Microsoft Wndows Update has been attempting a security update since last fall~Unsuccessfully!

I just discovered this problem when Myrti and I were working on some other problems on my computer. I noted that I'd gotten an 'update failed' several times lately. It said 'Some updates could not be installed. The following updates were not installed. MS.NetFramework 1.1 Service Pack 1 Security Update for windows 2000, XP, Vista, 2008, Windows7 and Windows Server 2008R2 (KB953297).' The error code was 0X64C.

I checked back in my logs and found that my computer has been attempting this update since October 2009!

When I tried manually at the Microsoft site, it said I needed to upload ActiveXControl, which I did. It still couldn't successfully update that security.

I have the log. Would you like for me to attach? I just did it a few days ago.

Thanks,
Sue Ellen

http://www.microsoft.com/downloads/details...;displaylang=en

Download, manually install.

http://social.answers.microsoft.com/Forums...3e-00bb56e82798, follow the suggestions given by PA Bear, ignore comments by others.

Louis

Louis, I tried your first suggestion and wanted to give you feedback on what happened.

It looked like the manual download from the first link was going to work. Then it said 'The feature you are trying to use is on a network resource that is unavailable.' I inherited this computer from my daughter and she is on as a user, too. Could that be the problem?

Then it said 'Click OK to try again or enter an alternate pathway to a folder containing the installation package 'tmp31, tmp' in the box below.

The box said C:\DOCUME~1\Owner\Locals~1\Temp\

Then it said 'That path cannot be found. Verify that you have access to this location and try again, or try to find the installation package 'tmp31.tmp' in a folder from which you can install the product. I searched for that file name in my C drive and within temp files, with no results.

Another name I was given somewhere for the file was NDP1.1sp1-KB867460-X.86.exe and found 2 files of different sizes with that name. I opened one and it seemed to be a log of what failed in the installation attempts. I wondered if it would be helpful?

=== Verbose logging started: 3/8/2010 12:31:37 Build type: SHIP UNICODE 3.01.4001.5512 Calling process: C:\WINDOWS\system32\msiexec.exe ===
MSI © (D0:58) [12:31:37:362]: Resetting cached policy values
MSI © (D0:58) [12:31:37:362]: Machine policy value 'Debug' is 0
MSI © (D0:58) [12:31:37:362]: ******* RunEngine:
******* Product: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
******* Action:
******* CommandLine: **********
MSI © (D0:58) [12:31:37:362]: Client-side and UI is none or basic: Running entire install on the server.
MSI © (D0:58) [12:31:37:362]: Grabbed execution mutex.
MSI © (D0:58) [12:31:37:862]: Cloaking enabled.
MSI © (D0:58) [12:31:37:862]: Attempting to enable all disabled priveleges before calling Install on Server
MSI © (D0:58) [12:31:37:878]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (2C:50) [12:31:37:893]: Grabbed execution mutex.
MSI (s) (2C:6C) [12:31:37:893]: Resetting cached policy values
MSI (s) (2C:6C) [12:31:37:893]: Machine policy value 'Debug' is 0
MSI (s) (2C:6C) [12:31:37:893]: ******* RunEngine:
******* Product: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
******* Action:
******* CommandLine: **********
MSI (s) (2C:6C) [12:31:37:893]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (2C:6C) [12:31:37:909]: End dialog not enabled
MSI (s) (2C:6C) [12:31:37:909]: Original package ==> C:\WINDOWS\Installer\50c4.msi
MSI (s) (2C:6C) [12:31:37:909]: Package we're running from ==> C:\WINDOWS\Installer\50c4.msi
MSI (s) (2C:6C) [12:31:37:924]: APPCOMPAT: looking for appcompat database entry with ProductCode '{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}'.
MSI (s) (2C:6C) [12:31:37:924]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (2C:6C) [12:31:37:924]: MSCOREE not loaded loading copy from system32
MSI (s) (2C:6C) [12:31:37:971]: Opening existing patch 'C:\WINDOWS\Installer\1599f.msp'.
MSI (s) (2C:6C) [12:31:37:971]: Note: 1: 2203 2: C:\WINDOWS\Installer\1599f.msp 3: -2147287038
MSI (s) (2C:6C) [12:31:37:971]: Opening existing patch 'C:\WINDOWS\Installer\1599f.msp'.
MSI (s) (2C:6C) [12:31:37:971]: Note: 1: 2203 2: C:\WINDOWS\Installer\1599f.msp 3: -2147287038
MSI (s) (2C:6C) [12:31:37:971]: Couldn't find local patch 'C:\WINDOWS\Installer\1599f.msp'. Looking for it at its source.
MSI (s) (2C:6C) [12:31:37:971]: Resolving Patch source.
MSI (s) (2C:6C) [12:31:37:971]: User policy value 'SearchOrder' is 'nmu'
MSI (s) (2C:6C) [12:31:37:971]: User policy value 'DisableMedia' is 0
MSI (s) (2C:6C) [12:31:37:971]: Machine policy value 'AllowLockdownMedia' is 0
MSI (s) (2C:6C) [12:31:37:971]: SOURCEMGMT: Media enabled only if package is safe.
MSI (s) (2C:6C) [12:31:37:971]: SOURCEMGMT: Looking for sourcelist for product {411EDCF7-755D-414E-A74B-3DCD6583F589}
MSI (s) (2C:6C) [12:31:37:971]: SOURCEMGMT: Adding {411EDCF7-755D-414E-A74B-3DCD6583F589}; to potential sourcelist list (pcode;disk;relpath).
MSI (s) (2C:6C) [12:31:37:971]: SOURCEMGMT: Now checking product {411EDCF7-755D-414E-A74B-3DCD6583F589}
MSI (s) (2C:6C) [12:31:37:971]: SOURCEMGMT: Media is enabled for product.
MSI (s) (2C:6C) [12:31:37:971]: Note: 1: 1402 2: UNKNOWN\Media 3: 2
MSI (s) (2C:6C) [12:31:37:971]: Note: 1: 1402 2: UNKNOWN\Media 3: 2
MSI (s) (2C:6C) [12:31:37:971]: SOURCEMGMT: Attempting to use raw LastUsedSource value.
MSI (s) (2C:6C) [12:31:37:971]: SOURCEMGMT: Trying source C:\DOCUME~1\Owner\LOCALS~1\Temp\.
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 2203 2: C:\DOCUME~1\Owner\LOCALS~1\Temp\tmp31.tmp 3: -2147287037
MSI (s) (2C:6C) [12:31:38:018]: SOURCEMGMT: Source is invalid due to missing/inaccessible package.
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 1706 2: -2147483647 3: tmp31.tmp
MSI (s) (2C:6C) [12:31:38:018]: SOURCEMGMT: Attempting to use LastUsedSource from source list.
MSI (s) (2C:6C) [12:31:38:018]: SOURCEMGMT: Trying source C:\DOCUME~1\Owner\LOCALS~1\Temp\.
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 2203 2: C:\DOCUME~1\Owner\LOCALS~1\Temp\tmp31.tmp 3: -2147287037
MSI (s) (2C:6C) [12:31:38:018]: SOURCEMGMT: Source is invalid due to missing/inaccessible package.
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 1706 2: -2147483647 3: tmp31.tmp
MSI (s) (2C:6C) [12:31:38:018]: SOURCEMGMT: Processing net source list.
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 1706 2: -2147483647 3: tmp31.tmp
MSI (s) (2C:6C) [12:31:38:018]: SOURCEMGMT: Processing media source list.
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 1402 2: UNKNOWN\Media 3: 2
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 1402 2: UNKNOWN\Media 3: 2
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 1402 2: UNKNOWN\Media 3: 2
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 1706 2: -2147483647 3: tmp31.tmp
MSI (s) (2C:6C) [12:31:38:018]: SOURCEMGMT: Processing URL source list.
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 1402 2: UNKNOWN\URL 3: 2
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 1706 2: -2147483647 3: tmp31.tmp
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 1706 2: 3: tmp31.tmp
MSI (s) (2C:6C) [12:31:38:018]: SOURCEMGMT: Failed to resolve source
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 1708
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 2729
MSI (s) (2C:6C) [12:31:38:018]: Note: 1: 2729
MSI (s) (2C:6C) [12:31:38:018]: Product: Microsoft .NET Framework 1.1 -- Installation failed.

MSI (s) (2C:6C) [12:31:38:034]: MainEngineThread is returning 1612
The installation source for this product is not available. Verify that the source exists and that you can access it.
C:\WINDOWS\Installer\50c4.msi
MSI © (D0:58) [12:31:38:034]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI © (D0:58) [12:31:38:034]: MainEngineThread is returning 1612
=== Verbose logging stopped: 3/8/2010 12:31:38 ===

I tried PA Bear's suggestions for the Patch Registration Cleanup tool download and none of the d/ls given worked for me.




Sue Ellen

Edited by scarlettudor, 09 March 2010 - 02:27 AM.

<<Another name I was given somewhere for the file was NDP1.1sp1-KB867460-X.86.exe and found 2 files of different sizes with that name. I opened one and it seemed to be a log of what failed in the installation attempts. I wondered if it would be helpful?>>

When a Microsoft download is double-clicked, it should merely install.

I believe you are infected...I will suggest internally that your thread be moved to a forum appropriate for dealing with malware.

FWIW: Any file name...can be malware. Generally, users should look at file location and file size to determine whether or not a file is genuine or not.

Louis

You know, as I explore my computer and look at files ~ I have no idea what most of them are!

In trying to download PA Bear's suggestion of the Patch Register Cleanup, this is what happened. The first 'download' was a MS Word document, requiring no signature, just giving legal rights.

The next two gave me this message: 'C:\Documents and Settings\sue\Local Settings\Temporary Internet Files\content, IE5\9L5SUNB9\PatRegCleanup1a64[1].exe3 is not a valid Win32 application.'

The fourth download button, which double clicked, gave me a black box which said 'A product code must be specified. Press any key to exit.'

I note that the file description includes IE5. I'm running IE8.

Myrti and I ran a whole series of scans, GMER, SystemLook, etc. Some more than once. She concluded I wasn't infected. When we found out that the 1.1 Service security pack had been trying to update since October '09 and been unable, she suggested I come to this part of the forum.

I'm attaching the Windows update log, zipped, in hopes this might be helpful in showing what's wrong. PA Bear's thread, where you directed me, perfectly replicated my problem, right down to how long it had been trying to update, the error code, and service pack that couldn't load. However, his solution of the Patch Register wouldn't upload for me.

Infected? Yikes! I will keep calm....

Sue Ellen

PS: The zipped UpdateLog would not attach. It said it was too large. However, I attached the same zipped log to a post to Myrti in that thread.

Edited by scarlettudor, 09 March 2010 - 11:16 AM.

My mistake...I forgot that your system has been given the once-over.

My comment was sparked by something in your log you listed...that I also saw as a reference to Vundo infections.

<<C:\WINDOWS\Installer\50c4.msi>>

Google Search Results

To see file extensions...Explorer view, Tools/Folder Options/View tab.

Select Show Hidden Files/Folders...de-select the next two items listed.

In general, problems with MS.NET can probably be solved by uninstalling the whole works and then reinstalling...but I don't know if that would apply to your situation.

Louis

So, what do you recommend, Louis? I am not terribly sophisticated in things computer, but if you will tell me, step-by-step, how to uninstall my MS.Net and reinstall it, I'll certainly try. But you don't think that'll solve it? So, what do I do? I thought all MS security updates were very important.

Thanks,
Sue Ellen

Read the whole message...uninstall, then reinstall...not just uninstall.

Uninstalling/reinstalling is the only effective way of removing problems with programs or functions which may be damaged.

Add/Remove Programs is the tool for uninstalling programs/functions.

Before you start that...take a look in Event Viewer and note the last 5 errors noted.

Double-clicking on any error in Event Viewer...allows the user to see the detail.

Post the detail for the 5 most recent errors of any type (not info items, not warnings) in your next post.

Please read (before doing anything) How To Use Event Viewer - http://www.bleepingcomputer.com/forums/t/40108/how-to-use-event-viewer/ .

Louis

I found the errors in the eventviewer. I noticed that all of them are in my daughter's side of the computer. I think I told you that she gave me her old Dell when she bought a new laptop. So, there are still 2 users or sides of the computer, mine and hers. Maybe I'm asking for an update in one part and what it needs is in the other? How can or could we correct this?

Anyway, second problem. I can see the errors and started trying to copy the descriptions as well as the bytes numbers listed below it. However, it will not permit me to copy and paste. It's a lot to write out. Do you have any suggestion on how to do this more easily?

'The most recent error is 3/12/10, event ID 500 in source (native wrapper) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages for a remote computer. You may be able to use the /AUXSOURCE=flag to retrieve the descriptionl. Following is part of the event: visualstudio7x80 update, msiexc.exe.10.1622.4946.kb953297,1033,64c,f.install,x86,5.1.2600.2.3.0.768,0.'

The second most recent error is also on 3/12. Application error, event 1001. Fault Bucket 1567343042. It also asked me for the first time if it was ok to send this information across the internet and to check to always send and not ask again.

My daughter is coming over tonight. If there's something we can do to communicate between the two sides or eleminate her side and make sure my side has the wherewithal to do its updates, please advise.

Thanks so much,
Sue Ellen

Edited by scarlettudor, 12 March 2010 - 11:37 AM.

There is no such thing as "my side/your side" when it comes to errors noted in Event Viewer. Anything noted is a "system error" and XP could care less who is logged on at the time.

If you can explain what you mean...that may help me understand.

I wouldn't worry about either of the errors you posted, but it appears that one is related to connectivity and that may impact your ability to download/install.

http://technet.microsoft.com/en-us/library...683(WS.10).aspx

Does your system show any problems connecting/navigating while on the Internet?

There's no rush to do anything . Someone is here at the forum 24/7, I think.

Louis

I'll try to explain a little better, Louis.

The whole long list of errors has Julie ______ as signed on. She's virtually never on this computer since she gave it to me last fall. But ALL the errors have her as the one signed in.

It seemed to me like there were 2 sides to the computer because, when I log in as me, I see my documents, pictures, stuff. When Julie is here and logs in as herself, she sees all her stuff. I just thought that might have something to do with it, that the updates were maybe set up by her and when the computer tries to automatically update when I'm on (most of the time), it can't get to where it wants to go.

My computer is extremely slow to pull up my IE8. In fact, I've been leaving it on my msn homepage, rather than shutting it down when I go to bed to night. Occasionally, I do close out the IE and even shut down. But it takes so loooooonnng to get that IE back up, I hate to do it.

I haven't checked out that link you gave in your most recent post, but I will.

Do you want me to copy and write here any more of the errors? Especially ones starting when the updates began trying to install and couldn't, last Fall?

Thanks,
Sue Ellen

FWIW: The MS.NET update that you initially grieved over so much...really is out of date.

There is no reason to have MS.NET/NET Framework version 1.1 on a system these days, it's been superceded by versions 2 and 3.

Go to Add/Remove Programs...make sure that "Show updates" is checked...and see if you have Microsoft NET Framework 1.0 or 1.1 listed. If so, attempt to uninstall either both.

Tell me what other entries you see listed in Add/Remove Programs...for Microsoft NET Framework 2.0 or 3.0 or 3.5. Do not include the sub-items/updates for each, just the main versions I have listed.

Louis

LOL, I like your turn of phrase. Yes, I do grieve over real and imagined threats to my 'baby.'

Well, I checked out my add/remove programs. It does indeed have MS.Net/Framework 1.1 listed, as well as 3 and 4 and 3.5. I tried to uninstall/remove it. But just like when I tried to update it, it came up with

'The feature you are trying to use is on a network resource that is unavailable. Check OK to try again or enter an alternate path to the installation package 'tmp31.tmp.' Same old, same old.

What next? How can I find that elusive tmp31.tmp or an alternate route to it? It continues to show up as an error as it tries incessantly to update its unavailable self. I can't even get rid of it.

Sue Ellen

Edited to add: There was also a Microsoft Compression Client Pack 1.0 for Windows XP that hadn't been used since 1/20/07. There was a Microsoft.NETframework 1.1 HotFix KB886903 that had no listing of when, if ever, it was used. Same for the 1.1 (no date, if ever). The most rcently used MS Framework was the 3.5, used 8/1/09. The 3.0 pack 2 was last used 11/15/08.

Edited by scarlettudor, 12 March 2010 - 08:38 PM.

Well...I don't know what to tell you.

Worth reading, http://blogs.msdn.com/astebner/archive/200...04/6659905.aspx.

I've never had these types of problems with MS.NET, but it seems that others have.

FWIW: If you have NET Framework 4.0 installed...I suggest that you uninstall it. It's a beta and it's not ready for prime time. It may be responsible for some of your problems.

The only version of MS.NET that needs to be installed...is 3.5, SP1 (which will install updates for NET Framework 2.0 and 3.0 as part of the SP).

Louis

Try this link it has worked for me. If you end up re-installing the NET Framework make sure you install them in the order referenced in the article.


http://support.microsoft.com/kb/922377