Security Update KB956572 install fails continually

Discussion in 'Windows Update' started by DavidS, Apr 16, 2009.

  1. DavidS

    DavidS Guest

    We're updating our XP SP3 desktops using WSUS 3.0. Today during the first
    round of patch testing we found that the patch for KB956572 wouldn't install.
    In checking the install log for the patch, it seems to be failing because
    NTDLL.DLL is in use. Running the update manually produces the same result.

    Any ideas where to look in order to fix this? TiA
    DavidS, Apr 16, 2009
    1. Advertisements

  2. Ǝиçεl, Apr 16, 2009
    1. Advertisements

  3. DavidS

    DavidS Guest

    So far, Microsoft's solution was to apply the patch manually in safe mode,
    which kind of defeats the purpose of WSUS.
    DavidS, Apr 16, 2009
  4. Ǝиçεl, Apr 16, 2009
  5. Who knew you were updating via WSUS from your first post?
    PA Bear [MS MVP], Apr 16, 2009
  6. DavidS

    DavidS Guest

    Thanks for the link. Didn't see that newsgroup before posting.
    DavidS, Apr 17, 2009
  7. DavidS

    DavidS Guest

    I would have thought the part where I mentioned "updating our XP SP3 desktops
    using WSUS 3.0." would have indicated that we were using WSUS.

    Thanks for taking the time to reply though. ;-)
    DavidS, Apr 17, 2009
  8. <mybad>
    PA Bear [MS MVP], Apr 17, 2009
  9. DavidS

    Fred Morpeth Guest

    I am also unable to instal this update but there is no mention of NTDLL.
    Instead there is the error message:' KB956572 Setup encountered an error:
    The update.ver file is not correct.'
    Can anyone help with this
    Fred Morpeth, Apr 19, 2009

  10. That's a normal message. Keep looking. ; )
    Robert Aldwinckle, Apr 19, 2009
  11. OK, the fact that a manual install doesn't work either eliminates WSUS from the
    picture. I gather the update does work in Safe Mode, in which case the problem
    smells of a third-party security product issue. What software do you have

    The odd thing is that NTDLL.DLL is *always* in use. It's one of the core DLLs
    used by pretty much every user-mode process, so the update should be expecting
    to need to do a replace-on-reboot operation. Could you post the install log
    here? There might be other clues in it.

    I assume you've tried the install on a machine that has recently been rebooted?

    Harry Johnston [MVP], Apr 21, 2009

  12. Not just security software. See also "KB956572 fails to install on SBS 2003 server"
    Robert Aldwinckle, Apr 21, 2009

  13. Oops. Previous post sent too soon.
    (<bleeping> Ctrl-Enter in OE while Working Online.)

    Not just security software. See also "KB956572 fails to install on SBS 2003 server"

    There the symptom looks like it could be caused by a driver or driver
    support software. (I have a vague recollection of an HP Printer driver
    or its software doing something like this before.) Safe mode could
    inhibit stuff like that too.


    Robert Aldwinckle, Apr 21, 2009
  14. Personally, I don't see any reason to suspect a driver or driver-related
    software in either thread; my first guess in both cases would be security
    software. YMMV.
    You're probably thinking of one of the MSXML files being locked by HP printer
    software? Different situation, as ntdll.dll is actually supposed to be locked.

    I suspect the problem is actually either a lock on some other resource
    associated with the attempted update of ntdll.dll, or third-party kernel-mode
    software intercepting and rejecting the attempt to look at it. Or perhaps a
    mangled ACL; unless we can figure out how to reproduce the problem all I can do
    is speculate.

    Harry Johnston [MVP], Apr 22, 2009
  15. I'm going to backpedal on this. On further investigation, ntdll.dll is usually
    locked with the SHARE_READ flag. If any process has locked it for exclusive
    access, you get the symptoms the OP describes.

    This means it could be any piece of software on the system causing the problem.

    Harry Johnston [MVP], Apr 22, 2009

  16. Just the log entry which precedes the error message.

    Yes. Thanks.
    Robert Aldwinckle, Apr 22, 2009
  17. DavidS

    DavidS Guest

    Still fighting with this.

    Security related, we are using RSA for secure logins and Mcafee for
    antivirus. Other than that, nothing else out of the ordinary that I can think
    of. This is the first time we've had problems patching though.
    DavidS, Apr 22, 2009
  18. DavidS

    DavidS Guest

    After reading some other posts and getting some ideas, I've found that the
    issue in my case was with Norton Ghost. Once I uninstalled Ghost from a test
    PC the WSUS install ran just fine on it. Hope this helps some other people.
    DavidS, Apr 23, 2009
  19. DavidS

    rhl2000 Guest

    That gave me the cue I needed. In the case of a client of mine, Drive Image
    7 (precursor of recent editions of Norton Ghost) was removed, and the update
    installed successfully after that.
    rhl2000, Jun 21, 2009
  20. DavidS

    vensondiana Guest

    This solved my problem on the KB956572 update failure.

    Delete everything inside

    1. C:\WINDOWS\SoftwareDistribution\Download
    2. Manually download the KB956572 (for your OS) save on desktop
    3. run on command "chkdsk /f" then restart
    4. run on command "KB location" /o
    (e.g. c:\documents and settings\unknown\desktop\WindowsServer2003-KB956572-x86-ENU.exe /o)
    vensondiana, Jul 19, 2013
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.