v5 Windows Updates Failed and 0x8007043C error in Safe Mode

Hi hlcsco,

I too installed a new windows XP just today and had 20 updates to install. I used v5 updater and all the updates installed fine.

So there is something in your machine that is not allowing all the updates.

Is this a new system or you are rebuilding an old system ?

If this is an old system then you probably have to check for virus and spywares in the system .
If it is new , less chance that they are there .

BTW, have you already installed Service Pack 2. I didnot have Sp2 on Windows update as it is coming to windows update only on Aug 25th. If that is the case, you may want to uninstall SP2 and install SP1 and all updates.

So my machine has got all updates without SP2. May be Sp2 is the error here.

If you want to try installing Sp2 and all updates then you need to work on the firewall settings and Anti-virus settings in it and see if that would help .

Post back
SR..

This is an older system, but relatively new. It is the department chair's machine at my college. The machine had the W32.HLLW.Gaobot.gen virus. I was able to quarantine the virus in safe mode by using Norton Antivirus.

Then, I ran ad-aware with the most recent update -- Then ran Spybot Search and Destroy -- then, ran windows update and just like you installed 20 or so updates (I believe it was 30+ for me), then restarted, and couldn't get the remaining to install. Even Media Player 9.0 gives me a failed error.

I then reinstalled XP PRO from CD. And everything repeats itself again, the 20+ updates o.k., then upon reboot 10 failing.

-Adam

hlcsco,

BTW, windows media player update has to be done seperately. Hope you are trying to do that way .

I went to security response and found none of the registry entries it referenced. However, I did find in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices two entries which may not mean anything at all:

"Microsoft Update" -- "wuammgr32.exe"
"win update" -- "wupdate.exe"

Seems a little redundant.... don't know if that is important, and which one I could remove?

Stinger did not find any viruses.

The updates are still failing, but I'll go through in safe and normal mode and scan for viruses, spyware, and spybots, once more.

Windows Media Player update I did try to run by itself.

-Adam

Rwmove both those exe files from registry.
Before doing that , make a backup of registry

Remove them and restart to see if that would help

"Microsoft Update" -- "wuammgr32.exe"
"win update" -- "wupdate.exe"

means there are some Junk files present on ur system and running,,,,,, can u Download HijackThis v1.98.2, run it, Save the LOG file and Post it here:
http://tools.radiosplace.com/HijackThis.exe

I removed both exe files from the registry, but still get the failing message.
I rebooted into safe mode and ran SpyBot, which found 9 items:
Double Click
Alexa Related
Avenue A, Inc.
DSO Exploit (5)
Hotbar

Removed those, then ran AdAware, and it found instances of Alexa in the registry. Removed that.
Restarted in normal mode, downloaded HijackThis and here is the log file:

Logfile of HijackThis v1.98.2
Scan saved at 11:22:09 AM, on 8/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Creative\SBAudigy\Taskbar\CTLTray.exe
C:\Program Files\Creative\SBAudigy\Taskbar\CTLTask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\BOB & JULIE\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dslstart.verizon.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\RunServices: [Net Framework] scvhost.exe
O4 - HKCU\..\Run: [TaskTray] C:\Program Files\Creative\SBAudigy\Taskbar\CTLTray.exe
O4 - HKCU\..\Run: [Taskbar] C:\Program Files\Creative\SBAudigy\Taskbar\CTLTask.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

Thanks-
Adam

O4 - HKLM\..\RunServices: [Net Framework] scvhost.exe
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)
===============================

the Net Framework(scvhost.exe) is a facked service and shud not be running,,,, Fix this entry !!!
scvhost.exe is related to W32/Agobot-S worm >> http://www.liutilities.com/products/wintaskspro/processlibrary/scvhost/

Check here for its description and removal >> http://www.sophos.com/virusinfo/analyses/w32agobots.html
So clean ur system, and after that check if u still get the Update problem or not ??

So, I checked the one you referenced to be fixed on hijack this, then following the information at sophos.com, I was unable to do anything, since there were no registry entries by that name.

I had quarantined the file when it was first found by Norton AntiViruses.

I restarted and ran spybot just for kicks, and it found this DSO Exploit still!

I ran Windows Update and still, the updates fail.

Upon restarting into Safe Mode, in the administrator account, I still receive the Error 0x8009043C when trying to run updates. Don't know if this is related.

btw just confirmaing,,,,

have u tried to delete ur Temporary Internet Files and Cookies of IE ??
Also empty the C:\documents and settings\username\Local settings\Temp and C:\Windows\Temp folders ??

means the Cache problem..... :-?

I did that when I first started, but it has been a while since I have.

So, I went in, deleted cookies, then the temporary files, and that gave me an hour glass for about 20 seconds. Restarted the browser, started it, then got the blue screen of death!

Restarted, started IE without problems, re-scanned with Windows Update, but still fails.

try deleting them in safemode manaully.....

Goto C:\Documents and Settings\ur usernmae\Local Settings\Temp and delete all files present here
Goto C:\Documents and Settings\ur usernmae\Local Settings\Temporary Internet Files, and delete the folder of ContentIE
Goto C:\Windows\Temp, and delete all files present here

reboot in Normal Mode to check ??

There were alot of files in the local settings\temp, but still the updates fail.

I appreciate all the help I've received on this issue. After many numerous attempts and failed installs of SP1 and even SP2. I determined that some device driver was not happy with the OS. (Or rather, the OS wasn't happy with it). I've since junked the computer and have given up troubleshooting this issue.