Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Dependencies tab slow


  • Please log in to reply
4 replies to this topic

#1 Jerry Tomas

Jerry Tomas

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:16 PM

Posted 27 August 2009 - 04:36 AM

Hi all,

After a bout with the latest Anti-Virus 2009, rootkits and a zoo of other nasties, I've gotten my system back in working order---sort of. After removing the rootkit, ran Malware Bytes Full Scan and no more were found. HiJackThis reports nothing unusual. However, it knocked out the .Net Framework 1.1 installation (wouldn't update to SP1). So...went through and removed .Net Framework 3.5, 3.0, 2.0 and finally 1.1. Then downloaded each and installed individually. Went fine until I tried to run the 3.0 install at which point it said that it couldn't start the Windows Installer service anymore. GRRR. So I go in and try to start it and it refuses saying the service doesn't match something or other. I finally open the Registry and found that the key HKLM/System/CurrentControlSet/Enum/Root/LEGACY_MSISERVER didn't exist. So exported from another machine with the same specs and imported (later found that LEGACY_CISVC didn't exist either and imported that as well).

So anyways, once Windows Installer was fixed I was able to install all of the .Net packages and then ran Microsoft Update again and it updated everything except Genuine Advantage for Office 2007...which isn't a big deal to me. However, I noticed that Microsoft Update takes a *lot* longer than usual scanning for updates when doing the Custom check from their website. So, took a peek into Services.msc and found that I had no permissions to open the Automatic Updates service. UGH. Couldn't get properties, permissions---nothing. Went into the Registry again and checked to see if the service wuauserv ImagePath was set to %fystemroot% but seems the rootkit/virii didn't do anything there. Checked permissions and my account was still part of Administrators and had Full Control. My account was also not part of Guests, Users, or any account without privileges. So, finally found some instructions on how to remove the Automatic Update service. Did that and then downloaded AU and reinstalled. I can get into Automatic Updates now but...wait for it....when I click on the Dependencies tab, it takes about 3 minutes before it will show anything. No response from the properties page for Automatic Updates until the long wait, then no dependencies. I also noticed that this happens on the Windows Installer service. Here are the lists of oddities:

- Clicking on the Dependencies tab will cause the properties page for the service to not respond for about 3 minutes before showing contents (which for some are blank even though they shouldn't be).
- Windows Installer service lists no dependencies (after the long wait) even though I know it needs the RPC service. I can still run MSI/Windows installers though.
- Microsoft Update takes forever (at least 3-5 times longer) to show updates after doing a Manual/Custom scan.
- After Microsoft Update does show updates, installing updates works fine (all critical ones have been applied) EXCEPT for Office Genuine Advantage.
- Seeing a lot of DCOM Event ID 10010 errors in System log. The server {1F87137D-0E7C-44D5-8C73-4EFFB68962F2} did not register with DCOM within the required timeout.
- Also not as common but DCOM Event ID 10010 errors in System log with The server {D6015EC3-FA16-4813-9CA1-DA204574F5DA} did not register with DCOM within the required timeout.

So the question is...are any of these things fixable without needing to do a Repair or Clean install of XP?

The machine works fine for the most part aside from the above (and anything else I haven't run into yet)...

The machine in question is a Dell Precision 690 with 4 GB RAM running XP Pro SP3. Any help greatly appreciated. I can post any logs requested.

Thanks!

BC AdBot (Login to Remove)

 


#2 Jerry Tomas

Jerry Tomas
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:16 PM

Posted 29 August 2009 - 05:01 PM

bump?

#3 Jerry Tomas

Jerry Tomas
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:16 PM

Posted 02 September 2009 - 01:09 AM

anyone?

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 55,868 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:16 PM

Posted 02 September 2009 - 09:48 AM

<<So the question is...are any of these things fixable without needing to do a Repair or Clean install of XP?>>

IMO, no.

The fact is that it is not unusual for a clean install to ultimately be the final recourse for various malware agents.

You post about a series of infections...and you don't want to do a clean install? I'm not a malware expert (or any other kind of expert) but the question should have had an obvious answer (maybe that's why no one responded to it).

I suggest starting with a clean sheet...and maintaining system defenses properly (critical updates, AV, malware-defense, firewall, safe computing, etc.) from this point on...so that you don't have to go through (again) what you've experienced thus far.

Now you have at least one set of opinions :thumbsup:.

Louis

#5 Sylvain Langlade

Sylvain Langlade

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:16 PM

Posted 23 November 2011 - 06:48 AM

Ok, maybe is it a bit late, but I've got an answer that saved my life multiple times lately. I think some recent Windows Update hotfix messed up things badly because I've seen many machines having the very same problem (from a Windows XP workstation to a Windows 2008 R2 Server, including Windows 2008 Server). Here is a solution that worked for me.

>Go to C:\Windows\System32\wbem
>Rename the Repository folder that's in it (maybe you'll have to reboot in safe mode in order to do this)
>Reboot

Done !

Not done ?... Ok, some more radical solution if the above failed : create a batch script (wmi_fix.bat looks like an appropriate name, given that WMI is the culprit) with the following content :

@echo on
cd /d c:\temp

if not exist %windir%\system32\wbem goto TryInstall
cd /d %windir%\system32\wbem
net stop winmgmt
winmgmt /kill

if exist Rep_bak rd Rep_bak /s /q
rename Repository Rep_bak

mofcomp cimwin32.mof
mofcomp cimwin32.mfl
mofcomp rsop.mof
mofcomp rsop.mfl

for %%i in (*.dll) do RegSvr32 -s %%i
for %%i in (*.exe) do call :FixSrv %%i
for %%i in (*.mof,*.mfl) do Mofcomp %%i
net start winmgmt
goto End

:FixSrv
if /I (%1) == (wbemcntl.exe) goto SkipSrv
if /I (%1) == (wbemtest.exe) goto SkipSrv
if /I (%1) == (mofcomp.exe) goto SkipSrv
%1 /RegServer

:SkipSrv
goto End

:TryInstall
if not exist wmicore.exe goto End
wmicore /s
net start winmgmt
:End


This script is not mine and I don't know who posted it first : just google to find it elsewhere. It is not intended for the very error you have, but the underlying problem is the same : the wmi part of Windows somehow blew up on your computer. In my case, the problem was a SQL Server 2008 R32 refusing to install because of Windows Installer service not running. In fact, Windows Installer service was running (according to the service console) but not really (according to SQL 2008R2 installer). And whenever I wanted to check service dependencies, it showed an empty list, without error message but after a loooooooong wait.

I recently had a customer having trouble installing a french ERP (CEGID) because of the MSI installer failing to find a working Windows Installer service, and this fix worked for him too.


Maybe it's too late, but I hope this helps someone else. Because I didn't find any relevant and direct link to this WMI problem, when googling for the errors I was seeing myself.

Bye.

Edited by Sylvain Langlade, 23 November 2011 - 07:12 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users