0x800703E3 installing Windows Update Agent

[Darryl]

Using XP SP3, I am getting the following when trying to install the latest
update agent (windowsupdateagent30-x86.exe). I'd appreciate any help!

2010-01-20 22:44:19:140 3976 1700 Misc =========== Logging initialized
(build: 7.4.7600.226, tz: -0600) ===========
2010-01-20 22:44:19:140 3976 1700 Misc = Process:
d:\7b8ddf66cf37fb5bcb524483\wusetup.exe
2010-01-20 22:44:19:140 3976 1700 Setup Windows Update Client standalone
setup : resource dll path is d:\7b8ddf66cf37fb5bcb524483\en\wusetup.exe.mui
2010-01-20 22:44:19:140 3976 1700 Setup *********** Setup: Checking whether
self-update is required ***********
2010-01-20 22:44:19:140 3976 1700 Setup * Inf file:
d:\7b8ddf66cf37fb5bcb524483\wusetup.inf
2010-01-20 22:44:19:187 3976 1700 Setup FATAL: Update required for
C:\WINDOWS\system32\cdm.dll: target version = 7.2.6001.788, required version
= 7.4.7600.226
2010-01-20 22:44:19:203 3976 1700 Setup FATAL: Update required for
C:\WINDOWS\system32\wuapi.dll: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-20 22:44:19:218 3976 1700 Setup Update required for
C:\WINDOWS\system32\wuapi.dll.mui: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-20 22:44:19:234 3976 1700 Setup FATAL: Update required for
C:\WINDOWS\system32\wuauclt.exe: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-20 22:44:19:281 3976 1700 Setup FATAL: Update required for
C:\WINDOWS\system32\wuaucpl.cpl: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-20 22:44:19:296 3976 1700 Setup Update required for
C:\WINDOWS\system32\wuaucpl.cpl.mui: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-20 22:44:19:359 3976 1700 Setup FATAL: Update required for
C:\WINDOWS\system32\wuaueng.dll: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-20 22:44:19:375 3976 1700 Setup Update required for
C:\WINDOWS\system32\wuaueng.dll.mui: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-20 22:44:19:437 3976 1700 Setup FATAL: Update required for
C:\WINDOWS\system32\wucltui.dll: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-20 22:44:19:453 3976 1700 Setup Update required for
C:\WINDOWS\system32\wucltui.dll.mui: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-20 22:44:19:453 3976 1700 Setup FATAL: Update required for
C:\WINDOWS\system32\wups.dll: target version = 7.2.6001.788, required version
= 7.4.7600.226
2010-01-20 22:44:19:468 3976 1700 Setup FATAL: Update required for
C:\WINDOWS\system32\wups2.dll: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-20 22:44:19:468 3976 1700 Setup FATAL: Update required for
C:\WINDOWS\system32\wuweb.dll: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-20 22:44:19:468 3976 1700 Setup * IsUpdateRequired = Yes
2010-01-20 22:44:19:484 3976 1700 Setup Windows Update Client standalone
setup : eula file path is d:\7b8ddf66cf37fb5bcb524483\en\eula.rtf
2010-01-20 22:44:22:890 3976 1784 Setup *************
2010-01-20 22:44:22:890 3976 1784 Setup ** START ** Setup: Installing
client binaries
2010-01-20 22:44:22:890 3976 1784 Setup *********
2010-01-20 22:44:22:890 3976 1784 Setup * Download directory:
d:\7b8ddf66cf37fb5bcb524483\
2010-01-20 22:44:22:890 3976 1784 Setup * Stop and start service: Yes
2010-01-20 22:44:22:890 1488 5b4 AU ########### AU: Uninitializing
Automatic Updates ###########
2010-01-20 22:44:22:906 1488 5b4 Service *********
2010-01-20 22:44:22:906 1488 5b4 Service ** END ** Service: Service exit
[Exit code = 0x240001]
2010-01-20 22:44:22:906 1488 5b4 Service *************
2010-01-20 22:44:25:953 3976 1784 Setup Starting file operations for section
cdm_Standalone
2010-01-20 22:44:26:437 3976 1784 Setup WARNING: Setup failed while
processing file operations, error = 0x800703E3. Rolling back changes.
2010-01-20 22:44:26:500 1488 9cc Misc =========== Logging initialized
(build: 7.2.6001.788, tz: -0600) ===========
2010-01-20 22:44:26:500 1488 9cc Misc = Process:
C:\WINDOWS\System32\svchost.exe
2010-01-20 22:44:26:500 1488 9cc Misc = Module:
C:\WINDOWS\system32\wuaueng.dll
2010-01-20 22:44:26:500 1488 9cc Service *************
2010-01-20 22:44:26:500 1488 9cc Service ** START ** Service: Service startup
2010-01-20 22:44:26:500 1488 9cc Service *********
2010-01-20 22:44:26:500 1488 9cc Agent * WU client version 7.2.6001.788
2010-01-20 22:44:26:515 1488 9cc Agent * Base directory:
C:\WINDOWS\SoftwareDistribution
2010-01-20 22:44:26:515 1488 9cc Agent * Access type: No proxy
2010-01-20 22:44:26:515 1488 9cc Agent * Network state: Connected
2010-01-20 22:44:29:437 3976 1784 Setup * WARNING: Exit code = 0x800703E3
2010-01-20 22:44:29:437 3976 1784 Setup *********
2010-01-20 22:44:29:437 3976 1784 Setup ** END ** Setup: Installing
client binaries
2010-01-20 22:44:29:437 3976 1784 Setup *************
2010-01-20 22:44:29:437 3976 1784 Setup FATAL: InstallUpdatedBinaries failed
with error 0x800703e3
2010-01-20 22:44:31:578 3976 1700 Setup wusetup has finished. Exit code is
0. Reboot is NOT needed

[PA Bear [MS MVP]]

Try doing an Aggressive mode Reset: http://support.microsoft.com/kb/971058

What anti-virus application or security suite is installed and is your
subscription current? What anti-spyware applications (other than Defender)?
What third-party firewall (if any)?

Has a(another) Norton or McAfee application ever been installed on the
computer (e.g., a free-trial version that came preinstalled when you bought
it)?
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002
www.banthecheck.com

Darryl wrote:
> Using XP SP3, I am getting the following when trying to install the latest
> update agent (windowsupdateagent30-x86.exe). I'd appreciate any help!
>
> 2010-01-20 22:44:19:140 3976 1700 Misc =========== Logging initialized
> (build: 7.4.7600.226, tz: -0600) ===========
> 2010-01-20 22:44:19:140 3976 1700 Misc = Process:
> d:\7b8ddf66cf37fb5bcb524483\wusetup.exe
> 2010-01-20 22:44:19:140 3976 1700 Setup Windows Update Client standalone
> setup : resource dll path is
> d:\7b8ddf66cf37fb5bcb524483\en\wusetup.exe.mui
> 2010-01-20 22:44:19:140 3976 1700 Setup *********** Setup: Checking
> whether
> self-update is required ***********
> 2010-01-20 22:44:19:140 3976 1700 Setup * Inf file:
> d:\7b8ddf66cf37fb5bcb524483\wusetup.inf
> 2010-01-20 22:44:19:187 3976 1700 Setup FATAL: Update required for
> C:\WINDOWS\system32\cdm.dll: target version = 7.2.6001.788, required
> version
> = 7.4.7600.226

<SNIP>

> 2010-01-20 22:44:26:437 3976 1784 Setup WARNING: Setup failed while
> processing file operations, error = 0x800703E3. Rolling back changes.

<SNIP>

[Ǝиçεl]

0x800703E3 ERROR_OPERATION_ABORTED
The I/O operation has been aborted because of either a thread exit or an
application request.
Invalid access to memory location

[Darryl]

Thanks for the suggestions, PA Bear. I installed Fix It and did an agressive
reset and reboot, but that didn't fix the problem; still getting the same
error.

No 3rd party firewall or anti-spyware. Norton/McAfee has never been
installed. The virus checker is Trend, installed by our IT people. I tried
to uninstall it, but it is password protected.

Windows Update used to work fine. I did notice that the Trend icon looks
different now than it used to look; I think our IT people pushed out a new
version. Could this be the problem?

> .
>

[Darryl]

Thanks PA Bear. I installed Fix It and did an agressive reset, but got the
same error.

The machine had Trend antivirus, no 3rd party firewall or antispyware. I
uninstalled Trend and rebooted because I suspected it (it was updated
recently) and tried to install the update agent again, but got the same error.

I then tried the agressive reset again, and again got the same error.

I am trying to install the update agent because when I try to update via
windowsupdate.microsoft.com, it says I need to install the ActiveX control,
but I am not prompted to install the control. The information bar does not
appear, and it just sits there.

Any ideas? I've never had so much trouble trying to do something so simple.

"PA Bear [MS MVP]" wrote:

> .
>

[PA Bear [MS MVP]]

Does the computer belong to you or your employer?

[Darryl]

It belongs to my employer, but we are a small shop and generaly take care of
our machines ourselves.

[MowGreen]

Darryl wrote:

> It belongs to my employer, but we are a small shop and generaly take care of
> our machines ourselves.

Suggest you clean boot XP to eliminate interference from Trend:

How to configure Windows XP to start in a "clean boot" state
http://support.microsoft.com/kb/310353

Run the Fixit once more or, in the clean boot state, stop the AU and
BITS services and then install the previously downloaded Windows Update
Agent (WUA).
Start > Run > type in
cmd
Click OK or press Enter
At the Command Prompt type in the following, pressing Enter after each
command

net stop wuauserv
net stop bits

Leave the CP window open and install the WUA now.
Go back to the Command Prompt, enter the following, press Enter after
each command

net start wuauserv
net start bits
exit

*Restart* the system and the latest Version of the WUA *should* now be
installed.
See if the system can search for updates now while still in the clean
boot state. If it can, UNdo the steps, restart, and see if it can search
for updates in normal Windows mode.

MowGreen
===============
*-343-* FDNY
Never Forgotten
===============

banthecheck.com
"Security updates should *never* have *non-security content* prechecked

[Darryl]

Thanks Mow. I clean booted, stopped the services, and tried to install WUA.
Same error in the log.

I then ran Fix It in aggressvie mode, rebooted, stopped the services and
tried to install WUA. Same error again.

Here's what I typically find in the log:

2010-01-21 16:52:45:671 2088 e08 Misc =========== Logging initialized

(build: 7.4.7600.226, tz: -0600) ===========

2010-01-21 16:52:45:671 2088 e08 Misc = Process:
d:\6b604922dd6db28dd277f6b3\wusetup.exe
2010-01-21 16:52:45:671 2088 e08 Setup Windows Update Client standalone
setup : resource dll path is d:\6b604922dd6db28dd277f6b3\en\wusetup.exe.mui
2010-01-21 16:52:45:671 2088 e08 Setup *********** Setup: Checking whether
self-update is required ***********
2010-01-21 16:52:45:671 2088 e08 Setup * Inf file:
d:\6b604922dd6db28dd277f6b3\wusetup.inf
2010-01-21 16:52:45:671 2088 e08 Setup FATAL: Update required for

C:\WINDOWS\system32\cdm.dll: target version = 7.2.6001.788, required version
= 7.4.7600.226

2010-01-21 16:52:45:687 2088 e08 Setup FATAL: Update required for
C:\WINDOWS\system32\wuapi.dll: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup Update required for
C:\WINDOWS\system32\wuapi.dll.mui: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup FATAL: Update required for
C:\WINDOWS\system32\wuauclt.exe: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup FATAL: Update required for
C:\WINDOWS\system32\wuaucpl.cpl: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup Update required for
C:\WINDOWS\system32\wuaucpl.cpl.mui: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup FATAL: Update required for
C:\WINDOWS\system32\wuaueng.dll: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup Update required for
C:\WINDOWS\system32\wuaueng.dll.mui: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup FATAL: Update required for
C:\WINDOWS\system32\wucltui.dll: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup Update required for
C:\WINDOWS\system32\wucltui.dll.mui: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup FATAL: Update required for
C:\WINDOWS\system32\wups.dll: target version = 7.2.6001.788, required version
= 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup FATAL: Update required for
C:\WINDOWS\system32\wups2.dll: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup FATAL: Update required for
C:\WINDOWS\system32\wuweb.dll: target version = 7.2.6001.788, required
version = 7.4.7600.226
2010-01-21 16:52:45:687 2088 e08 Setup * IsUpdateRequired = Yes
2010-01-21 16:52:45:687 2088 e08 Setup Windows Update Client standalone
setup : eula file path is d:\6b604922dd6db28dd277f6b3\en\eula.rtf
2010-01-21 16:52:49:375 2088 8a4 Setup *************
2010-01-21 16:52:49:375 2088 8a4 Setup ** START ** Setup: Installing client
binaries
2010-01-21 16:52:49:375 2088 8a4 Setup *********
2010-01-21 16:52:49:375 2088 8a4 Setup * Download directory:
d:\6b604922dd6db28dd277f6b3\
2010-01-21 16:52:49:375 2088 8a4 Setup * Stop and start service: Yes
2010-01-21 16:52:49:437 2088 8a4 Setup Starting file operations for section
cdm_Standalone
2010-01-21 16:52:49:656 2088 8a4 Setup WARNING: Setup failed while

processing file operations, error = 0x800703E3. Rolling back changes.

2010-01-21 16:52:49:656 2088 8a4 Setup * WARNING: Exit code = 0x800703E3
2010-01-21 16:52:49:656 2088 8a4 Setup *********
2010-01-21 16:52:49:656 2088 8a4 Setup ** END ** Setup: Installing client
binaries
2010-01-21 16:52:49:656 2088 8a4 Setup *************
2010-01-21 16:52:49:656 2088 8a4 Setup FATAL: InstallUpdatedBinaries failed
with error 0x800703e3
2010-01-21 16:52:52:140 2088 e08 Setup wusetup has finished. Exit code is

0. Reboot is NOT needed

"MowGreen" wrote:

> .
>

[PA Bear [MS MVP]]

0x800703E3 Error_Operation_Aborted

Invalid access to memory location

If the above isn't Trend Micro's doing, something's really wrong with your
computer (e.g., a hijackware infection).

[PA Bear [MS MVP]]

Let your IE Department (such as it is) handle this or contact Trend Micro
Support.

[MowGreen]

Darryl,

0x800703E3 ERROR_OPERATION_ABORTED
The I/O operation has been aborted because of either a thread exit or an
application request

To be clear here, the WUA you are attempting to install was download and
*saved* from:
http://download.windowsupdate.com/windowsupdate/redist/standalone/7.4.7600.226/windowsupdateagent30-x86.exe

Is that correct ?
Did you download and save the Fixit or run it online ?

Something isn't quite right here. In the clean boot state, Trend
*should* be totally disabled. All references I see with the
0x800703E3 updating error are related to IIS, a corrupt system file, a
bad HD sector, or the presence of malware.

In the clean boot state, please open a Command Prompt ( Start > Run >
type in cmd, press Enter )
At the prompt, type in the below and then press Enter

proxycfg

Under Current WinHTTP proxy settings, does it state " Direct access(no
proxy server)" ?

Now type in sigverif.exe and press Enter
The File Signature Verification tool will open.
Close the Command Prompt window by typing in exit and then press Enter.

Now click the *Advanced* button of the File Signature Verification tool.
Ensure that the "Look for other files that are not digitally signed"
option is marked.
The " Scan for this file type" field should being showing
*.*
For the "Look in this folder" field, set the path to the
WINDOWS\system32 subfolder. If the WINDOWS directory is on C:\ set it to
C:\WINDOWS\system32 or click the Browse button to select it.

You do *not* need to check the box that states "Include subfolders"

Now click the Logging tab. The "Save the file signature verification
results to a log file" option should be checked.
Under "Logging options", it should show "Append to existing log file".
The "Log file name:" should be showing as SIGVERIF.TXT
Click OK, then click the Start button.
The tool will take some time to run. When it's done, please copy and
paste the contents of SIGVERIF.TXT into your reply.

MowGreen
================
* -343-* FDNY
Never Forgotten
================

PA Bear [MS MVP] wrote:

[Darryl]

Hi Mow, thanks again for the help. I had about given up on this, so didn't
see your post right away.

Yes, that is the correct URL where I got the WUA that I'm trying to install.

Yes, I downloaded FixIt and ran it from my desktop.

I have completely uninstalled Trend AntiVirus. I got my IT guy to enter the
password so it could be uninstalled. No change after it was uninstalled,
though, same error.

After a clean boot, proxycfg shows "Direct access (no proxy server)."

I will post the logfile from sigverif in a separate post, due to length.

[Darryl]

Mow, the sigverif logfile is very long; you can get it here:
http://darrylsimagehost.s3.amazonaws.com/SIGVERIF.TXT

"MowGreen" wrote:

> .
>

[MowGreen]

First, unregister winhttp5.dll and re-register winhttp.dll from a
Command Prompt (CP).
Open a CP, at the prompt type in the following pressing Enter after each
command. NOTE the spaces after the "2" and the last " l " in the first
command, please.

regsvr32 winhttp5.dll /u
regsvr32 winhttp.dll
exit

Were the unregister/register commands successful ?
If not, what did the messages state ?

There are a couple of suspicious Unsigned files showing in the sigverif.txt:

kxentovz.dll 2/4/2009
rockvdd.dll 4/7/2005

The former may be an indication that 'something' was or, still is,
present on the system.
I can't find out enough about the latter to determine just what it's
related to, but it appears to have been present on the system for awhile
now.

All of the files related to updating are old and need to be replaced or
the system will never be able to update. Some "thing" is preventing the
installation of the latest release of the WUA.
So, since Trend has been uninstalled, suggest you download and run this
tool to ensure all remnants of it are gone:
AppRemover
http://www.technibble.com/appremover-repair-tool-of-the-week

Next, download, save, and then install Malwarebytes anti-malware:
http://www.malwarebytes.org/

Grab the free version. When installing MBAM it will try to update to
it's latest definitions. Either allow it or wait until it's installed to
update the defs.
Once installed, run a QuickScan and see what, if anything, it detects.

Please post back with your progress, Darryl.

MowGreen
================
* -343-* FDNY
Never Forgotten
================

banthecheck.com

"Security updates should *never* have *non-security content* prechecked

[Darryl]

Thanks again for the help, Mow.

The unregister/register of winhttp5.dll worked without any errors.

kxentovz.dll is one of the dlls belonging to software that we have written
here, so it is Ok.

I think rockvdd.dll may be left over from something the prior owner of this
machine installed long ago. I think it is benign based on info I found here:
http://www.siteadvisor.com/sites/rockey.gr/downloads/2178178/

AppRemover did not find any remnants of security software to be removed. It
only found my installation of Malware AntiBytes.

Early on in all this, I installed and ran AntiBytes and it found some things
that I quarantined and removed:

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{00ada225-ea6c-4fb3-82e8-68189201ccb9}
(Adware.Winad) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{735c5a0c-f79f-47a1-8ca1-2a2e482662a8}
(Adware.Winad) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{15696ae2-6ea4-47f4-bea6-a3d32693efc7}
(Adware.Winad) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6}
(Rogue.DriveCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\LoaderX.exe (Adware.Winad) -> Quarantined and
deleted successfully.

Getting rid of these things did not solve my problem, though.

I ran it again as you suggested and it found more items, which were probably
not causing any problems. I quarantined them and removed them anyway:

Files Infected:
C:\Documents and Settings\joncmartin\Local Settings\Temp\res88B.tmp
(Adware.180olutions) -> Quarantined and deleted successfully.
C:\Program Files\Microsoft
AntiSpyware\Quarantine\28B36EAB-3A20-47BF-BB9A-9B4B89\6C755816-4BC4-4E67-B68F-31930B (Adware.180olutions) -> Quarantined and deleted successfully.
C:\Program Files\Microsoft
AntiSpyware\Quarantine\28B36EAB-3A20-47BF-BB9A-9B4B89\D8CEB3A0-F20D-4A91-A424-1CDAB6 (Adware.180olutions) -> Quarantined and deleted successfully.
C:\Program Files\Microsoft
AntiSpyware\Quarantine\547A6688-0AE7-4F21-8599-6C7272\FBC29733-84E4-4766-9ABB-D365FA (Adware.180olutions) -> Quarantined and deleted successfully.

I'm starting to think that the only solution is going to be repaving this
machine!

[MowGreen]

You're mowst welcome, Darryl.
Previously, I suggested the unregistering of winhttp5.dll and the re
registering of *winhttp.dll*.
Did you mistakenly re register winhttp5.dll ?

Before proceeding, I can see there are at least 2 partitions involved, C
and D. Suggest you download another copy of the WUA and place it on the
partition where the Windows directory is *not* installed, which I assume
is D:\ -
http://download.windowsupdate.com/windowsupdate/redist/standalone/7.4.7600.226/windowsupdateagent30-x86.exe

Then stop the AU and BITS services.
( Adding the /force switch to the executable prior to running it should
not have be done when the services are stopped. )
Next, show hidden files, folders, and system files:
http://www.bleepingcomputer.com/tutorials/tutorial62.html#winxp

Using Windows Explorer, navigate to
WINDOWS\Software Distribution
Open the Software Distribution subfolder and delete *all* of it's
subfolders.
The only thing left now in the Software Distribution subfolder should be
the ReportingEvents.log
Now run windowsupdateagent30-x86.exe from the D partition and then
restart the system.
See if it can search for updates now.

If no joy, the only other suggestion left is to download, save, and then
run Process Monitor when you try to install the Windows Update Agent.
You could set a filter for the executable, windowsupdateagent30-x86.exe,
and perhaps see which process/handle/thread is preventing it from
installing properly.

MowGreen
================
* -343-* FDNY
Never Forgotten
================

banthecheck.com
"Security updates should *never* have *non-security content* prechecked

[Darryl]

Mow, you're right, I had messed up the winhttp registration/unregistration.
Went back and redid it, but still no error messages.

I tried to install from the D:\ drive, stopping the services first and
clearing out the distribution folder as instructed, but got that same old
error again.

I downloaded and installed the Process Monitor. I set up a filter for
windowsupdateagent30-x86, cleared the display and ran the installer.
Scanning through the items (and not being very familiar with interpreting the
entries), I finally decided that based on the WindowsUpdate.log, it looked
like what was failing was wusetup, not windowsupdateagent30-x86 itself. So I
set another filter for wusetup, cleared the display, and ran the installer
again. Again, I'm not sure how to interpret the entries, but if you would
like to take a look, I saved the log and you can get it here:
http://darrylsimagehost.s3.amazonaws.com/Logfile.PML

Hoping you'll find the silver bullet in there! (and thanks again!)

"MowGreen" wrote:

> .
>

[MowGreen]

Well, I didn't an obvious cause of the WUA failing to be updated,
Darryl. There are no failures showing in the log.
It very well may signify that either the HD has bad sectors or the
memory may be starting to go kaput.

The only other thing I can think of is that there's a minifilter still
present that may have been installed by Trend.

From: http://support.microsoft.com/kb/922582

" Click Start, click Run, type cmd, and then click OK.
Type fltmc.exe, and then press ENTER.

The following example shows a legacy filter and minifilters:

Filter Name Num Instances Frame
------------------------------ ------------------ --------
TestLegacyFilter <Legacy>
TestMiniFilter1 4 1
TestMiniFilter2 0 0

The following example shows only minifilters:

Filter Name Num Instances Frame
------------------------------ ------------------ --------
TestMiniFilter1 4 1
TestMiniFilter2 0 0 "

Please post back with the results of running filtmc.exe.

[Robert Aldwinckle]

"Darryl" <Dar...@discussions.microsoft.com> wrote in message news:7897B33C-6215-4E83...@microsoft.com...

> Mow, you're right, I had messed up the winhttp registration/unregistration.
> Went back and redid it, but still no error messages.
>
> I tried to install from the D:\ drive, stopping the services first and
> clearing out the distribution folder as instructed, but got that same old
> error again.
>
> I downloaded and installed the Process Monitor. I set up a filter for
> windowsupdateagent30-x86, cleared the display and ran the installer.
> Scanning through the items (and not being very familiar with interpreting the
> entries), I finally decided that based on the WindowsUpdate.log, it looked
> like what was failing was wusetup, not windowsupdateagent30-x86 itself. So I
> set another filter for wusetup, cleared the display, and ran the installer
> again. Again, I'm not sure how to interpret the entries, but if you would
> like to take a look, I saved the log and you can get it here:
> http://darrylsimagehost.s3.amazonaws.com/Logfile.PML

Filter on Operation Contains WRITE
to find C:\$PrepareToShrinkFileSize
WTH is that? Notice that it is surrounded by a bunch of WU.log writes;
so you should be able to use the pattern of their timestamps and lengths
to see if there is anything interesting in the log which explains that.
Tip: I use Notepad with its Status line on and press End to find out
which lines end where. ; )

[Darryl]

Here you go.

Filter Name Num Instances Frame
------------------------------ ------------- -----

PROCMON20 0 0
sr <Legacy>

"MowGreen" wrote:

> .
>

[MowGreen]

Robert Aldwinckle wrote:
> "Darryl"<Dar...@discussions.microsoft.com> wrote in message news:7897B33C-6215-4E83...@microsoft.com...
>> Mow, you're right, I had messed up the winhttp registration/unregistration.
>> Went back and redid it, but still no error messages.
>>
>> I tried to install from the D:\ drive, stopping the services first and
>> clearing out the distribution folder as instructed, but got that same old
>> error again.
>>
>> I downloaded and installed the Process Monitor. I set up a filter for
>> windowsupdateagent30-x86, cleared the display and ran the installer.
>> Scanning through the items (and not being very familiar with interpreting the
>> entries), I finally decided that based on the WindowsUpdate.log, it looked
>> like what was failing was wusetup, not windowsupdateagent30-x86 itself. So I
>> set another filter for wusetup, cleared the display, and ran the installer
>> again. Again, I'm not sure how to interpret the entries, but if you would
>> like to take a look, I saved the log and you can get it here:
>> http://darrylsimagehost.s3.amazonaws.com/Logfile.PML
>
>
> Filter on Operation Contains WRITE
> to find C:\$PrepareToShrinkFileSize
> WTH is that? Notice that it is surrounded by a bunch of WU.log writes;
> so you should be able to use the pattern of their timestamps and lengths
> to see if there is anything interesting in the log which explains that.
> Tip: I use Notepad with its Status line on and press End to find out
> which lines end where. ; )
>

Interesting is an understatement, Robert. Something really hinky is
going on here which may be stemming from a hardware issue. Heck, it may
even be related to how the drive(s) are partitioned.
I've never seen this with the installation of the WUA before.

[MowGreen]

There are no mini filters present from the installation of Trend, just
Process Monitor and the Legacy System Restore filter.

How many Hard Drives and how many partitions does the drive(s) have,
Darryl ?
How much free space is available on C:\ and D:\ ?
Automatic updates are stored in the WINDOWS directory but will be
unpacked and installed from the drive with the most free space available.

Frankly speaking, I've never seen this issue when installing the WUA
before. There may be something amiss with the partioning/provisioning of
the HD, there are bad sectors of the HD, or failing RAM involved.
Also, I don't get why there are Write attempts to F:\.

What is F:\ ?

I'm going to fire up a Virtual instance of XP and run ProcMon while
installing the latest release of the WUA and compare the log to the one
from your system. Hang in there.

[Darryl]

Mow, the machine has 2 physical disks.

Disk 0 has 2 partitions: C: and F:
- C: is 32GB, with 3GB free
- F: has 37GB, with 20GB free

Disk 0 has one partition, D:
- D: has 149GB, with 126GB free

Originally, I only had disk 0, and it was partitioned into C: and D:. C:
was the OS and I did my work on D:. But I kept running out of space on C:,
so I added a new disk to be my work disk. To keep things the way they were,
I assigned the original D: to be F:, and assigned the new disk to be D:. I
then uninstalled/reinstalled my biggest applications (Office, Visual Studio,
etc) from C: to D: to free up as much space as possible on C:. It still has
only a little space, but I figured 3GB ought to be enough for Windows
updates, etc.

My CD-ROM is E:.

If it matters, I also have configured page files to be on both D: and F:,
where there is a lot of free space (so no page file on C:).

[MowGreen]

Unless you've mistyped it, it's hard to believe that both drives were
assigned the number 0. The D:\ drive should be Disk1.

Was a 3rd party tool used to rename D:\ to F:\ and did the updating
correlate with the installation of the new HD or did it occur after the
upgrade of Trend ?

From what I've seen in the ProcMon log from my VPC of XP, the ProcMon
log from your system is showing many more BUFFER OVERFLOWS. In fact,
there was just one in the ProcMon log from the VPC of XP.

C:\ is being used only for the Windows directory, correct ? If so, you
can recover a great deal of disk capacity by removing the uninstall
subfolders of Service Packs, the backup of SP3 located at
WINDOWS\ServicePackFiles\i386, and the uninstall subfolders of installed
updates.
If you have the original XP installation CD you can slipstream SP3 to it
so as to be able to reinstall XP SP3 before removing the
ServicePackFiles\i386 subfolder.

Slipstreamed Windows XP CD Using SP3
http://www.theeldergeek.com/slipstreamed_xpsp3_cd.htm

Save Space After Installing Updates
http://www3.telus.net/dandemar/spack.htm

Though the question still remains as to the paths issue which appears to
be part of or entirely the cause of the failure of the WUA to install.

MowGreen
================
* -343-* FDNY
Never Forgotten
================

banthecheck.com
"Security updates should *never* have *non-security content* prechecked

[Darryl]

Yes, sorry, drive D: is on disk 1. That was a copy & paste error on my part.

The regular Windows Disk Management applet was used to reassign the drive
letters. That was done a year or more ago, but the Trend (since uninstalled)
update was within the last couple months.

C:\ has the OS, and some other apps. But I don't install anything new on it
because of disk space issues. Do you think the problem has to do with
insufficient space on C:, and that I should try to free up more space there?

"MowGreen" wrote:

> .
>

[MowGreen]

*** Can you manually download and manually install updates ? ***

Freeing up space on C:\ is worth a shot Darryl, but I don't think it's
going to resolve the WUA installation issue if it's stemming from a
path's issue.

1) Remove all of the update uninstall subfolders.
2) Remove the ServicePack subfolders.
3) Clean the WINDOWS\temp and your UserAccount's temp subfolders *after*
first restarting the system to ensure that anything in said subfolders
is no longer needed.
4) You could even back up the Windows\Installer subfolder to a CD or
external HD, too, if it's grown to an unwieldy size. Then move either
it's contents or the required .msp/.msi back when upgrading/updating
installed software.

" If you have the original XP installation CD you can slipstream SP3 to
it so as to be able to reinstall XP SP3 before removing the
ServicePackFiles\i386 subfolder.

Slipstreamed Windows XP CD Using SP3
http://www.theeldergeek.com/slipstreamed_xpsp3_cd.htm

Save Space After Installing Updates
http://www3.telus.net/dandemar/spack.htm "

MowGreen
================
* -343-* FDNY
Never Forgotten
================

banthecheck.com
"Security updates should *never* have *non-security content* prechecked

Darryl wrote:
> Yes, sorry, drive D: is on disk 1. That was a copy& paste error on my part.

[Darryl]

Well, I think I'm going to throw in the towel and repave this machine, Mow.
I want to thank you for all the help and sticking with me for all this time
and trying to figure this one out. You went above and beyond!

[MowGreen]

You're mowst welcome, Darryl. At least we gave it a shot. Trust me, it
was a pleasure working with someone who provides relevant information
instead of having to be constantly prodded for it.

[Darryl]

Well finally, I'm back in business. I booted the Windows CD and did a
repair. Went pretty smoothly; did have to hunt down a driver file (.MOF?)
for the network card. Luckily was able to find it on the internet.

After everything was done, had a nasty problem with activation that took me
a few days of Googling to solve: when I logged in, it said I had to activate.
Clicked OK and then nothing happened; just showed the desktop. Turns out
that activation requires IE8. Had to download the IE8 installer from another
machine, burn it onto a CD, go into safe mode on the problem machine, and
install it. Upon rebooting after the IE8 install, the activation dialog came
up, hooray! This is the thread that showed me this solution, in case anyone
else hits the problem:
http://social.technet.microsoft.com/Forums/en-US/itproxpsp/thread/b991ce21-db5b-46eb-8c9b-f8d4aa14a35a

Once past that, ran Windows Update and installed 65 updates (since SP3)
without a hitch. Didn't lose a thing; my files, programs, desktop and all
settings are just as they were. Whew! Now if only I could get back all the
hours I spent to get back to normal ;)

"MowGreen" wrote:

> .
>

[Robert Aldwinckle]

"Darryl" <Dar...@discussions.microsoft.com> wrote in message

news:5E65EC97-0B09-44AB...@microsoft.com...

> Well finally, I'm back in business. I booted the Windows CD and did a
> repair. Went pretty smoothly; did have to hunt down a driver file (.MOF?)
> for the network card. Luckily was able to find it on the internet.
>
> After everything was done, had a nasty problem with activation that took
> me
> a few days of Googling to solve: when I logged in, it said I had to
> activate.

> Clicked OK and then nothing happened; just showed the desktop.

> Turns out that activation requires IE8.

More likely just a repair of whatever IE you had. Unfortunately
comprehensive repairs are hard to find and uninstalling and reinstalling IE
is sometimes impossible; so, yes, installing a higher level version of IE
could have been a sufficient repair for your case.

---

[smartbear]

Ran into this problem on Server 2003 SP2 and none of about 6 other proposed
solutions worked. No, I didn't have antivirus software running. This is how
I ultimately was able to "fix" this.

Find the right standalone Windows Update installer, in my case it was the
3.0 version for Server 2003.

Run the installer and watch for the temp directory it creates before
displaying the Next button in the wizard. If you miss it, just look for a
recently created GUID directory off the root of the drive it was unzipped on.

Go into this directory, and you'll see a number of .dll files that
correspond to those in the windows system directory.

As a sanity check, use explorer to check the file properties of wuweb.dll in
the system directory and the wuweb.dll in the unzip directory, and compare
the file versions. Make sure you're installing later versions of these
files. Or it might be easier to just check the windowsupdate.log file - it
records the file versions in the previous failed installs.

Now copy each of the .dll files in the unzip directory to a new directory.
In addition to these files, there are .exe, .cpl and language enabled files
you'll need to copy. The language enabled files will need to be copied to
the appropriate filename, e.g.:
wuaucpl.cpl.mui_en => wuaucpl.cpl.mui

Then for each of the files in your new directory, copy the existing system
files off somewhere, e.g.:

md backup && for %a in (*.*) do copy \windows\system32\%a backup

Boot to a safe mode command line and copy the new set of files into the
system directory. At this point you can run the windows update installer
again and check the windowsupdate.log file again - I missed one file doing
this and it pointed out the one I'd missed. If you copied the files
correctly the log will show there was nothing to do.

Yes, this is a PITA, but if I done this in the first place instead of trying
the various proposed "solutions" it would have saved me several aggravating
hours. I don't, however, know if this removes the underlying problem or
whether it might happen again on the next attempted update.

Eric

[PA Bear [MS MVP]]

> ...I didn't have antivirus software running. This is

> how I ultimately was able to "fix" this.

Not having "antivirus software running" is why you needed to fix it!