KB931768 update (6.0 SP2)

Topic

New Reply

Every time I try to run KB931768 on about 18 of my PC’s, I receive a ‘Setup canceled’ message, and mshtml.dll never gets updated (one of the purposes of the update). I can’t simply copy/paste the dll file, as it automatically gets restored to the previous version. I’ve tried disabling system restore in the registry and then copy/paste to no avail. Any ideas?

Reply | Quote

Replies

It probably gets the old dll version from your WFP folder.
How about going to that folder and renaming the mshtml.dll to mshtml.old, then trying to copy the new version to the folder(s)?

Don’t really know why you can’t run the hotfix. Have you looked for it in the Windows folder? Should look something like $NtuninstallKB931768xxx$. If it’s there go the the subfolder “spuninst” and run the exe file to uninstall it.
The try to install again.

Reply | Quote

What’s the WFP folder?

Reply | Quote

Windows File Protection ( WFP )
Do a search for it.

Reply | Quote

Bob,
I thought that WFP (and WRP, Windows Resource Protection, in WinVista, new name) was a “feature” not a folder.

See my off-topic post to Gloria and the link to MS.

As to where Windows XP keeps a copy of these protected files, that would be the WindowsSystem32dllcache.

I.e. for 931768 most of the files goes to WindowsSystem32; iexplore.exe is updated in its program folder, and a fresh copy of everything goes into WindowsSystem32dllcache.

For future use/updates, the new files, I know you know this Bob, also goes to the HotFix Migration folder: Windows$hf_mig$KB931768-IE7… or Windows$hf_mig$KB931768… if IE6.

And last but not least the replaced files are also backed up for an eventual uninstall; in the case of IE7 not the normal Windows$NtUninstallKBNNNNNN$, but in Windowsie7updatesKB931768-IE7.

Reply | Quote

Argus,
Screenshot below is a small part of my WFP Folder . It contains 2111 oblects, 10.6 GB size. It has .nls files and .dll files stored there.

I happen to have it on my G: drive because I moved it there from the C:

Reply | Quote

Hello Bob,
Slightly off topic.
I understand that you have moved a folder to another drive. That is understandable, that some, sometimes would like to move a rather big folder. In this case, as I understand, done by a small registry edit to point to the new folder, followed by running sfc.exe.

I don’t know, but maybe in this process you named the new home for the cache “WFP”.

On any standard installation of Windows 2k Pro/XP the cache folder is %SystemRoot%System32DLLCache.

Let’s put it this way: if Windows File Protection (WFP) is going to work there must be a pointer in the registry to where the cached files of the protected files are (however, absence of pointer means default place).

The pointer is the SFCDllCacheDir value, in the key:
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon

The default value data is %SystemRoot%System32, i.e. the folder that contains the cache folder, in standard installation hidden and called “dllcache”. To quote MS: “By default, the SFCDllCacheDir value is not listed in the […] registry key. To modify the cache location, you must add this value.”

And at start Windows copies any WFP settings from the key (if it exist):
HKLMSoftwarePoliciesMicrosoftWindows NTWindows File Protection
to the above mentioned key, so any WFP related values in the policy key takes precedence over same values in the Winlogon key.

So, by default the location, where the cache folder is, is not listed, and by default the location for the cache folder is set to: %SystemRoot%System32.

So, if there is no SFCDllCacheDir value in the registry, the cache folder ought to be the DLLCache folder in %SystemRoot%System32.

If there is a SFCDllCacheDir value in the registry, then it has been added by the “user”, and can point anywhere (even to the default location).

Then it’s a different matter that when WFP is working, looking for a correct version to replace a file, it looks at:
%SystemRoot%System32DLLCache
%SystemRoot%Driver Cachei386Driver.cab and maybe sp2.cab
Source; CD or network share

To quote MS on “Driver cache”:
“Additionally, all drivers in the Driver.cab file are protected, but they are not populated in the Dllcache folder. WFP can restore these files from the Driver.cab file directly without prompting the user for the source media. However, running the sfc /scannow command does populate the files from the Driver.cab file into the Dllcache folder.”

Only if it cannot find the file in cache or other place on network, it prompts for a product CD.

Reply | Quote

I’m assuming that when an update is run, it updates i386driver.cab (sp2.cab) with the latest info? I only make that assumption because whenever a user logs on after I replace mshtml.dll, a WFP notification pops up. The user can cancel/ok out of the message and all is well, but I’d like to run the “update” as thorough as possible.

Reply | Quote

Nah, the original cabinet files do not get updated (look at the file dates in WindowsDriver Cachei386, or where you have them placed). But Windows know where to find the original files, so in the case of a file that has not been updated since XP Gold/SP2, it can also look at the Driver.cab.

The WFP notification would probably be that WFP has found that a file has been replaced and that it is restoring the correct version (according to the information Windows has about installed updates).

As you maybe saw in my link to MS, in the mentioned post to Gloria, here: http://support.microsoft.com/kb/222193%5B/url%5D MS says:
“Replacement of protected system files is supported only through the following mechanisms:

Reply | Quote

I don’t know, Argus.
I DO recall moving the folder to a new drive but do NOT recall renaming it?
I agree with the balance of your post but will continue to “scratch my head” about the mysterious WFP folder.???

Reply | Quote

Argus,

Thanks for all the valuable information, hopefully I can put it to use! I knew about hf_mig, but not about the dllcache folder (or more specifically, its purpose).

Thanks again!

Reply | Quote

Hi Jeremy,
Well, I’m sorry for my slightly off-topic post, and that I did not address your direct problem. I think that disabling SR isn’t going to help, as you have found out. SR is a different layer of protection, than Windows File Protection. In fact turning of SR, beside the fact that it removes all present RP’s (nothing to go back to), it doesn’t protect you during the process (you create an RP, do something, if it doesn’t work you return to previous state).

I would never at the situation we have today with Windows updates and sometimes temporarily hotfixes, try to manually copy files to replace files on a PC. Maybe, back at Win3/9x time. Even more, why replace only one file. If files are replaced somehow this way, then their version will not correspond with the information about installed updates. It would undermine the stability for the future.

If you know about the %WINDIR%$hf_mig$ folder, then you maybe know that since around SP2 (some before SP2, all after) MS uses something called Branching to support multiple installation scenarios. Among things this allows MS to release an update that address only critical issues, and no other changes. We have the GDR branch and the QFE branch. This is a complicated business. And myself I would not like to step in and try to outsmart the update process and/or WFP.

For more information on that subject see: The Package Installer (Formerly Called Update.exe) for Microsoft Windows Operating Systems and Windows Components

To find the cause of your problem I would try:

• Do the update install on other PC’s you have? (if there are more). If so, can you find any discrepancy between those that can install and those that cannot. I know it can be hard, but maybe. Are program files on those machines that cannot in their default location? If moving the location it can become a problem (when installing updates). Has the PC’s with problems temporarily been running some other version of IE? Etc.
• What do you get beside the ‘Setup canceled’ dialog box?, does anything get installed before cancel (well it probably would remove that at cancel, but anyway). Do you find a log in Windows; KB931768.log? For some installation problems this log can be a help (a log created by the package installer). Have you looked at Event viewer for errors?
• Not that it should matter, for a small update, but the installer needs space to extract the package, and of course the right write and delete etc. in the temporarily extraction folder (and of course the user must be an Admin). Though that would lead to other error messages. One could try to manually extract the updates to a temp folder, then running the “update.exe”. See this post for short mention about manual extraction.
  [/list]Setup canceled, is the 61453 error, STATUS_USER_CANCELLED. Odd.

  So depending on what you find out … here is the MS IEBlog post with comments on the May update: IE May 2007 Security Update Available Now. There has been some real problems with the 931768, IE May update, as Jerry mentioned. Our Woody has them detailed also. But I have not, on a brief search, found anything about setup cancel, 61453, and the May update. Though, a general search for this error maybe could give clues (“package installer 61453 setup canceled”). No matter how search it’ll be a digging; I cannot understand why some people at help sites must repeat the log files in extenso in their replies, it’s so annoying to read. Vive l’Lounge!

  There probably should be a support newsgroup kind of thing for this, but I give up trying to find it, since MS have done a make over of their site (and I also have to find English language sites).

Reply | Quote

Hi Jeremy

It appears that there are a series of issues with this update which may need a bit of reviewing. I know you will have read this but I thought i would add it to the mix. There are too many things to pull into this and as you state there are a few of them, it may be because they are a different “build” to the others ( big assumption on my part here but symptomatic of any network )

Have a look at http://support.microsoft.com/kb/931768%5B/url%5D particularly the hotfixes section

Reply | Quote

Jerry,

I’ve been through this update up and down, side to side for about a week and a half – nothing suggested by M$ helps…

Reply | Quote

Knew you had, just checking

Reply | Quote