Solved

v5 Windows Updates Failed and 0x8007043C error in Safe Mode

Posted on 2004-08-23
18
49,270 Views
Last Modified: 2012-06-21
I recently reinstalled Windows XP, downloaded 28 critical updates through Windows Update using the new v5 updater.
After reboot, still 4 more critical updates and 5 recommended remain. However, each one fails. I get the message "update failed." Upon restarting the machine into Safe Mode with networking the following error message 0x8007043C is given. There is no information about this anywhere.

I believe this is a new issue with the new windows updater, version 5.
0
Comment
Question by:hlcsco
  • 7
  • 6
  • 4
  • +1
18 Comments
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
Hello hlcsco =)

>> Upon restarting the machine into Safe Mode with networking the following error message 0x8007043C is given. There is no information about this anywhere.

I found something here abt this error >> http://www.eventid.net/display.asp?eventid=8193&eventno=1994&source=VSS&phase=1
0
 
LVL 49

Expert Comment

by:sunray_2003
Comment Utility
Hi hlcsco,

I too installed a new windows XP just today and had 20 updates to install. I used v5 updater and all the updates installed fine.

So there is something in your machine that is not allowing all the updates.

Is this a new system or you are rebuilding an old system ?

If this is an old system then you probably have to check for virus and spywares in the system .
If it is new , less chance that they are there .

BTW, have you already installed Service Pack 2. I didnot have Sp2 on Windows update as it is coming to windows update only on Aug 25th. If that is the case, you may want to uninstall SP2 and install SP1 and all updates.

So my machine has got all updates without SP2. May be Sp2 is the error here.

If you want to try installing Sp2 and all updates then you need to work on the firewall settings and Anti-virus settings in it and see if that would help .

Post back
SR..
0
 

Author Comment

by:hlcsco
Comment Utility
This is an older system, but relatively new. It is the department chair's machine at my college. The machine had the W32.HLLW.Gaobot.gen virus. I was able to quarantine the virus in safe mode by using Norton Antivirus.

Then, I ran ad-aware with the most recent update -- Then ran Spybot Search and Destroy -- then, ran windows update and just like you installed 20 or so updates (I believe it was 30+ for me), then restarted, and couldn't get the remaining to install. Even Media Player 9.0 gives me a failed error.

I then reinstalled XP PRO from CD. And everything repeats itself again, the 20+ updates o.k., then upon reboot 10 failing.

-Adam
0
 
LVL 49

Assisted Solution

by:sunray_2003
sunray_2003 earned 250 total points
Comment Utility
I probably think Virus could be the issue here

Check this http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.ao.html and make sure you have removed all the registry entries it had created

Run http://vil.nai.com/vil/stinger/ and make sure there are no more viruses.

Run them in normal mode and also in safe mode to be absolutely sure

Restart and check windows update now

SR
0
 
LVL 49

Expert Comment

by:sunray_2003
Comment Utility
hlcsco,

BTW, windows media player update has to be done seperately. Hope you are trying to do that way .

0
 

Author Comment

by:hlcsco
Comment Utility
I went to security response and found none of the registry entries it referenced. However, I did find in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices two entries which may not mean anything at all:

"Microsoft Update" -- "wuammgr32.exe"
"win update" -- "wupdate.exe"

Seems a little redundant.... don't know if that is important, and which one I could remove?

Stinger did not find any viruses.

The updates are still failing, but I'll go through in safe and normal mode and scan for viruses, spyware, and spybots, once more.

Windows Media Player update I did try to run by itself.

-Adam
0
 
LVL 49

Expert Comment

by:sunray_2003
Comment Utility
Rwmove both those exe files from registry.
Before doing that , make a backup of registry

Remove them and restart to see if that would help
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
"Microsoft Update" -- "wuammgr32.exe"
"win update" -- "wupdate.exe"

means there are some Junk files present on ur system and running,,,,,, can u Download HijackThis v1.98.2, run it, Save the LOG file and Post it here:
http://tools.radiosplace.com/HijackThis.exe
0
 

Author Comment

by:hlcsco
Comment Utility
I removed both exe files from the registry, but still get the failing message.
I rebooted into safe mode and ran SpyBot, which found 9 items:
Double Click
Alexa Related
Avenue A, Inc.
DSO Exploit (5)
Hotbar

Removed those, then ran AdAware, and it found instances of Alexa in the registry. Removed that.
Restarted in normal mode, downloaded HijackThis and here is the log file:

Logfile of HijackThis v1.98.2
Scan saved at 11:22:09 AM, on 8/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Creative\SBAudigy\Taskbar\CTLTray.exe
C:\Program Files\Creative\SBAudigy\Taskbar\CTLTask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\BOB & JULIE\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dslstart.verizon.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\RunServices: [Net Framework] scvhost.exe
O4 - HKCU\..\Run: [TaskTray] C:\Program Files\Creative\SBAudigy\Taskbar\CTLTray.exe
O4 - HKCU\..\Run: [Taskbar] C:\Program Files\Creative\SBAudigy\Taskbar\CTLTask.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

Thanks-
Adam
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
O4 - HKLM\..\RunServices: [Net Framework] scvhost.exe
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)
===============================

the Net Framework(scvhost.exe) is a facked service and shud not be running,,,, Fix this entry !!!
scvhost.exe is related to W32/Agobot-S worm >> http://www.liutilities.com/products/wintaskspro/processlibrary/scvhost/

Check here for its description and removal >> http://www.sophos.com/virusinfo/analyses/w32agobots.html
So clean ur system, and after that check if u still get the Update problem or not ??
0
 

Author Comment

by:hlcsco
Comment Utility
So, I checked the one you referenced to be fixed on hijack this, then following the information at sophos.com, I was unable to do anything, since there were no registry entries by that name.

I had quarantined the file when it was first found by Norton AntiViruses.

I restarted and ran spybot just for kicks, and it found this DSO Exploit still!

I ran Windows Update and still, the updates fail.

Upon restarting into Safe Mode, in the administrator account, I still receive the Error 0x8009043C when trying to run updates. Don't know if this is related.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
btw just confirmaing,,,,

have u tried to delete ur Temporary Internet Files and Cookies of IE ??
Also empty the C:\documents and settings\username\Local settings\Temp and C:\Windows\Temp folders ??

means the Cache problem..... :-?
0
 

Author Comment

by:hlcsco
Comment Utility
I did that when I first started, but it has been a while since I have.

So, I went in, deleted cookies, then the temporary files, and that gave me an hour glass for about 20 seconds. Restarted the browser, started it, then got the blue screen of death!

Restarted, started IE without problems, re-scanned with Windows Update, but still fails.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
try deleting them in safemode manaully.....

Goto C:\Documents and Settings\ur usernmae\Local Settings\Temp and delete all files present here
Goto C:\Documents and Settings\ur usernmae\Local Settings\Temporary Internet Files, and delete the folder of ContentIE
Goto C:\Windows\Temp, and delete all files present here

reboot in Normal Mode to check ??
0
 

Author Comment

by:hlcsco
Comment Utility
There were alot of files in the local settings\temp, but still the updates fail.
0
 
LVL 65

Accepted Solution

by:
SheharyaarSaahil earned 250 total points
Comment Utility
what if u try to check for updates from another user acocunt ??

if still the same problem, then i must say that either Windows Updates went soemwhere wrong..... and didn't update ur system PERFECTLY.... !!!!!

If u bother abt this Update error, then u can give a try to Reinstalling SP1\SP2(whichever u have on ur system)
and then try updating again..... sorry but can think only of this now =|
0
 

Author Comment

by:hlcsco
Comment Utility
I appreciate all the help I've received on this issue. After many numerous attempts and failed installs of SP1 and even SP2. I determined that some device driver was not happy with the OS. (Or rather, the OS wasn't happy with it). I've since junked the computer and have given up troubleshooting this issue.
0
 
LVL 6

Expert Comment

by:montezz
Comment Utility
Then why did you award points to answers that didn't resolve the problem?
That is mis-leading and makes experts-exchange a less valuable resource for the community. Don't worry about hurting the expert's feelings.
THIS WHOLE STRING SHOULD BE DELETED
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Can you find a fax from a vendor you saved a decade ago in seconds? Have you ever cursed your PC under your breath during an audit because you couldn’t find the requested statement or driver history?  If you answered no to the first question or yes …
cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now