Problem with Security Update for Windows XP (KB9

Topic

New Reply

I am running XP Pro, SP3, with windows updates set to automatic. I keep getting a message to download and then install Security Update for Windows XP (KB979683), but every time I try to do so it says the update could not be installed and then within a matter of minutes wants to download and install it all over again with the same result. Here is the log file that is created when the install fails, which maybe somebody can decipher for me:
1.000: 2010/04/17 17:14:05.437 (local)
1.000: e:3bf8fc23f2f01c10e9c7b87eupdateupdate.exe (version 6.3.13.0)
1.000: DoInstallation: GetProcAddress(InitializeCustomizationDLL) Returned: 0x7f
1.015: Hotfix started with following command line:
1.062: In Function GetReleaseSet, line 1240, RegQueryValueEx failed with error 0x2
1.093: CreateUserInterface: GetProcAddress for DefineInstallCustomUI failed: 0x7f
1.125: Return Value From MpSysCheck = 0
1.125: MpSysCheck returned 506628
1.125: Fist Condition in MagicTrap.Check.Condition Failed
1.125: Condition Check for Line 1 of PreRequisite returned FALSE
1.125: ReadStringFromInf: UpdSpGetLineText failed: 0xe0000102
1.125: KB979683 Setup encountered an error: Setup cannot continue because one or more prerequisites required to install KB979683 failed. For More details check the Log File c:windowsKB979683.log
1.140: ReadStringFromInf: UpdSpGetLineText failed: 0xe0000102
1.140: Setup cannot continue because one or more prerequisites required to install KB979683 failed. For More details check the Log File c:windowsKB979683.log
15.984: Message displayed to the user: Setup cannot continue because one or more prerequisites required to install KB979683 failed. For More details check the Log File c:windowsKB979683.log
15.984: User Input: OK
15.984: Update.exe extended error code = 0xf0f4
15.984: Update.exe return code was masked to 0x643 for MSI custom action compliance.

Thanks, Jim

Reply | Quote

Replies

Run a thorough antivirus and antimalware scan on your computer.

Reply | Quote

I ran Avira’s AntiVir, Housecall, Malwarebyte’s AntiMalware and Windows Defender. A few problems were found and fixed, but still cannot install the update.

Reply | Quote

I ran Avira’s AntiVir, Housecall, Malwarebyte’s AntiMalware and Windows Defender. A few problems were found and fixed, but still cannot install the update.

Did you look at the log file mentioned – c:windowsKB979683.log?

Joe

--Joe

Reply | Quote

Yes, it is copied in the initial post, but I’m not sure what it means.

Reply | Quote

Yes, it is copied in the initial post, but I’m not sure what it means.

See the “Known Issues” paragraph at MS10-021: Vulnerabilities in Windows Kernel could allow elevation of privilege.

Joe

--Joe

Reply | Quote

Thanks for your response, Joe.
I tried all of the solutions indicated that I could, but without success. When I try to install the update manually I get a KB979683 Setup Error: “Setup cannot continue because one or more prerequisites required to install KB979683 failed. For More details check the Log File c:windowsKB979683.log.”
Latest addition to the log file:
0.953: ================================================================================
0.969: 2010/04/19 19:38:31.859 (local)
0.969: e:dc467413f8cf6dbef0dca3509fupdateupdate.exe (version 6.3.13.0)
0.969: DoInstallation: GetProcAddress(InitializeCustomizationDLL) Returned: 0x7f
0.969: Hotfix started with following command line:
0.969: In Function GetReleaseSet, line 1240, RegQueryValueEx failed with error 0x2
0.969: CreateUserInterface: GetProcAddress for DefineInstallCustomUI failed: 0x7f
1.000: Return Value From MpSysCheck = 0
1.016: MpSysCheck returned 506628
1.016: Fist Condition in MagicTrap.Check.Condition Failed
1.016: Condition Check for Line 1 of PreRequisite returned FALSE
1.016: ReadStringFromInf: UpdSpGetLineText failed: 0xe0000102
1.016: KB979683 Setup encountered an error: Setup cannot continue because one or more prerequisites required to install KB979683 failed. For More details check the Log File c:windowsKB979683.log
1.031: ReadStringFromInf: UpdSpGetLineText failed: 0xe0000102
1.031: Setup cannot continue because one or more prerequisites required to install KB979683 failed. For More details check the Log File c:windowsKB979683.log
98.016: Message displayed to the user: Setup cannot continue because one or more prerequisites required to install KB979683 failed. For More details check the Log File c:windowsKB979683.log
98.016: User Input: OK
98.016: Update.exe extended error code = 0xf0f4
98.016: Update.exe return code was masked to 0x643 for MSI custom action compliance.

Reply | Quote

I’m out of ideas.

You can try contacting Microsoft at 1-866-PCSAFETY. There is free support for installation problems with security fixes.

Joe

--Joe

Reply | Quote

OK, thanks a lot.

Reply | Quote

OK, thanks a lot.

Reply | Quote

This is what I do when a security update won’t install, and it has worked every time except for KB967715 which was causing a problem because of Sonic Record DLA. Anyway, here is the procedure:

If the update shows in Add/Remove Programs, uninstall it and reboot. Download the update and save to C: drive root. Open Run and enter, for example, the following

C:WindowsXP-KB971486-x86-ENU.exe /overwriteoem

with the correct name for the update replacing the one in the example. Note there is a space between exe and the slash. Reboot and check if the update is properly installed.

Reply | Quote

Thanks for the idea, but it didn’t work. 🙁 Still get the error message that one or more prerequisites required to install the update are missing, but no one seems to be able to figure out what is missing. Am working with an MS tech but so far no success there either, so all ideas are welcome!

Reply | Quote

Has anyone else had a problem installing this particular XP update — #KB979683 — or am I the only one?

Reply | Quote

If you are a single user, or even in a multi-user home environment, this may not be an issue for you so there may be no practical need to spend additional time trying to solve what appears to be essentially a “don’t care” security patch in those situations.

Perhaps someone else can tell us if I am misinterpreting this.

According to the KB article,
“A security issue has been identified that could allow an authenticated local attacker to compromise your system and gain control over it.”

That suggests to me that it applies only to local access, and that is further constrained only to someone who has already validly logged-onto the system.

Remote access does not seem to be an issue, and “drive-by” users who have not already logged-in do not seem to be an issue.

Reply | Quote

I am on a network at work with 5 other people, none of whom would want (or even know how!) to attack and compromise my system. If you are right, it would certainly save me a lot of hassle!

Reply | Quote

I am on a network at work with 5 other people, none of whom would want (or even know how!) to attack and compromise my system. If you are right, it would certainly save me a lot of hassle!

Hi!

I had a problem w/ this update on 2 clients and we just passed it by w/ no adverse issues since they were in a secure local network.

Reply | Quote

I am on a network at work with 5 other people, none of whom would want (or even know how!) to attack and compromise my system. If you are right, it would certainly save me a lot of hassle!

Without wanting to or knowing how, they may still compromise your system.

I believe a careless click is all it takes.

I may be overcautious, but I have had no virus for 20 years.

Alan

Reply | Quote

In the for what it’s worth department, I have installed the above inquired patch and as far as I know it has not caused any problems that I am aware of. I am running XP home SP3. Could be an issue with XP Pro.

Reply | Quote

OK, thanks. That would certainly be the easiest solution!

Reply | Quote

You might check out this possibility:

http://social.answer…b0-f5ab9cd155f3

Please let us know if that works. If not, you might download the update (find your link here http://www.microsoft…n/MS10-021.mspx ) to an empty folder, expand it ” WindowsXP-KB979683-x86-ENU.exe /x:.” then adjust the timestamp (use your favorite utility tool) on the SP3GDRntoskrnl.exe file to be 3 hours later [e.g., in EDT it shows as “2010-2-17 09:10” but it should be “2010-2-17 12:10″ per http://support.micro…om/?kbid=979683 for XPx86SP3] then execute update.exe in the update folder to install. Let us know how it goes. Sometimes the timestamp being incorrect will cause the update to be offered repeatedly. You may have to place the corrected file manually into the proper folder, then run Windows Updates to be sure it won’t be offered again. [ Go here http://windowsconnec…/1050/3348.aspx for a good synopsis of General Distribution Releases (GDR) and Quick Fix Engineering (QFE) Service Branches and another undocumented switch, /B: ]

Reply | Quote

I tried both of your suggestions, but neither worked. My problem is not that the update is repeatedly offered after being installed, but that it will not install. Error message says that “one or more prerequisites required to install KB979683 failed. For more details check the Log File c:windowsKB979683.log.”
Is it possible that one of the services required is disabled (via services.msc)?

Reply | Quote

We had a problem with this patch being offered repeatedly on XP Pro SP3. We were given direction to use method three in MS article kb/822798 however there were two files that were in use and the folder could not be renamed. We used File Assasin to remove those (which is included in the MBAM utility) and all was well the update then installed perfectly. Hope this is helpful. – Mike

Reply | Quote

Thanks, but still no go. I am able to rename the CatRoot2 folder but it doesn’t help the install.

Reply | Quote

Don’t know what happened. Hope this does not show up two times. Put the KB979683 in to Google search. Lot of info there.

Reply | Quote

Perhaps the information in this Q&A will help you solve the problem:

Windows Update/Automatic Updates keeps wanting to install the same update. How can I stop Windows Update from repeatedly offering the same patch? –

http://www.pcbuyerbeware.co.uk/SoftwareProblems.htm#recurring

Reply | Quote

If anyone else is actually interested in and following this thread, I will let you know that I am now on my 4th MS tech (2 email and 2 phone) without resolution. The 4th tech told me that update KB979683 is intended for a Windows Server 2003 system, not for my XP Pro, which is why it will not install. Can anyone else confirm this?

I have also, in the process, discovered that I have the Win32/Alureon.A virus which has caused a TDSS rootkit infection in Win32DriversiaStor.sys. But all the scanners recommended to me so far have been unable to remove it. I am also unable to boot up in Safe Mode, as the computer hangs on the DriversMup.sys file, which I am hoping is tied into the Alureon virus. Any one else experiencing any of this??

Thanks, Jim

Reply | Quote

If anyone else is actually interested in and following this thread, I will let you know that I am now on my 4th MS tech (2 email and 2 phone) without resolution. The 4th tech told me that update KB979683 is intended for a Windows Server 2003 system, not for my XP Pro, which is why it will not install. Can anyone else confirm this?

I have also, in the process, discovered that I have the Win32/Alureon.A virus which has caused a TDSS rootkit infection in Win32DriversiaStor.sys. But all the scanners recommended to me so far have been unable to remove it. I am also unable to boot up in Safe Mode, as the computer hangs on the DriversMup.sys file, which I am hoping is tied into the Alureon virus. Any one else experiencing any of this??

Thanks, Jim

Have you tried the remedies for the infection suggested by Microsoft here?

http://www.microsoft…Win32/Alureon.A

Most AV programs are now aware of the more common variants on this virus. Have you done a deep scan with Malwarebytes, including Heuristics and Extras?

Without getting rid of this infection, you will not be able to install this update, whether you need it or not.

-- rc primak

Reply | Quote

Have you tried the remedies for the infection suggested by Microsot here?

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Virus:Win32/Alureon.A

Most AV programs are now aware of the more common variants on this virus. Have you done a deep scan with Malwarebytes, including Heuristics and Extras?

Without getting rid of this infection, you will not be able to install this update, whether you need it or not.

Thanks Bob for your questions. Yes, I do or have done all that is suggested in the MS article as well as the deep scan with Malwarebytes. Fortunately there are no corrupted files or other negative effects from the virus (that I am aware of!) except for not being able to install update B979683.

Reply | Quote

Thanks Bob for your questions. Yes, I do or have done all that is suggested in the MS article as well as the deep scan with Malwarebytes. Fortunately there are no corrupted files or other negative effects from the virus (that I am aware of!) except for not being able to install update B979683.

Hi Jim!

I just got bit by the same update. There is a fault in the way some Windows XP systems handle Certificates. There was supposed to be a Signed Certificate which was supposed to be imported with the installation of this update. But I in my infinite wisdom (NOT!) have been installing all of the recent optional MS Updates for changing the way Windows XP handles Certificates. So…I have a system which rejected the MS Certificate for this update. I don’t know whether it was the Certificate, or my configuration which was at fault, but this seems to trigger the endless reoffers of the update by MS Updates. I have posted a request for help at https://www.askwoody.com about this issue.

I think the update installs just fine in these cases. There is NO VIRUS, as a very specific MS Fixit told me (it scans for the Alureon family of rootkits in certain System Files in Windows XP). The Fixit is one of many suggestions in the MS KB Article on the subject of why this update may not install, or may be reoffered when it has already successfully installed (as appears to be my case). None of the suggestions from the Microsoft users forums seems to help at all. I would classify this as a flawed MS Certificate. This is not the first time such a flawed Certificate has caused people problems with MS Updates, and it won’t be the last time.

What I finally did, was to run Secunia PSI, which said I have all necessary current MS Updates. Then, I went to MS Updates (or, click on the Tray Icon if you have automatic notifications). I found the reoffered update, and unchecked it. Then I checked the box for “Don’t show me this update again”, and closed out the session. Out of sight, out of mind, and I think I am in fact fully patched, even if MS Updates refuses to recognize this.

If Woody Leonhard responds to my Comment, I’ll update everyone here in the Lounge. Right now, I’d say, don’t sweat it — you are fully patched. And you do NOT have a virus!

-- rc primak

Reply | Quote

Thanks, Bob, and you are right. I don’t have a virus, BUT I did until last night! I was finally able to remove the Win32/Aleuron.A virus and when I did the TDSS rootkit problem went away and the update installed without a hitch. I was finally able to remove the Aleuron virus by running MS Windows Malicious Software Removal Tool. I had run it before and it identified but was not able to completely remove the virus, but this time it did. I ran quite a few other scans as well, some of which found things and some of which didn’t (TDSSKiller, Malwarebytes Anti-Malware, a-Squared, FixIt, Windows OneCare Safety Scanner, VIPRE Rescue) but this is the one that finally got credit for the win.

Thanks to all who offered their suggestions. It is great to be a free man again!

Jim

Reply | Quote

Thanks to all who offered their suggestions. It is great to be a free man again!

Congratulations!!! Thanks for hanging in there and also for keeping us posted.

Joe

--Joe

Reply | Quote

Unfortunately, running MSRT, Malwarebytes, Super Antispyware, and Avast deep scans did not end my endless reoffers of this patch. Secunia PSI says the patch is installed, but Belarc Adviser says it is missing. MS Updates says it is installed, but keeps reoffering it. Perhaps this is unrelated, but my laptop also stalls and won’t complete Windows shutdown when Comodo Firewall and Defense Plus is active. If I exit the firewall, the stalling does not occur. This is new since the update was supposedly installed. Uninstalling the update and downloading it from SoftwarePatch.com as a stand-alone installation also does not solve either the reoffer or the shutdown problem. The installer does its thing, reports no errors, and the patch is not recognized by Belarc Adviser or MS Updates. For me, this is just an annoyance, but it could portend worse things to come.

-- rc primak

Reply | Quote

Bob, if the update shows up in Add/Remove Programs, try: Removing the update through Add/Remove — Manually download but do not install the update — Reboot in Safe Mode — Install the update — Reboot normally.

There are some suggestions above in this thread about how to get rid of the endless reoffers of the update. That was my problem only because it wasn’t installing. Once it installed, the offers stopped.

You might try calling MS — the techs did a couple registry and certificate related things that didn’t solve my problem but might solve yours: 866-234-6020. Besides, you’ll probably get to talk to someone in India where it is 100+ degrees Farhrenheit. 🙂

Reply | Quote

Bob, if the update shows up in Add/Remove Programs, try: Removing the update through Add/Remove — Manually download but do not install the update — Reboot in Safe Mode — Install the update — Reboot normally.

There are some suggestions above in this thread about how to get rid of the endless reoffers of the update. That was my problem only because it wasn’t installing. Once it installed, the offers stopped.

You might try calling MS — the techs did a couple registry and certificate related things that didn’t solve my problem but might solve yours: 866-234-6020. Besides, you’ll probably get to talk to someone in India where it is 100+ degrees Farhrenheit. 🙂

No luck. Nothing works. I’ve spent too much time on this one already. Thanks for all who tried to help, but this one’s a complete botch, at least on my computer. It does install, I think, but it is never recognized as installed. I have no further interest in this patch. Maybe MS will revise it someday…

Just so as not to sound too gloomy, I may have a good reason now to go to my local Micro Center and ask if their technicians can get the update installed without causing too much collateral damage. If not, the most cost-effective solution might be to have them reinstall Windows XP Pro and bring it completely up to date, and then rebuild on my own. Very time consuming, but the results might be better than fooling around with a possibly misconfigured computer. The money might be well worth it, if future time-consuming headaches can be avoided.

Sometimes you have to recognize when being your own technician has reached its limits.

-- rc primak

Reply | Quote

I just got done with a series of Chats and phone conversations with Microsoft’s and my computer servicer’s support technicians. Microsoft technicians finally gave the go-ahead to hide forever the reoffered update. If anyone is still having the update reoffered after it reports a successful install, even if no reboot is prompted, it is probably safe to hide the update permanently. I was given the “explanation” that my BIOS did not “synchronize” with the inside the kernel Windows system changes which this update has made. The changes are successfully made, but Belarc Adviser and MS Updates check using some sort of BIOS check. What the heck all of this means is way beyond my technical knowledge.

There are no BIOS or motherboard updates available for my laptop computer. So this may be a recurring issue as long as I continue to run this computer.

Secunia PSI uses some other method to check for missing MS Updates, and reports a fully-updated system. So, you can trust Secunia PSI for this analysis, but do not trust Belarc Adviser or MS Updates to accurately report missing MS patches.

I have asked via e-mail for the MS technician to clarify just what “BIOS synchronization” means to him, and I await his e-mail response. If anything useful or interesting emerges from all of this, I will post again.

As far as I am concerned, this issue is now fully resolved. If reoffers or failed installs happen in the future, I have a resource at Microsoft to contact. But what a waste of time this mess has been! !!!

New update: [/size][/size][/b]The issue is the interaction between the Windows System kernel (the innermost layer of the OS, which interacts directly with hardware, BIOS, and firmware) and the motherboard and/or the BIOS. The patch is not interacting in the best possible way with the computer hardware. Usually this is not fatal, and Windows will operate reasonably normally. I may be getting a shutdown and reboot hangup now, so this may be related to the update. But otherwise, there should be no problems. If there is no Mobo chipset driver update, this MS update can just be hidden.

New update: Due to the Microsoft Support Chat technician using EasyAssist Remote Access, my Ethernet and Firewire Devices were stuck in the ON position, and Windows could no longer control them. I had to go into the Device Manager and manually disable those two Devices. Then Windows would shut down and hibernate as usual, maybe better than before. Again I say, what a waste of time[/b] !![/color][/size]

Such are the issues with running older laptops into the unforeseen future!

Thanks to Sam at Microsoft technical support for the clarification.

[/color][/size][/size][/color]

-- rc primak

Reply | Quote