivirus 8i. I have even scanned online
    using Trend Micro's online scanner. Can't find any significant issues with
    spyware or virus'.

    I do get explorer.exe crashing after a reboot because it attempt to access
    restricted memory. DEP seems to be configured correctly. After the crash, I
    log off and on and usually everything works just fine.

    Any suggestions welcome.
    Mark D, Nov 28, 2005
    1. Advertisements

  2. Mark D

    Mark D Guest

    Forgot to include the list of updates.

    There was 6 on Friday, but somehow I have reduced it to 5... accidentally

    Cumulative Security update for Internet Explorer for Windows XP (KB896688)
    Security update for Windows XP(KB896424)
    Security update for Windows XP(KB900725)
    Security update for Windows XP(KB902400)
    Security update for Windows XP(KB905749)

    Security update for Windows XP(KB905414) Seems to have gone away finally.
    Mark D, Nov 28, 2005
    1. Advertisements

  3. Mark D

    Mark D Guest

    Well, I seem to be the only one posting to my question.

    Have done much more investigation and have discovered a resolution to the
    Microsoft Update problem and will probably need to take this to another forum
    for further discussion.

    What I determined is that Microsoft Update is working just fine. What
    appears to be broken is the reboot process that is supposed to put in the
    system files that are in use during the update.

    How did I determine this.... I looked at the KBxxxxxx.log files that are in
    the Windows directory. In those near the end of the log, there is mention of
    files that are (delayed) and they have names like SETx.tmp. If you check the
    properties of the tmp files, you will notice that they directly correlate to
    those files (delayed).

    To FIX the symptoms of problem, I booted to Windows PE, renamed all the DLLs
    that I wrote down to .tmp and then renamed each file named SETx.tmp to the
    appropriate DLL name. The versions of the SETx.tmp files are those
    referenced in the KB article.

    This resulted in a MUCH more stable and functional OS. I carried it further
    to other tmp files I located in Windows\system32\usmt

    It is interesting to note that the creation of the SETx.tmp files are always
    created with a unique name. If you try and install the update over and
    over....... you get an additional copy of the files that are not installed.
    Consequently you really start using up the storage space on the drive with
    multiple copies with different names. In my case, there was 260 MB of tmp
    files created.
    Mark D, Dec 2, 2005
  4. ....

    What is often thought in that case is that a user's security programs
    if not disabled may be interfering with the renaming procedure.

    Did you have your security programs disabled over the reboot
    (or try rebooting in safe mode which would also probably prevent such
    potential interference)?
    Robert Aldwinckle, Dec 3, 2005
  5. Mark D

    Mark D Guest

    Thanks for responding.

    I booted into safe mode to do each installation one at a time following up
    with safe mode to complete the installation. Did not help.

    The only thing I can think of doing is removing the spyware programs and
    trying again.

    Having installed the patches and then renaming the appropriate files via
    Windows PE, the system is working fine right now. Still scratching my head
    as to why the rename process doesn't function. Just looking for additonal
    information that might help me determine what is broken or where to look.
    Mark D, Dec 7, 2005

  6. Of course! If you had such Trojans active anything might be happening.

    My next suggestion would be to use RegMon to see what is happening
    with those renames. I'm not totally clear about the implementation but
    I think that they get written to value PendingFileRenameOperations.
    A simpler alternative I suppose would be just finding and inspecting
    that value before doing the forced reboot. That way you would know
    at least that they were all being listed there. After the boot you would
    probably see that the value was empty or gone.

    Checking what happens to that value during the boot is much harder.
    One possibility would be to use RegMon's Log Boot option.
    Another possibility I am even less familiar with would be setting up
    an audit on the key where the PendingFileRenameOperations value
    gets written. (I'm not even sure what all information that would capture.
    If nothing else it would probably give you some timestamped records
    for proof that something was happening with it.)

    Good luck

    Robert Aldwinckle, Dec 7, 2005
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.