hlcsco
asked on
v5 Windows Updates Failed and 0x8007043C error in Safe Mode
I recently reinstalled Windows XP, downloaded 28 critical updates through Windows Update using the new v5 updater.
After reboot, still 4 more critical updates and 5 recommended remain. However, each one fails. I get the message "update failed." Upon restarting the machine into Safe Mode with networking the following error message 0x8007043C is given. There is no information about this anywhere.
I believe this is a new issue with the new windows updater, version 5.
After reboot, still 4 more critical updates and 5 recommended remain. However, each one fails. I get the message "update failed." Upon restarting the machine into Safe Mode with networking the following error message 0x8007043C is given. There is no information about this anywhere.
I believe this is a new issue with the new windows updater, version 5.
Hi hlcsco,
I too installed a new windows XP just today and had 20 updates to install. I used v5 updater and all the updates installed fine.
So there is something in your machine that is not allowing all the updates.
Is this a new system or you are rebuilding an old system ?
If this is an old system then you probably have to check for virus and spywares in the system .
If it is new , less chance that they are there .
BTW, have you already installed Service Pack 2. I didnot have Sp2 on Windows update as it is coming to windows update only on Aug 25th. If that is the case, you may want to uninstall SP2 and install SP1 and all updates.
So my machine has got all updates without SP2. May be Sp2 is the error here.
If you want to try installing Sp2 and all updates then you need to work on the firewall settings and Anti-virus settings in it and see if that would help .
Post back
SR..
I too installed a new windows XP just today and had 20 updates to install. I used v5 updater and all the updates installed fine.
So there is something in your machine that is not allowing all the updates.
Is this a new system or you are rebuilding an old system ?
If this is an old system then you probably have to check for virus and spywares in the system .
If it is new , less chance that they are there .
BTW, have you already installed Service Pack 2. I didnot have Sp2 on Windows update as it is coming to windows update only on Aug 25th. If that is the case, you may want to uninstall SP2 and install SP1 and all updates.
So my machine has got all updates without SP2. May be Sp2 is the error here.
If you want to try installing Sp2 and all updates then you need to work on the firewall settings and Anti-virus settings in it and see if that would help .
Post back
SR..
ASKER
This is an older system, but relatively new. It is the department chair's machine at my college. The machine had the W32.HLLW.Gaobot.gen virus. I was able to quarantine the virus in safe mode by using Norton Antivirus.
Then, I ran ad-aware with the most recent update -- Then ran Spybot Search and Destroy -- then, ran windows update and just like you installed 20 or so updates (I believe it was 30+ for me), then restarted, and couldn't get the remaining to install. Even Media Player 9.0 gives me a failed error.
I then reinstalled XP PRO from CD. And everything repeats itself again, the 20+ updates o.k., then upon reboot 10 failing.
-Adam
Then, I ran ad-aware with the most recent update -- Then ran Spybot Search and Destroy -- then, ran windows update and just like you installed 20 or so updates (I believe it was 30+ for me), then restarted, and couldn't get the remaining to install. Even Media Player 9.0 gives me a failed error.
I then reinstalled XP PRO from CD. And everything repeats itself again, the 20+ updates o.k., then upon reboot 10 failing.
-Adam
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
hlcsco,
BTW, windows media player update has to be done seperately. Hope you are trying to do that way .
BTW, windows media player update has to be done seperately. Hope you are trying to do that way .
ASKER
I went to security response and found none of the registry entries it referenced. However, I did find in HKEY_LOCAL_MACHINE\Softwar e\Microsof t\Windows\ CurrentVer sion\RunSe rvices two entries which may not mean anything at all:
"Microsoft Update" -- "wuammgr32.exe"
"win update" -- "wupdate.exe"
Seems a little redundant.... don't know if that is important, and which one I could remove?
Stinger did not find any viruses.
The updates are still failing, but I'll go through in safe and normal mode and scan for viruses, spyware, and spybots, once more.
Windows Media Player update I did try to run by itself.
-Adam
"Microsoft Update" -- "wuammgr32.exe"
"win update" -- "wupdate.exe"
Seems a little redundant.... don't know if that is important, and which one I could remove?
Stinger did not find any viruses.
The updates are still failing, but I'll go through in safe and normal mode and scan for viruses, spyware, and spybots, once more.
Windows Media Player update I did try to run by itself.
-Adam
Rwmove both those exe files from registry.
Before doing that , make a backup of registry
Remove them and restart to see if that would help
Before doing that , make a backup of registry
Remove them and restart to see if that would help
"Microsoft Update" -- "wuammgr32.exe"
"win update" -- "wupdate.exe"
means there are some Junk files present on ur system and running,,,,,, can u Download HijackThis v1.98.2, run it, Save the LOG file and Post it here:
http://tools.radiosplace.com/HijackThis.exe
"win update" -- "wupdate.exe"
means there are some Junk files present on ur system and running,,,,,, can u Download HijackThis v1.98.2, run it, Save the LOG file and Post it here:
http://tools.radiosplace.com/HijackThis.exe
ASKER
I removed both exe files from the registry, but still get the failing message.
I rebooted into safe mode and ran SpyBot, which found 9 items:
Double Click
Alexa Related
Avenue A, Inc.
DSO Exploit (5)
Hotbar
Removed those, then ran AdAware, and it found instances of Alexa in the registry. Removed that.
Restarted in normal mode, downloaded HijackThis and here is the log file:
Logfile of HijackThis v1.98.2
Scan saved at 11:22:09 AM, on 8/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e xe
C:\WINDOWS\system32\winlog on.exe
C:\WINDOWS\system32\servic es.exe
C:\WINDOWS\system32\lsass. exe
C:\WINDOWS\system32\svchos t.exe
C:\WINDOWS\System32\svchos t.exe
C:\WINDOWS\system32\spools v.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcC DA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\wuaucl t.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\ShareDLL\Ct Notify.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Creative\SBAudigy\Ta skbar\CTLT ray.exe
C:\Program Files\Creative\SBAudigy\Ta skbar\CTLT ask.exe
C:\WINDOWS\System32\ctfmon .exe
C:\Program Files\Creative\ShareDLL\Me diaDet.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\BOB & JULIE\Desktop\HijackThis.e xe
R0 - HKCU\Software\Microsoft\In ternet Explorer\Main,Start Page = http://dslstart.verizon.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-7 84B7D6BE0B 3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEH elper.dll
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-F D60B590A87 D} - C:\PROGRA~1\COMMON~1\Real\ Toolbar\re albar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C F10577473F 7} - c:\program files\google\googletoolbar 2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-F ADC6B08487 2} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-F D60B590A87 D} - C:\PROGRA~1\COMMON~1\Real\ Toolbar\re albar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7 859DF00B1D 6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0 09027A5CD4 F} - c:\program files\google\googletoolbar 2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0 0A0C908246 7} - C:\WINDOWS\System32\msdxm. ocx
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\Ct Notify.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\RunServices: [Net Framework] scvhost.exe
O4 - HKCU\..\Run: [TaskTray] C:\Program Files\Creative\SBAudigy\Ta skbar\CTLT ray.exe
O4 - HKCU\..\Run: [Taskbar] C:\Program Files\Creative\SBAudigy\Ta skbar\CTLT ask.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon .exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad obe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar 2.dll/cmse arch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar 2.dll/cmba cklinks.ht ml
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar 2.dll/cmca che.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2 \OFFICE11\ EXCEL.EXE/ 3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar 2.dll/cmsi milar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar 2.dll/cmtr ans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3 C9C571A826 3} - C:\PROGRA~1\MICROS~2\OFFIC E11\REFIEB AR.DLL
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-9 83435B9899 E} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0 0C04F79568 3} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-0 0C04F79568 3} - C:\Program Files\Messenger\MSMSGS.EXE
Thanks-
Adam
I rebooted into safe mode and ran SpyBot, which found 9 items:
Double Click
Alexa Related
Avenue A, Inc.
DSO Exploit (5)
Hotbar
Removed those, then ran AdAware, and it found instances of Alexa in the registry. Removed that.
Restarted in normal mode, downloaded HijackThis and here is the log file:
Logfile of HijackThis v1.98.2
Scan saved at 11:22:09 AM, on 8/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcC
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\wuaucl
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\ShareDLL\Ct
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Creative\SBAudigy\Ta
C:\Program Files\Creative\SBAudigy\Ta
C:\WINDOWS\System32\ctfmon
C:\Program Files\Creative\ShareDLL\Me
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\BOB & JULIE\Desktop\HijackThis.e
R0 - HKCU\Software\Microsoft\In
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-F
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-F
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-F
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\Ct
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\RunServices: [Net Framework] scvhost.exe
O4 - HKCU\..\Run: [TaskTray] C:\Program Files\Creative\SBAudigy\Ta
O4 - HKCU\..\Run: [Taskbar] C:\Program Files\Creative\SBAudigy\Ta
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-9
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-0
Thanks-
Adam
O4 - HKLM\..\RunServices: [Net Framework] scvhost.exe
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-9 83435B9899 E} - (no file)
========================== =====
the Net Framework(scvhost.exe) is a facked service and shud not be running,,,, Fix this entry !!!
scvhost.exe is related to W32/Agobot-S worm >> http://www.liutilities.com/products/wintaskspro/processlibrary/scvhost/
Check here for its description and removal >> http://www.sophos.com/virusinfo/analyses/w32agobots.html
So clean ur system, and after that check if u still get the Update problem or not ??
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-9
==========================
the Net Framework(scvhost.exe) is a facked service and shud not be running,,,, Fix this entry !!!
scvhost.exe is related to W32/Agobot-S worm >> http://www.liutilities.com/products/wintaskspro/processlibrary/scvhost/
Check here for its description and removal >> http://www.sophos.com/virusinfo/analyses/w32agobots.html
So clean ur system, and after that check if u still get the Update problem or not ??
ASKER
So, I checked the one you referenced to be fixed on hijack this, then following the information at sophos.com, I was unable to do anything, since there were no registry entries by that name.
I had quarantined the file when it was first found by Norton AntiViruses.
I restarted and ran spybot just for kicks, and it found this DSO Exploit still!
I ran Windows Update and still, the updates fail.
Upon restarting into Safe Mode, in the administrator account, I still receive the Error 0x8009043C when trying to run updates. Don't know if this is related.
I had quarantined the file when it was first found by Norton AntiViruses.
I restarted and ran spybot just for kicks, and it found this DSO Exploit still!
I ran Windows Update and still, the updates fail.
Upon restarting into Safe Mode, in the administrator account, I still receive the Error 0x8009043C when trying to run updates. Don't know if this is related.
btw just confirmaing,,,,
have u tried to delete ur Temporary Internet Files and Cookies of IE ??
Also empty the C:\documents and settings\username\Local settings\Temp and C:\Windows\Temp folders ??
means the Cache problem..... :-?
have u tried to delete ur Temporary Internet Files and Cookies of IE ??
Also empty the C:\documents and settings\username\Local settings\Temp and C:\Windows\Temp folders ??
means the Cache problem..... :-?
ASKER
I did that when I first started, but it has been a while since I have.
So, I went in, deleted cookies, then the temporary files, and that gave me an hour glass for about 20 seconds. Restarted the browser, started it, then got the blue screen of death!
Restarted, started IE without problems, re-scanned with Windows Update, but still fails.
So, I went in, deleted cookies, then the temporary files, and that gave me an hour glass for about 20 seconds. Restarted the browser, started it, then got the blue screen of death!
Restarted, started IE without problems, re-scanned with Windows Update, but still fails.
try deleting them in safemode manaully.....
Goto C:\Documents and Settings\ur usernmae\Local Settings\Temp and delete all files present here
Goto C:\Documents and Settings\ur usernmae\Local Settings\Temporary Internet Files, and delete the folder of ContentIE
Goto C:\Windows\Temp, and delete all files present here
reboot in Normal Mode to check ??
Goto C:\Documents and Settings\ur usernmae\Local Settings\Temp and delete all files present here
Goto C:\Documents and Settings\ur usernmae\Local Settings\Temporary Internet Files, and delete the folder of ContentIE
Goto C:\Windows\Temp, and delete all files present here
reboot in Normal Mode to check ??
ASKER
There were alot of files in the local settings\temp, but still the updates fail.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I appreciate all the help I've received on this issue. After many numerous attempts and failed installs of SP1 and even SP2. I determined that some device driver was not happy with the OS. (Or rather, the OS wasn't happy with it). I've since junked the computer and have given up troubleshooting this issue.
Then why did you award points to answers that didn't resolve the problem?
That is mis-leading and makes experts-exchange a less valuable resource for the community. Don't worry about hurting the expert's feelings.
THIS WHOLE STRING SHOULD BE DELETED
That is mis-leading and makes experts-exchange a less valuable resource for the community. Don't worry about hurting the expert's feelings.
THIS WHOLE STRING SHOULD BE DELETED
>> Upon restarting the machine into Safe Mode with networking the following error message 0x8007043C is given. There is no information about this anywhere.
I found something here abt this error >> http://www.eventid.net/display.asp?eventid=8193&eventno=1994&source=VSS&phase=1