Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

0x80072EE7 windows update error

2,593 views
Skip to first unread message

Minus273

unread,
Dec 17, 2007, 2:57:02 PM12/17/07
to
Hi guys

I get the error message 0x80072EE7 when I try to download updates.
There are no IP addresses for microsoft in the HOSTS file although there is
127.0.0.1 localhost in the file

I hope you can help me
--
Today is the first day of the rest of your life!

TaurArian

unread,
Dec 17, 2007, 3:20:18 PM12/17/07
to
This error code translates to ERROR_INTERNET_CANNOT_CONNECT. This could be caused by
firewall software blocking the Windows Update Site.
You may receive an "Error 0x80072EE2," "Error 0x80072EE7," "Error 0x80072EFD," "Error
0x80072F76," or "Error 0x80072F78" error message when you try to use the Windows Update
Web site or the Microsoft Update Web site
http://support.microsoft.com/?kbid=836941

When searching for available updates on the Update site, you see the 0x80072EE7 error
http://update.microsoft.com/windowsupdate/v6/showarticle.aspx?articleid=22&ln=en&IsMu=False

You may receive an error message when you search for available updates on the Windows
Update Web site or on the Microsoft Update Web site
http://support.microsoft.com/?kbid=883821

--
====================================
TaurArian [MVP] 2005-2008 - Australia
====================================
How to ask a question: http://support.microsoft.com/kb/555375
http://taurarian.mvps.org/index.htm
Emails will not be acknowledged - please post to the newsgroup so all may benefit.


"Minus273" <Minu...@discussions.microsoft.com> wrote in message
news:E50410E1-94F9-4358...@microsoft.com...

update@discussions.microsoft.com window update

unread,
Dec 17, 2007, 5:27:00 PM12/17/07
to

Minus273

unread,
Dec 17, 2007, 6:23:41 PM12/17/07
to
Hi

below did not help! What do i need to do now, or what other
information do you need from me?


--
Today is the first day of the rest of your life!

guzarva

unread,
Dec 18, 2007, 4:44:03 PM12/18/07
to

michgal2k

unread,
Dec 20, 2007, 8:36:03 AM12/20/07
to
download fixwareout -
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe
Note: You will need to run this tool while having an Internet Connection.
The tool will download other files while running.
Save it to your desktop and run it. Click Next, then Install, make sure "Run
fixit" is checked and click Finish.
The fix will begin; follow the prompts.
If your firewall gives an alert, (because this tool will download an
additional files from the internet), please don't let your firewall block it,
but allow it instead.
You will be asked to reboot your computer; please do so. Your system may
take longer than usual to load; this is normal.
Once the desktop loads a text file will open (report.txt).

After that try the microsoft update - it worked great for me.
If you think about it, let me know

MowGreen [MVP]

unread,
Dec 20, 2007, 5:34:25 PM12/20/07
to
Why are you recommending running a malware specific tool when you have
no evidence that the OP's system is infected ?
Just because your system was infected does not mean that others' systems
are. Do you know the consequences of running Fixwareout on a CLEAN system ?
If not, then please refrain from this type of post.
If you do, then please present the evidence that the OPs system is infected.
The error message involves a protocol talker. The cause can be related
to a number of factors, it is *not* strictly related to malware.


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
================


michgal2k wrote:

> download fixwareout -
> http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

<snipped>

Minus273

unread,
Dec 20, 2007, 7:50:01 PM12/20/07
to
Below is the content of the Windowsupdate.log file - does this help to
identify the issue, and what can I do to correct it?

2007-12-21 00:32:34:734 3420 828 Misc =========== Logging initialized
(build: 7.0.6000.381, tz: -0000) ===========
2007-12-21 00:32:34:734 3420 828 Misc = Process: C:\Program Files\Internet
Explorer\IEXPLORE.EXE
2007-12-21 00:32:34:734 3420 828 Misc = Module:
C:\WINDOWS\system32\wuapi.dll
2007-12-21 00:32:34:734 3420 828 COMAPI ----------- COMAPI:
IUpdateServiceManager::AddService -----------
2007-12-21 00:32:34:734 3420 828 COMAPI - ServiceId =
{7971f918-a847-4430-9279-4a52d1efe18d}
2007-12-21 00:32:34:734 3420 828 COMAPI - AuthorizationCabPath =
C:\WINDOWS\SoftwareDistribution\AuthCabs\muauth.cab
2007-12-21 00:32:34:781 852 f00 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\7971f918-a847-4430-9279-4a52d1efe18d.auth.cab.temp\muauth.cab:
2007-12-21 00:32:34:796 852 f00 Misc Microsoft signed: Yes
2007-12-21 00:32:35:015 3788 f38 Misc =========== Logging initialized
(build: 7.0.6000.381, tz: -0000) ===========
2007-12-21 00:32:35:015 3788 f38 Misc = Process:
C:\WINDOWS\system32\wuauclt.exe
2007-12-21 00:32:35:015 3788 f38 Misc = Module:
C:\WINDOWS\system32\wuaueng.dll
2007-12-21 00:32:35:015 3788 f38 DtaStor Update service properties: service
registered with AU is {7971F918-A847-4430-9279-4A52D1EFE18D}
2007-12-21 00:32:35:046 3420 828 COMAPI - Added service, URL =
http://update.microsoft.com/microsoftupdate/
2007-12-21 00:32:35:046 3420 828 COMAPI ----------- COMAPI:
IUpdateServiceManager::RegisterServiceWithAU -----------
2007-12-21 00:32:35:046 3420 828 COMAPI - ServiceId =
{7971f918-a847-4430-9279-4a52d1efe18d}
2007-12-21 00:32:35:093 3420 828 Misc =========== Logging initialized
(build: 7.0.6000.381, tz: -0000) ===========
2007-12-21 00:32:35:093 3420 828 Misc = Process: C:\Program Files\Internet
Explorer\IEXPLORE.EXE
2007-12-21 00:32:35:093 3420 828 Misc = Module:
C:\WINDOWS\system32\muweb.dll
2007-12-21 00:32:35:093 3420 828 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
2007-12-21 00:32:35:109 3420 828 Misc Microsoft signed: Yes
2007-12-21 00:32:35:515 3420 828 Misc WARNING: DownloadFileInternal failed
for http://download.windowsupdate.com/v7/windowsupdate/redir/wuredir.cab:
error 0x80072ee7
2007-12-21 00:32:35:515 3420 828 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
2007-12-21 00:32:35:531 3420 828 Misc Microsoft signed: Yes
2007-12-21 00:32:36:312 3420 828 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
2007-12-21 00:32:36:328 3420 828 Misc Microsoft signed: Yes
2007-12-21 00:32:36:359 3420 828 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\WebSetup\wuident.cab:
2007-12-21 00:32:36:375 3420 828 Misc Microsoft signed: Yes
2007-12-21 00:32:36:843 3420 828 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\WebSetup\wuident.cab:
2007-12-21 00:32:36:843 3420 828 Misc Microsoft signed: Yes
2007-12-21 00:32:37:250 3420 828 Misc WARNING: DownloadFileInternal failed
for
http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab: error 0x80072ee7

--

MowGreen [MVP]

unread,
Dec 20, 2007, 10:26:28 PM12/20/07
to
Hang in there. As one can see, this is what is known as an 'emerging
issue '.
The section of the log posted doesn't show which version of Windows the
system is running ... I'm guessing XP, right ?
What is the installed antivirus/security software ?

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============

Minus273

unread,
Dec 21, 2007, 10:21:01 AM12/21/07
to
Hi - thanks for the help. I do have XP with SP2. I am running AVG free, and
also have AVG antispyware, windows defender and Spybot S&D on the machine. I
have never had any problems or conflicts with these

MowGreen [MVP]

unread,
Dec 21, 2007, 3:39:00 PM12/21/07
to
I pinged someone at MS about this 'emerging issue' but have not heard
back yet. If you'd care to, we can do some checking ourselves.
What stands out in the log is this entry :

2007-12-21 00:32:34:734 3420 828 COMAPI ----------- COMAPI:
IUpdateServiceManager::AddService -----------

I've not seen that in my log nor on others that have encountered the
0x80072EE7 error.
http://msdn2.microsoft.com/en-us/library/aa386819.aspx

> The IUpdateServiceManager interface adds or removes the registration of the update service with
> the Windows Update Agent or Automatic Updates.

0x80072EE7 ERROR_INTERNET_NAME_NOT_RESOLVED

I'm not sure if the issue lies with the redirect cabs on the system or
from the update server.
Suggest you download wsus3setup.cab from this link using Internet
Explorer and save it to the Desktop :
http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab

After the download completes, close IE.
If there is a 3rd party compression tool installed, such as WinZip or
7zip, you can use them to extract the contents of wsus3setup.cab to a
new folder on the Desktop.
IF not, then create a folder on the Desktop and name it wsus3setup
Open the wsus3setup.cab on the Desktop and right click the two files
contained therein, wsus3setup.cat and wsus3setup.inf, choose Extract,
and extract them to the newly created wsus3setup folder
Open the wsus3setup folder and *right* click wsus3setup.inf, choose
Install.

When the .inf file is installed, close any open windows and programs.
Now try a manual visit to Microsoft Update.

Did that resolve the issue ?

MowGreen [MVP]

unread,
Dec 22, 2007, 3:36:27 PM12/22/07
to
Forget the previous instructions. Instead, open a Command Prompt from
Start > Run > type in

cmd
Click OK or press Enter

At the prompt type these commands in, *press Enter after each one*
[NOTE the space after the g]

ipconfig /flushdns
exit

Now see if the system can access the update site

Minus273

unread,
Dec 23, 2007, 5:48:01 AM12/23/07
to
Sorry - below did not help, I still get the same error message
--

MowGreen [MVP]

unread,
Dec 23, 2007, 3:18:42 PM12/23/07
to
Nothing to be sorry about, you didn't create this issue <w>
Let's give this a shot ...
show hidden files, folders, and system files:
http://www.bleepingcomputer.com/tutorials/tutorial62.html#winxp

Using Windows Explorer, navigate to
WINDOWS\SoftwareDistribution\WuRedir

Open the WuRedir subfolder. How many folders are in there ?
I'm hoping 2 ...
Now open the folders and check the Created and Modified Dates of the
wuredir.xml files by right clicking them and choosing Properties.

Please post back with the Created and Modified dates and how many
folders are present in WuRedir.

I think the issue is that the update server is checking the validity of
the wuredir and wsus3setup.cabs and for some reason, the system is not
sending a response to back to the update server. The update server than
appears to be attempting to download the .cabs to the system but fails
to do so due to the 0x80072EE7 error.

BTW, who is your ISP ?

Minus273

unread,
Dec 25, 2007, 8:25:00 AM12/25/07
to
Thanks again
There are two folders in the subfolder

1. 7971F918-A847-4430-9279-4A52D1EFE18D dated 21/12/2007
Inside are two WINZIP files and the XML file.
XML file says created, modified and accessed 21 March 2007 at 12:48:42

2. 9482F4B4-E343-43B6-B170-9A65BC822C77 dated 25/12/2007
Inside is one WINZIP file and the XML file
XML file says created, modified and accessed 21 March 2007 at 12:48:26

ISP is through Pipex

Have a good Christmas

MowGreen [MVP]

unread,
Dec 25, 2007, 10:00:59 PM12/25/07
to
>> 1. 7971F918-A847-4430-9279-4A52D1EFE18D dated 21/12/2007
>> Inside are two WINZIP files and the XML file.

The 2 folders inside of 7971F918-A847-4430-9279-4A52D1EFE18D ... are
their extensions .cab or .zip ?
Same question for 9482F4B4-E343-43B6-B170-9A65BC822C77 ... is the
folder's extension .cab or .zip ?

Is this XP Home or Pro ?

Minus273

unread,
Dec 26, 2007, 6:48:00 PM12/26/07
to
Hi

XP Home

Curious result. Using DOS command prompt the result is they have a .cab
extension. Using windows explorer i get the following results

7971F918-A847-4430-9279-4A52D1EFE18D

muredir is a winzip file created 28 March 2007 at 23:08. Modified 11 June
2007 at 18:06. Accessed 11 Jun 2007 at 17:55. Properties show it as a
WinZip file that is 9.75 kb

wuredir is a winzip file created 24 October 2007 at 11:52. Modified 11 June
20077 at 18:06. Accessed 24 Octover 2007 at 11:52. Properties show it as a
WinZip file that is 9.70 kb

9482F4B4-E343-43B6-B170-9A65BC822C77

wuredir is a winzip file created 28 March 2007 at 23:08. Modified 25
December 2007 at 22:11. Accessed 25 December 2007 at 13:50. Properties
shows it as a winzip file that is 9.8 kb


--
Today is the first day of the rest of your life!

MowGreen [MVP]

unread,
Dec 27, 2007, 8:46:44 PM12/27/07
to
Which version of IE is installed [IE 6 or 7] and which firewall is being
used ?

In WINDOWS\SoftwareDistribution\SelfUpdate\Default is a copy of
wsus3setup.inf
What is the Created Date of wsus3setup.inf ?

In WINDOWS\SoftwareDistribution\WebSetup is another instance of
wsus3setup.inf
What is it's Created Date ?

Minus273

unread,
Dec 29, 2007, 9:20:00 AM12/29/07
to
IE 7 and I am using Windows Firewall

WINDOWS\SoftwareDistribution\SelfUpdate\Default\wsus3setup.inf was created
on 30/07/2007 at 19:23

WINDOWS\SoftwareDistribution\WebSetup\wsus3setup.inf was created on
30/07/2007 at 19:23

Both versions are 13kb in size

MowGreen [MVP]

unread,
Dec 29, 2007, 12:15:48 PM12/29/07
to
Much thanks for sticking with this and the information.
So, we've eliminated the redirect as the cause of the error and the
proper ActiveX controls appear to be installed.

Now ... can the system update Automatically ?
Not sure which options you've chosen for the Automatic Updates applet in
the Control Panel ... for now, please set it to " Notify me but don't
automatically download or install them ".
For this to work, you need to set the Automatic Updates service to at
least Manual [Automatic is preferred, but Manual will work] and
Background Intelligent Transfer Service [BITS] to at least Manual.

With all programs and IE closed, go to Start > Run > type in

wuauclt /detectnow

Click OK or press Enter

If any downloads are available the yellow icon should pop up in the
Notification area . If the latest definition for Windows Defender hasn't
been installed yet, that should be there now.

Install any that you wish to install, if offered.
Then copy and paste the last 40 - 50 lines in the WU.log into your
reply, please.

abosman

unread,
Dec 29, 2007, 2:15:00 PM12/29/07
to
Hi

this helped for me, i had the same problem + defender did not want to update
too.

log file of what was done by fixwareout:
Username "Alain" - 29/12/2007 19:58:19 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdagz.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"nameserver"="85.255.114.108 85.255.112.64" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{14DA0548-F08A-4628-BCF8-87BE1E990921}
"nameserver"="85.255.114.108,85.255.112.64" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{39DE6436-3235-4923-9885-265EDD7F1BAF}
"nameserver"="85.255.114.108,85.255.112.64" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{E4193466-3A4D-4AC3-BEE0-1F28417E99CE}
"nameserver"="85.255.114.108,85.255.112.64" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F2B93A91-75AA-4ACA-9AAB-4FB24C970B59}
"nameserver"="85.255.114.108,85.255.112.64" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{14DA0548-F08A-4628-BCF8-87BE1E990921}
"DhcpNameServer"="85.255.114.108,85.255.112.64" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{39DE6436-3235-4923-9885-265EDD7F1BAF}
"DhcpNameServer"="85.255.114.108,85.255.112.64" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{654B47DA-CBDC-4315-AA62-60AC5C2A575E}
"DhcpNameServer"="85.255.114.108,85.255.112.64" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F2B93A91-75AA-4ACA-9AAB-4FB24C970B59}
"DhcpNameServer"="85.255.114.108,85.255.112.64" <Value cleared.

Successfully flushed the DNS Resolver Cache.

hope this will not cause something else, but after searching for 4 days...
finally something that helps

Greetings and happy nw year

MowGreen [MVP]

unread,
Dec 29, 2007, 2:34:25 PM12/29/07
to
The system was infected with the malware WareOut :

HKLM\SOFTWARE\~\Winlogon\ "System"="kdagz.exe"

The malware made those entries in the registry that installed DNS
redirectors, essentially proxy redirectors, and the entire DNS process
was compromised.

* Fixwareout.exe will not harm a system that is not infected with Wareout *

It removes the rootkit in Winlogon, removes the TCP/IP registry
parameters that redirect DNS to it's own servers, and flushes the DNS cache.

http://research.sunbelt-software.com/threatdisplay.aspx?name=WareOut&threatid=40280

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============

Minus273

unread,
Dec 30, 2007, 6:23:00 AM12/30/07
to
Hi - below failed. The yellow icon appeared and then dissapeared. It
remained at 0%. Below are the lines from the WU log you requested

2007-12-30 11:12:53:731 1604 e50 Misc = Process:
C:\WINDOWS\system32\wuauclt.exe
2007-12-30 11:12:53:731 1604 e50 Misc = Module:
C:\WINDOWS\system32\wucltui.dll
2007-12-30 11:12:53:731 1604 e50 CltUI AU client got new directive =
'Download Progress', serviceId = {7971F918-A847-4430-9279-4A52D1EFE18D},
return = 0x00000000
2007-12-30 11:12:53:731 1604 e50 CltUI AU client creating UI plugin,
clsid={3809920F-B9D4-42DA-92E0-E26265E0FB89}
2007-12-30 11:12:59:262 848 bcc Misc WARNING: Send failed with hr = 80072ee7.
2007-12-30 11:12:59:262 848 bcc Misc WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30 11:12:59:262 848 bcc Misc WARNING: WinHttp:
SendRequestUsingProxy failed for
<http://download.windowsupdate.com/v7/windowsupdate/redir/wuredir.cab>. error
0x8024402c
2007-12-30 11:12:59:262 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30 11:12:59:262 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30 11:12:59:262 848 bcc Misc WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30 11:13:12:731 848 ff8 DnldMgr Error 0x8024402c occurred while
downloading update; notifying dependent calls.
2007-12-30 11:13:12:731 848 bd0 AU AU checked download status and it
changed: Downloading is paused
2007-12-30 11:13:12:731 1604 e50 CltUI AU client got new directive =
'Shutdown', serviceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, return =
0x00000000
2007-12-30 11:13:12:746 848 68c AU AU received handle event
2007-12-30 11:13:14:262 848 bcc Misc WARNING: Send failed with hr = 80072ee7.
2007-12-30 11:13:14:262 848 bcc Misc WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30 11:13:14:262 848 bcc Misc WARNING: WinHttp:
SendRequestUsingProxy failed for
<http://download.windowsupdate.com/v7/windowsupdate/redir/wuredir.cab>. error
0x8024402c
2007-12-30 11:13:14:262 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30 11:13:14:262 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30 11:13:14:262 848 bcc Misc WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30 11:13:29:278 848 bcc Misc WARNING: Send failed with hr = 80072ee7.
2007-12-30 11:13:29:278 848 bcc Misc WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30 11:13:29:278 848 bcc Misc WARNING: WinHttp:
SendRequestUsingProxy failed for
<http://download.windowsupdate.com/v7/windowsupdate/redir/wuredir.cab>. error
0x8024402c
2007-12-30 11:13:29:278 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30 11:13:29:278 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30 11:13:29:278 848 bcc Misc WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30 11:13:29:278 848 bcc Misc WARNING: DownloadFileInternal failed
for http://download.windowsupdate.com/v7/windowsupdate/redir/wuredir.cab:
error 0x8024402c
2007-12-30 11:13:29:278 848 bcc Misc Validating signature for

C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:

2007-12-30 11:13:29:278 848 bcc Misc Microsoft signed: Yes
2007-12-30 11:13:29:949 848 bcc Misc Validating signature for

C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:

2007-12-30 11:13:29:949 848 bcc Misc Microsoft signed: Yes
2007-12-30 11:13:29:949 848 bcc Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
2007-12-30 11:13:29:965 848 bcc Misc Microsoft signed: Yes
2007-12-30 11:13:30:356 848 bcc Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
2007-12-30 11:13:30:371 848 bcc Misc Microsoft signed: Yes
2007-12-30 11:13:45:371 848 bcc Misc WARNING: Send failed with hr = 80072ee7.
2007-12-30 11:13:45:371 848 bcc Misc WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30 11:13:45:371 848 bcc Misc WARNING: WinHttp:
SendRequestUsingProxy failed for
<http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab>. error 0x8024402c
2007-12-30 11:13:45:371 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30 11:13:45:371 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30 11:13:45:371 848 bcc Misc WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30 11:14:00:371 848 bcc Misc WARNING: Send failed with hr = 80072ee7.
2007-12-30 11:14:00:371 848 bcc Misc WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30 11:14:00:371 848 bcc Misc WARNING: WinHttp:
SendRequestUsingProxy failed for
<http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab>. error 0x8024402c
2007-12-30 11:14:00:371 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30 11:14:00:371 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30 11:14:00:371 848 bcc Misc WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30 11:14:15:371 848 bcc Misc WARNING: Send failed with hr = 80072ee7.
2007-12-30 11:14:15:371 848 bcc Misc WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30 11:14:15:371 848 bcc Misc WARNING: WinHttp:
SendRequestUsingProxy failed for
<http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab>. error 0x8024402c
2007-12-30 11:14:15:371 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30 11:14:15:371 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30 11:14:15:371 848 bcc Misc WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30 11:14:30:371 848 bcc Misc WARNING: Send failed with hr = 80072ee7.
2007-12-30 11:14:30:371 848 bcc Misc WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30 11:14:30:371 848 bcc Misc WARNING: WinHttp:
SendRequestUsingProxy failed for
<http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab>. error 0x8024402c
2007-12-30 11:14:30:371 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30 11:14:30:371 848 bcc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30 11:14:30:371 848 bcc Misc WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30 11:14:30:371 848 bcc Misc WARNING: DownloadFileInternal failed
for
http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab: error 0x8024402c
2007-12-30 11:14:30:371 848 bcc Setup FATAL: IsUpdateRequired failed with
error 0x8024402c
2007-12-30 11:14:30:371 848 bcc Setup WARNING: SelfUpdate: Default Service:
IsUpdateRequired failed: 0x8024402c
2007-12-30 11:14:30:371 848 bcc Setup WARNING: SelfUpdate: Default Service:
IsUpdateRequired failed, error = 0x8024402C
2007-12-30 11:14:30:371 848 bcc Agent * WARNING: Skipping scan,
self-update check returned 0x8024402C
2007-12-30 11:14:30:387 848 bcc Agent * WARNING: Exit code = 0x8024402C
2007-12-30 11:14:30:387 848 bcc Agent *********
2007-12-30 11:14:30:387 848 bcc Agent ** END ** Agent: Finding updates
[CallerId = AutomaticUpdates]
2007-12-30 11:14:30:387 848 bcc Agent *************
2007-12-30 11:14:30:387 848 bcc Agent WARNING: WU client failed Searching
for update with error 0x8024402c
2007-12-30 11:14:30:606 848 bd0 AU AU checked download status and it
changed: Downloading is not paused
2007-12-30 11:14:30:606 848 bd0 AU AU setting pending client directive to
'Download Progress'
2007-12-30 11:14:30:606 848 bd0 AU >>## RESUMED ## AU: Search for updates
[CallId = {212E51E1-D6C1-46DD-9709-10C01DF57723}]
2007-12-30 11:14:30:606 848 bd0 AU # WARNING: Search callback failed,
result = 0x8024402C
2007-12-30 11:14:30:606 848 bd0 AU # WARNING: Failed to find updates with
error code 8024402C
2007-12-30 11:14:30:606 848 bd0 AU #########
2007-12-30 11:14:30:606 848 bd0 AU ## END ## AU: Search for updates
[CallId = {212E51E1-D6C1-46DD-9709-10C01DF57723}]
2007-12-30 11:14:30:606 848 bd0 AU #############
2007-12-30 11:14:30:606 848 bd0 AU AU setting next detection timeout to
2007-12-30 16:14:30
2007-12-30 11:14:45:621 848 68c AU Launched new AU client for directive
'Download Progress', session id = 0x0
2007-12-30 11:14:45:668 2144 850 Misc =========== Logging initialized

(build: 7.0.6000.381, tz: -0000) ===========

2007-12-30 11:14:45:668 2144 850 Misc = Process:
C:\WINDOWS\system32\wuauclt.exe
2007-12-30 11:14:45:668 2144 850 AUClnt Launched Client UI process
2007-12-30 11:14:45:715 2144 850 Misc =========== Logging initialized

(build: 7.0.6000.381, tz: -0000) ===========

2007-12-30 11:14:45:715 2144 850 Misc = Process:
C:\WINDOWS\system32\wuauclt.exe
2007-12-30 11:14:45:715 2144 850 Misc = Module:
C:\WINDOWS\system32\wucltui.dll
2007-12-30 11:14:45:715 2144 850 CltUI AU client got new directive =
'Download Progress', serviceId = {7971F918-A847-4430-9279-4A52D1EFE18D},
return = 0x00000000
2007-12-30 11:14:45:731 2144 850 CltUI AU client creating UI plugin,
clsid={3809920F-B9D4-42DA-92E0-E26265E0FB89}
2007-12-30 11:15:09:403 848 ab0 DnldMgr Error 0x8024402c occurred while
downloading update; notifying dependent calls.
2007-12-30 11:15:09:403 848 bd0 AU AU checked download status and it
changed: Downloading is paused
2007-12-30 11:15:09:403 2144 850 CltUI AU client got new directive =
'Shutdown', serviceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, return =
0x00000000
2007-12-30 11:15:09:434 848 68c AU AU received handle event

TaurArian

unread,
Dec 30, 2007, 6:48:03 AM12/30/07
to
Whilst you're awaiting Mow, Have you checked these articles Minus273?

When searching for available updates on the Update site, you receive the 0x8024402C error
http://update.microsoft.com/windowsupdate/v6/showarticle.aspx?articleid=30&ln=en
A misconfigured Proxy/Firewall can cause this problem. Double-check the Proxy/Firewall
settings

You may receive an error message when you search for available updates on the Windows
Update Web site or on the Microsoft Update Web site

http://support.microsoft.com/kb/883821


--
====================================
TaurArian [MVP] 2005-2008 - Australia
====================================
How to ask a question: http://support.microsoft.com/kb/555375
http://taurarian.mvps.org/index.htm
Emails will not be acknowledged - please post to the newsgroup so all may benefit.


"Minus273" <Minu...@discussions.microsoft.com> wrote in message

news:49C3C01D-43B8-4253...@microsoft.com...

MowGreen [MVP]

unread,
Dec 31, 2007, 5:05:13 PM12/31/07
to
I'm not convinced that your system is free of malware.
WareOut can set false proxy servers in the registry to prevent the
system from obtaining updates.
Please open the registry editor Start > Run > type in

regedit


Click OK or press Enter

Navigate to this key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Click *on* Parameters
In the right frame under Name, is NameServer
What is it's ValueData ?

Minus273

unread,
Jan 3, 2008, 6:36:01 AM1/3/08
to
Sorry for delay - flu!

Data against NameServer is 208.67.220.220 208.67.222.222

Thanks!

MowGreen [MVP]

unread,
Jan 3, 2008, 3:25:28 PM1/3/08
to
I've been under the weather, too. No apologies necessary ... bourbon is
though. <w>
Here's some info on 208.67.220.220 - 208.67.222.222
http://www.dnsstuff.com/tools/whois.ch?ip=208.67.220.220

http://freedomfinancialnetwork.com/

Suggest you delete the ValueData for
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\
NameServer
Right click NameServer, choose Modify
Remove both URLs for Value data
Click OK
Close the registry editor and restart the system
Now try to access WU/MU

stusmudger

unread,
Jan 3, 2008, 6:16:02 PM1/3/08
to
All,

I've been following this thread (and understanding very little of it) as
I've recently had the 0x80072EE7 error. I bought my wife aPalm HandHeld for
Christmas but was unable to sunchronise it with Window XP as the drivers
weren't installed. Palm technical support directed me to Microsoft updates
which is when I received the error message.

I've followed the error resolution solution advised by Microsoft i.e. HOST
file and the inclusion of '#' but this didn't work. I then went to Microsoft
on-line technical support who - helpfully! - referred me to their on-line
support (round in circles) I've sent them a response but have yet to receive
a reply.

Can you provide a solution? Please be aware that I'm a luddite when it comes
to computers so any advice will need to be idiot proof and free from any
techno jargon.

Fingers crossed and regards,

stusmudger

dennis...@yahoo.com

unread,
Jan 5, 2008, 1:47:53 AM1/5/08
to
On Dec 31 2007, 5:05 pm, "MowGreen [MVP]" <mowgr...@nowandzen.com>
wrote:
> > downloadingupdate; notifying dependent calls.
> > C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C7­7\wuredir.cab:

> > 2007-12-30 11:13:29:278     848    bcc     Misc     Microsoft signed: Yes
> > 2007-12-30 11:13:29:949     848    bcc     Misc    Validating signature for
> > C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C7­7\wuredir.cab:

> > 2007-12-30 11:13:29:949     848    bcc     Misc     Microsoft signed: Yes
> > 2007-12-30 11:13:29:949     848    bcc     Misc    Validating signature for
> > C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
> > 2007-12-30 11:13:29:965     848    bcc     Misc     Microsoft signed: Yes
> > 2007-12-30 11:13:30:356     848    bcc     Misc    Validating signature for
> > C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
> > 2007-12-30 11:13:30:371     848    bcc     Misc     Microsoft signed: Yes
> > 2007-12-30 11:13:45:371     848    bcc     Misc    WARNING: Send failed with hr = 80072ee7.
> > 2007-12-30 11:13:45:371     848    bcc     Misc    WARNING: SendRequest failed with hr =
> > 80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
> > used : <>
> > 2007-12-30 11:13:45:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestUsingProxy failed for
> > <http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3...>.error0x8024402c

> > 2007-12-30 11:13:45:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestToServerForFileInformation MakeRequest failed.error0x8024402c
> > 2007-12-30 11:13:45:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestToServerForFileInformation failed with 0x8024402c
> > 2007-12-30 11:13:45:371     848    bcc     Misc    WARNING: WinHttp:
> > ShouldFileBeDownloaded failed with 0x8024402c
> > 2007-12-30 11:14:00:371     848    bcc     Misc    WARNING: Send failed with hr = 80072ee7.
> > 2007-12-30 11:14:00:371     848    bcc     Misc    WARNING: SendRequest failed with hr =
> > 80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
> > used : <>
> > 2007-12-30 11:14:00:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestUsingProxy failed for
> > <http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3...>.error0x8024402c

> > 2007-12-30 11:14:00:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestToServerForFileInformation MakeRequest failed.error0x8024402c
> > 2007-12-30 11:14:00:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestToServerForFileInformation failed with 0x8024402c
> > 2007-12-30 11:14:00:371     848    bcc     Misc    WARNING: WinHttp:
> > ShouldFileBeDownloaded failed with 0x8024402c
> > 2007-12-30 11:14:15:371     848    bcc     Misc    WARNING: Send failed with hr = 80072ee7.
> > 2007-12-30 11:14:15:371     848    bcc     Misc    WARNING: SendRequest failed with hr =
> > 80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
> > used : <>
> > 2007-12-30 11:14:15:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestUsingProxy failed for
> > <http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3...>.error0x8024402c

> > 2007-12-30 11:14:15:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestToServerForFileInformation MakeRequest failed.error0x8024402c
> > 2007-12-30 11:14:15:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestToServerForFileInformation failed with 0x8024402c
> > 2007-12-30 11:14:15:371     848    bcc     Misc    WARNING: WinHttp:
> > ShouldFileBeDownloaded failed with 0x8024402c
> > 2007-12-30 11:14:30:371     848    bcc     Misc    WARNING: Send failed with hr = 80072ee7.
> > 2007-12-30 11:14:30:371     848    bcc     Misc    WARNING: SendRequest failed with hr =
> > 80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
> > used : <>
> > 2007-12-30 11:14:30:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestUsingProxy failed for
> > <http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3...>.error0x8024402c

> > 2007-12-30 11:14:30:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestToServerForFileInformation MakeRequest failed.error0x8024402c
> > 2007-12-30 11:14:30:371     848    bcc     Misc    WARNING: WinHttp:
> > SendRequestToServerForFileInformation failed with 0x8024402c
> > 2007-12-30 11:14:30:371     848    bcc     Misc    WARNING: WinHttp:
> > ShouldFileBeDownloaded failed with 0x8024402c
> > 2007-12-30 11:14:30:371     848    bcc     Misc    WARNING: DownloadFileInternal failed
> > for
> >http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3...error0x8024402c

> > 2007-12-30 11:14:30:371     848    bcc     Setup   FATAL: IsUpdateRequired failed with
> >error0x8024402c
> > 2007-12-30 11:14:30:371     848    bcc     Setup   WARNING: SelfUpdate: Default Service:
> > IsUpdateRequired failed: 0x8024402c
> > 2007-12-30 11:14:30:371     848    bcc     Setup   WARNING: SelfUpdate: Default Service:
> > IsUpdateRequired failed,error= 0x8024402C

> > 2007-12-30 11:14:30:371     848    bcc     Agent     * WARNING: Skipping scan,
> > self-updatecheck returned 0x8024402C

> > 2007-12-30 11:14:30:387     848    bcc     Agent     * WARNING: Exit code = 0x8024402C
> > 2007-12-30 11:14:30:387     848    bcc     Agent   *********
> > 2007-12-30 11:14:30:387     848    bcc     Agent   **  END  **  Agent: Finding updates
> > [CallerId = AutomaticUpdates]
> > 2007-12-30 11:14:30:387     848    bcc     Agent   *************
> > 2007-12-30 11:14:30:387     848    bcc     Agent   WARNING: WU client failed Searching
> > forupdatewitherror0x8024402c
> > 2007-12-30 11:14:30:606     848    bd0     AU      AU checked download status and it
> > changed: Downloading is not paused
> > 2007-12-30 11:14:30:606     848    bd0     AU      AU setting pending client directive to
> > 'Download Progress'
> > 2007-12-30 11:14:30:606     848    bd0     AU      >>##  RESUMED  ## AU: Search for updates
> > [CallId = {212E51E1-D6C1-46DD-9709-10C01DF57723}]
> > 2007-12-30 11:14:30:606     848    bd0     AU        # WARNING: Search callback failed,
> > result = 0x8024402C
> > 2007-12-30 11:14:30:606     848    bd0     AU        # WARNING: Failed to find updates with
> >errorcode 8024402C

> > 2007-12-30 11:14:30:606     848    bd0     AU      #########
>
> ...
>
> read more »- Hide quoted text -
>
> - Show quoted text -

Not sure if you guys figured this out but I ran across the solution.
It is scamware that changes the DNS server details from automatically
obtaining to using there own ip.

Solution: Get to your Local Area Connection and click properties.
Click TCP/IP then properties. Click "Obtain DNS Automatically".

Also if you go to your reg. you will find this ip 85.255.115.18. This
ip leads directly to the scammers and they also give details how to
remove the software.

Thanks to abosman for the clue in your post above.

PA Bear [MS MVP]

unread,
Jan 5, 2008, 1:51:58 AM1/5/08
to
dennis...@yahoo.com wrote:
> On Dec 31 2007, 5:05 pm, "MowGreen [MVP]" <mowgr...@nowandzen.com>
> wrote:
>> I'm not convinced that your system is free of malware.
>> WareOut can set false proxy servers in the registry to prevent the
>> system from obtaining updates.
>> Please open the registry editor Start > Run > type in
>>
>> regedit
>> Click OK or press Enter
>>
>> Navigate to this key:
>>
>> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
>> Click *on* Parameters
>> In the right frame under Name, is NameServer
>> What is it's ValueData ?
>>
>> Minus273 wrote:
>>> Hi - below failed. The yellow icon appeared and then dissapeared. It
>>> remained at 0%. Below are the lines from the WU log you requested
<snip>

>
> Not sure if you guys figured this out but I ran across the solution.
> It is scamware that changes the DNS server details from automatically
> obtaining to using there own ip.
>
> Solution: Get to your Local Area Connection and click properties.
> Click TCP/IP then properties. Click "Obtain DNS Automatically".
>
> Also if you go to your reg. you will find this ip 85.255.115.18. This
> ip leads directly to the scammers and they also give details how to
> remove the software.

That's a symptom of a WareOut infection. Run a /thorough/ check for
hijackware, including posting your hijackthis log to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Espen4

unread,
Jan 11, 2008, 5:48:53 PM1/11/08
to

Dear all,
I had problem updating windows XP (got error "0x80072EE7" every time I
tried to update). I tried to fix it using all I could
find on the internet. In the end I got help from a friend
who told me to check the DNS of my internet service provider
(it had probably been changed lately because it was different
from earlier). I found the DNS on the web-site of my internet service
provider.
I changed the DNS in XP the following way:

1. Click on the Start Menu.
2. Go to the Control Panel.
3. Double-click on Network and Internet Connections. (XP users in
Classic mode will not see this choice. Skip to #4.)
4. Double-click on Network Connections.
5. Double-click on Local Area Connection then click on the Properties
button.
6. Under This connection select Internet Protocol (TCP/IP) and click
the Properties button.
7. Change the DNS adress to the updated one you got from your internet
service provider.

Now windows update should work (it did for me !!!)

Espen


--
Espen4
------------------------------------------------------------------------
Espen4's Profile: http://forums.techarena.in/member.php?userid=39416
View this thread: http://forums.techarena.in/showthread.php?t=873684

http://forums.techarena.in

Minus273

unread,
Jan 15, 2008, 1:01:01 PM1/15/08
to
All - sorry for delays in answering, been in hospital. Below has fixed my
updates problem. As I have not removed anything from my PC do I need to do
anything else?

prolaanhk...@gmail.com

unread,
Apr 6, 2014, 10:20:35 AM4/6/14
to
Vào 02:57:02 UTC+7 Thứ ba, ngày 18 tháng mười hai năm 2007, Minus273 đã viết:
0 new messages