I can't install critical updates

[Maslow]

Hello !
I don't speak English very well but I think you'll understand me.
I couldn't install some critical Windows updates (such as KB958644,
KB953155). However, I could install Windows Defender Updates or Silverlight.

I already wrote to Microsoft Technical Support : they answered me twice.
They sent me two files to install (FIX_WU_v.17.zip the first time, then
Checksur the second time). I answered them that the two solutions didn't
help me. Since, they didn't answer me anymore.

So, I expose you my problem : my Windows Updates can search new updates, but
the problem is that when I arrived at 98% of the installation, I had this
code error : 800736B2 (unknown error). I run Vista Premium SP1.
Thank you.

[MowGreen [MVP]]

800736B2 ERROR_SXS_INVALID_ACTCTXDATA_FORMAT
The application binding data format is invalid.

The issue may be caused by antivirus/security software.
What is the installed AV/security suite/anti-malware and which firewall
is being used ?
Which country did you contact Support in and do you have a case number,
Maslow ?

MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============

[Maslow]

Thank you MowGreen for answering me.

I'm from France and I think that Microsoft technical support is located in
Swiss, or Luxembourg or Belgium. Anyway, the guy has a French name.
I have Antivir and Windows Defender as antivirus and antimalwares
residential softwares.
Furthermore, I scan my computer from time to time with Malwarebytes and
Spybot (theses two softwares are not residentials).
I have Vista Premium Vista SP1 and use Windows Firewall (Inbound and
Outbound : I created some outbound rules).

Last news : Microsoft sent me a third mail and suggested me to install this
file : "au_client_tool_v72.exe". I don't know exactly the contents of this
file, but I think(I'm not sure) the guy installed me Windows Installer 3.1
!!! Anyway, this third solution didn't work like the others.

I don't know what you mean by "case number" but in alls objects of my
emails, I've got this figure : SRX1082888031ID

"MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le message de groupe
de discussion : e$5tAVrOJ...@TK2MSFTNGP06.phx.gbl...

[MowGreen [MVP]]

This *is* the case number: SRX1082888031ID

I can't believe they sent you an older reset tool. Please download the
latest one from here and *save* it:

http://www.codeplex.com/aureset/Release/ProjectReleases.aspx?ReleaseId=17263

Once the download completes, close the browser and all open programs.

Before proceeding, what rules did you add to outbound filtering for the
native Vista firewall ? Suggest you reset the firewall to it's Default
settings for now.

Next, *** temporarily disable AntiVir so that *none* of it's services
nor processes are running. Consult the User Guide or Avira's web site if
the page below does not accomplish that ***
http://www.bleepingcomputer.com/forums/topic114351.html

Now run au_check_v78_codeplex.exe and allow it time to complete it's
operation. Restart the system after it's done.

Can the system update now ?
If not, has Malware Bytes ever detected any malware on the system ?

MowGreen [MVP 2003-2008]
================

[PA Bear [MS MVP]]

> Furthermore, I scan my computer from time to time with Malwarebytes and
> Spybot (theses two softwares are not residentials).

Is Spybot Tea Timer enabled? Was it ever enabled?
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

[Maslow]

Thank you. I'll let you know soon.

As regards the outbound rules of the firewall, I blocked all traffic and
allow some : svhost.exe, helpPane.exe, services.exe, rundll.exe, wercon.exe,
Internet Explorer, Firefox,...) and it works till now.

As regards the reset tool that I suspected as an old version : I said that
because they asked me to right click this file ("au-client_tool_v.72.exe)
and choose "run in compatibility mode for XP SP2", Am I wrong ?

"MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le message de groupe

de discussion : ufK616sO...@TK2MSFTNGP02.phx.gbl...

[Maslow]

@ Robert Dyer : No it isn't

"PA Bear [MS MVP]" <PABe...@gmail.com> a écrit dans le message de groupe
de discussion : OLLVBPv...@TK2MSFTNGP03.phx.gbl...

[PA Bear [MS MVP]]

Was it ever enabled?

[Maslow]

I'm afraid I don't really understand you.
All that I can say is that in Spybot option, I noticed that "Resident
tea-timer" and "Resident SDHelper" are uncheked.

"PA Bear [MS MVP]" <PABe...@gmail.com> a écrit dans le message de groupe

de discussion : OCViQN2O...@TK2MSFTNGP05.phx.gbl...

[PA Bear [MS MVP]]

Has the Tea Timer option EVER been checked?

[Maslow]

Never

"PA Bear [MS MVP]" <PABe...@gmail.com> a écrit dans le message de groupe

de discussion : OGsMjm2O...@TK2MSFTNGP05.phx.gbl...

[PA Bear [MS MVP]]

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For more information about how to contact your local Microsoft subsidiary
for security update support issues, visit the International Support Web
site: http://support.microsoft.com/common/international.aspx

For enterprise customers, support for security updates is available through
your usual support contacts.

--
~Robear Dyer (PA Bear)

MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.net

[Maslow]

@ MowGreen : I'm waiting for Microsoft last proposition tomorrow. If this
last won't work, I'll download "au_check_v78_codeplex.exe" and follow your
instruction.

"Maslow" <valy-...@hotmail.fr> a écrit dans le message de groupe de
discussion : #fUewYzO...@TK2MSFTNGP05.phx.gbl...

[MowGreen [MVP]]

> As regards the reset tool that I suspected as an old version : I said that because they asked me to
> right click this file ("au-client_tool_v.72.exe) and choose "run in compatibility mode for XP SP2",
> Am I wrong ?

Contrary to the advice they gave you, suggest you *right click*
au_check_v78_codeplex.exe and choose 'Run as administrator'.
It's designed to work with Vista.

> As regards the outbound rules of the firewall, I blocked all traffic
> and allow some : svhost.exe, helpPane.exe, services.exe, rundll.exe,
> wercon.exe, Internet Explorer, Firefox,...) and it works till now.

I *hope* you meant svchost.exe and NOT *svhost.exe*.
Vista uses wuapp.exe and wuaucult.exe to update and they can't be
blocked by the firewall. They're a process spawned from svchost.exe,
specifically svchost.exe -k netsvcs. So, I doubt that you accidentally
blocked the system from the update servers unless either the RPC or DCOM
Server Process Launcher services are blocked.
That's why I suggested resetting the firewall to it's Default settings
so that we could eliminate the firewall as being the cause of the issue.

BUT, you're saying that Windows Update worked previously with the
firewall rules you created, correct ?

[Maslow]

Sorry, it is indeed *Svchost.exe*.
Yes, I had no problems before even with theses rules.

"MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le message de groupe

de discussion : u2OqlW5O...@TK2MSFTNGP05.phx.gbl...

[Maslow]

I installed "au_check_v78" MowGreen but unfortunately It did'nt work for me
! I even desactivated all antivirus and antimalware and Firewall progams.
Perhaps It's a good tool and may be I have corrupted files.
I even tried to manually install the concerning file but it failed.
Now, I'm really stuck !
If someone has an idea to repair corrupted files without reinstalling
Vista...

"MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le message de groupe

de discussion : u2OqlW5O...@TK2MSFTNGP05.phx.gbl...

[MowGreen [MVP]]

The tool creates several log files in C:\aulogs [the logs are stored on
the root drive, the drive where Windows is installed to. In most cases
this is the C:\ drive. IF Windows is installed to a different
drive/partition, then the logs will be located there]
Since I'm not that familiar with the logs yet, please provide me with a
list of their names and perhaps we can figure out just where the issue lies.
As a last resort we can contact the tools author and send him the logs.

[Maslow]

I found 9 files with .txt extension and others with .log (checkSUR.log,
WindowsUpdate.log, progress.log).
And there is also an .htm file (download.htm). I clicked above and I got
this text :
"The following prerequisites may need to be installed/reinstalled for proper
operation of Windows Update/Microsoft Update/ The Automatic Update Client
For Vista:
WindowsUpdateAgent30-x86.exe (direct link to the latest version of the
Update Client)"

What do you think, should I download this file ?

"MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le message de groupe

de discussion : ey$zjZePJ...@TK2MSFTNGP06.phx.gbl...

[MowGreen [MVP]]

Please provide a list of *all* .txt files and .log files.
The tool attempts to install the WindowsUpdateAgent but, obviously,
something went awry. Let's check the logs before attempting to run the
tool once more, Maslow.

[Master Blaster]

Try this fix from Microsoft Update Help:

Open Notepad and copy/paste the following lines....

---- Start code below

@echo off
cls

regsvr32 wuapi.dll
regsvr32 wuaueng.dll
regsvr32 wuaueng1.dll
regsvr32 wucltui.dll
regsvr32 wups.dll
regsvr32 wups2.dll
regsvr32 wuweb.dll

pause

---- End code above

Now Save with "File type = ALL", and filename = FixUpdates.cmd

You can now run FixUpdates.cmd to fix Win Updates. I've used this in the
past, it worked for me.

--
===============
Master Blaster
Computer System Specialist
IT Technician

"MowGreen [MVP]" <mowg...@nowandzen.com> wrote in message
news:uPub$WfPJH...@TK2MSFTNGP05.phx.gbl:

[Maslow]

1) Here are the list :

Under "data.cab" :
- MGAlog.txt
- audcomlog.txt
- Fileversions.txt
- WinHTTP_log.txt
- cci_XML_object_test.txt
- WindowsUpdate.log
- gpresult.txt
- bitsqueue.txt
- Descriptors.txt
- CheckSUR.log

Under "progress.CAB" :
- _progress.log
- DLLReg_output.txt

2) I tried to install WindowsUpdateAgent but, as you said MowGreen, it
didn't work (I've got the same code error : 800736B2)

3) @ Master Blaster : Is this manipulation valid also for Vista ? For
example, in C:\Windows\System 32, I have "wucltux.dll" instead of
"wucltui.dll"

"Master Blaster" <no...@nowhere.com> a �crit dans le message de groupe de
discussion : AmLPk.277623$C65....@en-nntp-01.dc1.easynews.com...

>> > "MowGreen [MVP]" <mowg...@nowandzen.com> a �crit dans le message de

>> > groupe de discussion : ey$zjZePJ...@TK2MSFTNGP06.phx.gbl...
>> >
>>
>> >> The tool creates several log files in C:\aulogs [the logs are stored
>> >> on the root drive, the drive where Windows is installed to. In most
>> >> cases this is the C:\ drive. IF Windows is installed to a different
>> >> drive/partition, then the logs will be located there]
>> >> Since I'm not that familiar with the logs yet, please provide me with
>> >> a list of their names and perhaps we can figure out just where the
>> >> issue lies.
>> >> As a last resort we can contact the tools author and send him the
>> >> logs.
>> >>
>> >> MowGreen [MVP 2003-2009]
>> >> ===============
>> >> *-343-* FDNY
>> >> Never Forgotten
>> >> ===============
>> >>
>> >>
>> >> Maslow wrote:
>> >>
>>
>> >>> I installed "au_check_v78" MowGreen but unfortunately It did'nt work
>> >>> for me ! I even desactivated all antivirus and antimalware and
>> >>> Firewall progams.
>> >>> Perhaps It's a good tool and may be I have corrupted files.
>> >>> I even tried to manually install the concerning file but it failed.
>> >>> Now, I'm really stuck !
>> >>> If someone has an idea to repair corrupted files without reinstalling
>> >>> Vista...
>> >>>
>> >>>

>> >>> "MowGreen [MVP]" <mowg...@nowandzen.com> a �crit dans le message de

>> >>>>> "Maslow" <valy-...@hotmail.fr> a �crit dans le message de groupe

>> >>>>> de discussion : #fUewYzO...@TK2MSFTNGP05.phx.gbl...
>> >>>>>
>>
>> >>>>>> Thank you. I'll let you know soon.
>> >>>>>>
>> >>>>>> As regards the outbound rules of the firewall, I blocked all
>> >>>>>> traffic and allow some : svhost.exe, helpPane.exe, services.exe,
>> >>>>>> rundll.exe, wercon.exe, Internet Explorer, Firefox,...) and it
>> >>>>>> works till now.
>> >>>>>>
>> >>>>>> As regards the reset tool that I suspected as an old version : I
>> >>>>>> said that because they asked me to right click this file
>> >>>>>> ("au-client_tool_v.72.exe) and choose "run in compatibility mode
>> >>>>>> for XP SP2", Am I wrong ?
>> >>>>>>
>> >>>>>>
>> >>>>>>

>> >>>>>> "MowGreen [MVP]" <mowg...@nowandzen.com> a �crit dans le message

>> >>>>>>>> "MowGreen [MVP]" <mowg...@nowandzen.com> a �crit dans le

[MowGreen [MVP]]

The code MasterBlaster posted is contained in the AU Reset tool.
Maslow, please post the WinHTTP_.log.txt, Fileversions.txt,
CheckSUR.log, and _progress.log.

Q. When you attempted to install the WUA did you reboot afterwards ?

Maslow wrote:

> "Master Blaster" <no...@nowhere.com> a écrit dans le message de groupe

>>> > "MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le message de

>>> >>> "MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le message de

>>> >>>>> "Maslow" <valy-...@hotmail.fr> a écrit dans le message de groupe

>>> >>>>> de discussion : #fUewYzO...@TK2MSFTNGP05.phx.gbl...
>>> >>>>>
>>>
>>> >>>>>> Thank you. I'll let you know soon.
>>> >>>>>>
>>> >>>>>> As regards the outbound rules of the firewall, I blocked all
>>> >>>>>> traffic and allow some : svhost.exe, helpPane.exe, services.exe,
>>> >>>>>> rundll.exe, wercon.exe, Internet Explorer, Firefox,...) and it
>>> >>>>>> works till now.
>>> >>>>>>
>>> >>>>>> As regards the reset tool that I suspected as an old version : I
>>> >>>>>> said that because they asked me to right click this file
>>> >>>>>> ("au-client_tool_v.72.exe) and choose "run in compatibility mode
>>> >>>>>> for XP SP2", Am I wrong ?
>>> >>>>>>
>>> >>>>>>
>>> >>>>>>

>>> >>>>>> "MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le message

>>> >>>>>>>> "MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le

[Maslow]

I finally suceed to install WUA because I found another WUA file on
Microsoft site which has exactly the same version (6.2.29.0) but with a
slightly different size (6079 vs 6071 Ko). Yes I reboot my computer but it
didn't still work.

Here then contents of the files you've asked (CAUTION : very long)

1) Fileversions.txt :
Microsoft Windows [version 6.0.6001]
Personal Service Pack 1 (Build 6001)

Windows Update Agent (AU Client) File Versions:
------------------------------------------------------------------------------
--a-- W32i DLL ENU 7.2.6001.784 shp 1,811,656 07-19-2008 wuaueng.dll
--a-- W32i DLL ENU 7.2.6001.784 shp 563,912 07-19-2008 wuapi.dll
--a-- W32i APP - 7.2.6001.784 shp 53,448 07-19-2008 wuauclt.exe
--a-- W32i DLL - 7.2.6001.784 shp 45,768 07-19-2008 wups2.dll
--a-- W32i DLL - 7.2.6001.784 shp 36,552 07-19-2008 wups.dll

MSXML File Versions:
------------------------------------------------------------------------------
--a-- W32i DLL - 8.100.1043.0 shp 1,190,400 01-19-2008 msxml3.dll
--a-- W32i DLL ENU 8.20.8730.1 shp 2,048 11-02-2006 msxml3r.dll

BITS / WinHTTP File Versions:
------------------------------------------------------------------------------
--a-- W32i DLL ENU 7.0.6000.16386 shp 10,752 11-02-2006 bitsprx2.dll
--a-- W32i DLL ENU 7.0.6000.16386 shp 9,728 11-02-2006 bitsprx3.dll
--a-- W32i DLL ENU 7.0.6001.18000 shp 758,272 01-19-2008 qmgr.dll
--a-- W32i DLL ENU 7.0.6000.16386 shp 20,480 11-02-2006 qmgrprxy.dll
--a-- W32i DRV ENU 6.0.6001.18000 shp 401,408 01-19-2008 http.sys
--a-- W32i DLL ENU 6.0.6001.18000 shp 376,832 01-19-2008 winhttp.dll

Windows Installer (MSI) File Versions:
------------------------------------------------------------------------------
--a-- W32i DLL ENU 4.0.6001.18000 shp 2,085,888 01-19-2008 msi.dll
--a-- W32i APP ENU 4.0.6001.18000 shp 71,680 01-19-2008 msiexec.exe
--a-- W32i DLL ENU 4.0.6001.18000 shp 332,288 01-19-2008 msihnd.dll
--a-- W32i DLL ENU 4.0.6000.16386 shp 2,560 11-02-2006 msimsg.dll
--a-- W32i DLL ENU 4.0.6001.18000 shp 19,456 01-19-2008 msisip.dll

Windows Jet and Server Database files (Jet and esent) File Versions:
------------------------------------------------------------------------------
--a-- W32i DLL ENU 6.0.6001.18000 shp 1,452,544 01-19-2008 esent.dll
--a-- W32i DLL - 4.0.9704.0 shp 1,589,248 01-19-2008 msjet40.dll

2) WinHTTP_.log.txt
Proxycfg settings WORKED. Note - If you are getting 0x8024402C when
performing WU/MU scan, then see http://support.microsoft.com/?id=900936

Microsoft (R) WinHTTP Default Proxy Configuration Tool
Copyright (c) Microsoft Corporation. All rights reserved.
Current WinHTTP proxy settings under:
HKEY_LOCAL_MACHINE\
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\
WinHttpSettings :
Direct access (no proxy server).

3) CheckSUR.log
Checking System Update Readiness.
Version 6.0.6001.22275
2008-10-31 17:32
Checking Deployment Packages
Checking Package Manifests and catalogs.
Checking package watchlist.
Checking component watchlist.
Checking packages.
Checking component store

4) _progress.log
---AU Check Tool v78a ---
03/11/2008 18:12:18,65

---Vista SP1 or Server 2008 Detected---
---Stopping the Automatic Updates Service---
Le service Windows Update s'arr^te.
Le service Windows Update a ,t, arr^t,.

03/11/2008 18:12:21,38 : SC.EXE: Gathering Security Descriptor info for
Wuauserv, BITS, Windows Installer, and TS
03/11/2008 18:12:21,58 : Saved: Descriptors.txt

--logging jobs in the the BITS queue to bitsqueue.txt---

---Clearing out the BITS queue---

BITSADMIN version 2.0 [ 6.6.2600.2180 ]
BITS administration utility.
(C) Copyright 2000-2004 Microsoft Corp.

0 out of 0 jobs canceled.

---Stopping the Background Intelligent Transfer Service---
Le service Service de transfert intelligent en arriSre-plan s'arr^te.
Le service Service de transfert intelligent en arriSre-plan a ,t, arr^t,.

---Removing any pending file rename or RebootRequired registry keys---
---Removing any old UserAgent registry keys (per SOX080306700036)---
---Registering Dependent DLLs for Windows Update Agent
---If registration of any component fails, run SFC /scannow OR Reinstall
most recent OS service pack---
---Done Registering Dependent DLLs---
---Cleaning up the Software Distribution download folder---

---Cleaning up BITS state files---
Fichier supprim, - C:\ProgramData\Application
Data\Microsoft\Network\Downloader\qmgr0.dat
Fichier supprim, - C:\ProgramData\Application
Data\Microsoft\Network\Downloader\qmgr1.dat

Determining Version (Vista, Vista SP1, or 2008)
Vista specific section

---Verifying the Network Service Account has Read permissions to the system
root---
0 fichiers correctement trait,sя; ,chec du traitement de 1 fichiers

03/11/2008 18:12:34,75 : ---Dumping Policy settings---

03/11/2008 18:12:43,98 : ---Running CheckSUR---
03/11/2008 18:12:44,00 : ---CheckSUR Scan Finished---

End of OS specific section
---Checking for the FilesNotToBackup and RPC Registry Keys---
---Check for the Domain Registry key--
--verify the SusServerVersion is not present--
---Restarting the Automatic Updates Service---
Le service Windows Update d,marre.
Le service Windows Update a d,marr,.

---Restarting the Background Intelligent Transfer Service---
Le service Service de transfert intelligent en arriSre-plan d,marre.
Le service Service de transfert intelligent en arriSre-plan a d,marr,.
-
---Enumerating files used by BITS---
Le volume dans le lecteur C s'appelle ACER
Le num,ro de s,rie du volume est 6C02-753E

R,pertoire de C:\Windows\system32

19/01/2008 08:33 192я000 bitsadmin.exe
19/01/2008 08:33 31я744 bitsigd.dll
02/11/2006 10:46 17я920 bitsperf.dll
02/11/2006 10:46 10я752 bitsprx2.dll
02/11/2006 10:46 9я728 bitsprx3.dll
02/11/2006 10:46 9я216 bitsprx4.dll
02/11/2006 10:46 17я920 bitsprx5.dll
7 fichier(s) 289я280 octets
0 R,p(s) 46я662я766я592 octets libres
Le volume dans le lecteur C s'appelle ACER
Le num,ro de s,rie du volume est 6C02-753E

R,pertoire de C:\Windows\system32

19/01/2008 08:36 758я272 qmgr.dll
02/11/2006 10:46 20я480 qmgrprxy.dll
2 fichier(s) 778я752 octets
0 R,p(s) 46я662я864я896 octets libres
Le volume dans le lecteur C s'appelle ACER
Le num,ro de s,rie du volume est 6C02-753E

R,pertoire de C:\Windows\system32

19/01/2008 08:36 376я832 winhttp.dll
1 fichier(s) 376я832 octets
0 R,p(s) 46я662я914я048 octets libres
Le volume dans le lecteur C s'appelle ACER
Le num,ro de s,rie du volume est 6C02-753E

R,pertoire de C:\Windows\system32

---Verifying permissions on windir\registration directory based on
KB909444---

---Getting data logs and writing to C:\aulogs\data
---Testing creation of XML objects---
03/11/2008 18:14:10,53 : FILEVER.EXE: Gathering AU Related File Version
Information
03/11/2008 18:14:11,76 : Saved: Fileversions.txt file
03/11/2008 18:14:57,16 Completed

"MowGreen [MVP]" <mowg...@nowandzen.com> a йcrit dans le message de groupe
de discussion : ubQVs0pP...@TK2MSFTNGP04.phx.gbl...

>> "Master Blaster" <no...@nowhere.com> a йcrit dans le message de groupe de

>>>> > "MowGreen [MVP]" <mowg...@nowandzen.com> a йcrit dans le message de

>>>> >>> "MowGreen [MVP]" <mowg...@nowandzen.com> a йcrit dans le message

>>>> >>>>> "Maslow" <valy-...@hotmail.fr> a йcrit dans le message de

>>>> >>>>> groupe
>>>> >>>>> de discussion : #fUewYzO...@TK2MSFTNGP05.phx.gbl...
>>>> >>>>>
>>>>
>>>> >>>>>> Thank you. I'll let you know soon.
>>>> >>>>>>
>>>> >>>>>> As regards the outbound rules of the firewall, I blocked all
>>>> >>>>>> traffic and allow some : svhost.exe, helpPane.exe, services.exe,
>>>> >>>>>> rundll.exe, wercon.exe, Internet Explorer, Firefox,...) and it
>>>> >>>>>> works till now.
>>>> >>>>>>
>>>> >>>>>> As regards the reset tool that I suspected as an old version : I
>>>> >>>>>> said that because they asked me to right click this file
>>>> >>>>>> ("au-client_tool_v.72.exe) and choose "run in compatibility mode
>>>> >>>>>> for XP SP2", Am I wrong ?
>>>> >>>>>>
>>>> >>>>>>
>>>> >>>>>>

>>>> >>>>>> "MowGreen [MVP]" <mowg...@nowandzen.com> a йcrit dans le

>>>> >>>>>>>> "MowGreen [MVP]" <mowg...@nowandzen.com> a йcrit dans le

[PA Bear [MS MVP]]

[@BroMow: Is v7.2.6001.788 available yet?]

Maslow wrote:
> I finally suceed to install WUA because I found another WUA file on
> Microsoft site which has exactly the same version (6.2.29.0) but with a
> slightly different size (6079 vs 6071 Ko). Yes I reboot my computer but it
> didn't still work.
>
> Here then contents of the files you've asked (CAUTION : very long)
>
> 1) Fileversions.txt :
> Microsoft Windows [version 6.0.6001]
> Personal Service Pack 1 (Build 6001)
>
> Windows Update Agent (AU Client) File Versions:
> ------------------------------------------------------------------------------
> --a-- W32i DLL ENU 7.2.6001.784 shp 1,811,656 07-19-2008 wuaueng.dll
> --a-- W32i DLL ENU 7.2.6001.784 shp 563,912 07-19-2008 wuapi.dll
> --a-- W32i APP - 7.2.6001.784 shp 53,448 07-19-2008 wuauclt.exe
> --a-- W32i DLL - 7.2.6001.784 shp 45,768 07-19-2008 wups2.dll
> --a-- W32i DLL - 7.2.6001.784 shp 36,552 07-19-2008 wups.dll

<SNIP>

[MowGreen [MVP]]

Yup, it's now live from the MS Download Center via the links here:
http://support.microsoft.com/kb/949104

[MowGreen [MVP]]

I don't know which version you are referring to or from where you
downloaded it from. The latest Version is 7.2.6001.788.
It can be downloaded from the links here:
http://support.microsoft.com/kb/949104

Be sure to obtain the correct version for Windows x86 [32-bit].
Save the download, close all open programs and browsers.
*Right* click windowsupdateagent30-x86.exe and choose 'Run as
administrator'.

IF you get a message that the WUA is already installed then you'll need
to add this command /wuforce.
Depending upon where you saved the WUA to, the command from the Run line
will appear as

<path>\windowsupdateagent30-x86.exe /wuforce
[<path> being the location of where the WUA was saved to]

So, once the download completes click Start > Run > then click the
Browse button and locate windowsupdateagent30-x86.exe.
Put a space after the above and then add /wuforce.
Click OK or press Enter.
Restart the system afterwards.

Since you went ahead and installed an unknown version of the WUA, the
log files you posted are no longer relevant as they are from a few days
ago and any information in them is related to the previous WUA, v.
7.2.6001.784.

IF installing the latest version of the WUA does not resolve the error
message then suggest you give sfc /scannow a shot:
http://support.microsoft.com/kb/936212

Click the Change link next to United States if the page does not show in
French.

NOTE: Do NOT use the AU Reset tool again as it's still pointing to the
previous v. of the WUA.

[PA Bear [MS MVP]]

THX

[Maslow]

I think I have 7.2.6001.784 version because I only installed WUA after I
installed AU_CHECK_v.78. Now, how can I verify that I have the good version
?

"MowGreen [MVP]" <mowg...@nowandzen.com> a йcrit dans le message de groupe

de discussion : OtowudsP...@TK2MSFTNGP06.phx.gbl...

[MowGreen [MVP]]

Check the Version of wups or wups2.dll located in WINDOWS\System 32.
Locate the file[s], right click them and choose Properties, then click
the Version tab. How to show hidden files, folders, and system files -
http://www.bleepingcomputer.com/tutorials/tutorial62.html#vista

I'm not sure that AU Reset has been updated to point to the latest
version of the WUA. Will ask the author about that, Maslow.

MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============

Maslow wrote:

> I think I have 7.2.6001.784 version because I only installed WUA after I
> installed AU_CHECK_v.78. Now, how can I verify that I have the good
> version ?
>

> "MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le message de

>>> system root--- 0 fichiers correctement trait,sĸ; ,chec du traitement

>>> de 1 fichiers
>>>
>>> 03/11/2008 18:12:34,75 : ---Dumping Policy settings---
>>>
>>> 03/11/2008 18:12:43,98 : ---Running CheckSUR--- 03/11/2008
>>> 18:12:44,00 ---CheckSUR Scan Finished---
>>> End of OS specific section
>>> ---Checking for the FilesNotToBackup and RPC Registry Keys---
>>> ---Check for the Domain Registry key-- --verify the SusServerVersion
>>> is not present-- ---Restarting the Automatic Updates Service--- Le
>>> service Windows Update d,marre.
>>> Le service Windows Update a d,marr,.
>>>
>>> ---Restarting the Background Intelligent Transfer Service--- Le
>>> service Service de transfert intelligent en arriSre-plan d,marre.
>>> Le service Service de transfert intelligent en arriSre-plan a d,marr,.
>>> -
>>> ---Enumerating files used by BITS---
>>> Le volume dans le lecteur C s'appelle ACER
>>> Le num,ro de s,rie du volume est 6C02-753E
>>>
>>> R,pertoire de C:\Windows\system32
>>>

>>> 19/01/2008 08:33 192ĸ000 bitsadmin.exe
>>> 19/01/2008 08:33 31ĸ744 bitsigd.dll
>>> 02/11/2006 10:46 17ĸ920 bitsperf.dll
>>> 02/11/2006 10:46 10ĸ752 bitsprx2.dll
>>> 02/11/2006 10:46 9ĸ728 bitsprx3.dll
>>> 02/11/2006 10:46 9ĸ216 bitsprx4.dll
>>> 02/11/2006 10:46 17ĸ920 bitsprx5.dll
>>> 7 fichier(s) 289ĸ280 octets
>>> 0 R,p(s) 46ĸ662ĸ766ĸ592 octets libres

>>> Le volume dans le lecteur C s'appelle ACER
>>> Le num,ro de s,rie du volume est 6C02-753E
>>>
>>> R,pertoire de C:\Windows\system32
>>>

>>> 19/01/2008 08:36 758ĸ272 qmgr.dll
>>> 02/11/2006 10:46 20ĸ480 qmgrprxy.dll
>>> 2 fichier(s) 778ĸ752 octets
>>> 0 R,p(s) 46ĸ662ĸ864ĸ896 octets libres

>>> Le volume dans le lecteur C s'appelle ACER
>>> Le num,ro de s,rie du volume est 6C02-753E
>>>
>>> R,pertoire de C:\Windows\system32
>>>

>>> 19/01/2008 08:36 376ĸ832 winhttp.dll
>>> 1 fichier(s) 376ĸ832 octets
>>> 0 R,p(s) 46ĸ662ĸ914ĸ048 octets libres

>>> Le volume dans le lecteur C s'appelle ACER
>>> Le num,ro de s,rie du volume est 6C02-753E
>>>
>>> R,pertoire de C:\Windows\system32
>>>
>>> ---Verifying permissions on windir\registration directory based on
>>> KB909444---
>>> ---Getting data logs and writing to C:\aulogs\data
>>> ---Testing creation of XML objects--- 03/11/2008 18:14:10,53 :
>>> FILEVER.EXE: Gathering AU Related File Version Information
>>> 03/11/2008 18:14:11,76 : Saved: Fileversions.txt file
>>> 03/11/2008 18:14:57,16 Completed
>>>
>>>

>>> "MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le message de

>>>>> "Master Blaster" <no...@nowhere.com> a écrit dans le message de

>>>>>>> > "MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le

>>>>>>> >>> "MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le

>>>>>>> >>>>> "Maslow" <valy-...@hotmail.fr> a écrit dans le message de

>>>>>>> >>>>> groupe
>>>>>>> >>>>> de discussion : #fUewYzO...@TK2MSFTNGP05.phx.gbl...
>>>>>>> >>>>>
>>>>>>>
>>>>>>> >>>>>> Thank you. I'll let you know soon.
>>>>>>> >>>>>>
>>>>>>> >>>>>> As regards the outbound rules of the firewall, I blocked all
>>>>>>> >>>>>> traffic and allow some : svhost.exe, helpPane.exe,
>>>>>>> services.exe,
>>>>>>> >>>>>> rundll.exe, wercon.exe, Internet Explorer, Firefox,...)
>>>>>>> and it
>>>>>>> >>>>>> works till now.
>>>>>>> >>>>>>
>>>>>>> >>>>>> As regards the reset tool that I suspected as an old version
>>>>>>> : I
>>>>>>> >>>>>> said that because they asked me to right click this file
>>>>>>> >>>>>> ("au-client_tool_v.72.exe) and choose "run in compatibility
>>>>>>> mode
>>>>>>> >>>>>> for XP SP2", Am I wrong ?
>>>>>>> >>>>>>
>>>>>>> >>>>>>
>>>>>>> >>>>>>

>>>>>>> >>>>>> "MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le

>>>>>>> >>>>>>>> "MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le

[Maslow]

Both files (wups and wups2.dll) have 7.2.6001.784 version.
Did my installation not function well ? Yet I did download WUA from this
link http://support.microsoft.com/kb/949104, and chose the ones for x86
computer (in fact I have a x64 computer, but with x32 Windows)
As information, I found 80 cases of 7.2.6001.784 (and 26 of 7.2.6001.788) on
my hard disk. It's strange no ?

PS : I don't know if it is related to this problem, but Vista Security
Center don't recognize anymore my antivirus (Antivir updated).

"MowGreen [MVP]" <mowg...@nowandzen.com> a écrit dans le message de groupe

de discussion : Olm2fRSQ...@TK2MSFTNGP02.phx.gbl...

[PA Bear [MS MVP]]

> PS : I don't know if it is related to this problem, but Vista Security
> Center don't recognize anymore my antivirus (Antivir updated).

Not good.

[Maslow]

I resolved error message problem from Vista Security Center by uninstalling
and reinstalling Antivir. But I think this problem may come back.

Another question : How it comes I can't either manage to install manually
failing updates (msu files)?

"PA Bear [MS MVP]" <PABe...@gmail.com> a écrit dans le message de groupe
de discussion : #FQU0CeQ...@TK2MSFTNGP04.phx.gbl...

[PA Bear [MS MVP]]

The machine is still infected.

There's a very strong possibility that you have a Vundo infection, which is
usually accompanied by ZLOB and/or SDBot infections, all of which are
protected by a rootkit.

Run a thorough check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or another appropriate forum for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

==========================================

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.

--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/