Stealth Windows update prevents XP repair

Windows Secrets ^ | 27 September 2007 | Scott Dunn

[ShadowAce]

A silent update that Microsoft deployed widely in July and August is preventing the "repair" feature of Windows XP from completing successfully.

Ever since the Redmond company's recent download of new support files for Windows Update, users of XP's repair function have been unable to install the latest 80 patches from Microsoft.

Repaired installations of XP can't be updated
Accounts of conflicts with XP's repair option came to our attention after Microsoft's "silent install" of Windows Update (WU) executable files, known as version 7.0.600.381, was reported in the Sept. 13 and 20 issues of the Windows Secrets Newsletter.

The trouble occurs when users reinstall XP's system files using the repair capability found on genuine XP CD-ROMs. (The feature is not present on "Restore CDs.") The repair option, which is typically employed when XP for some reason becomes unbootable, rolls many aspects of XP back to a pristine state. It wipes out many updates and patches and sets Internet Explorer back to the version that originally shipped with the operating system.

Normally, users who repair XP can easily download and install the latest patches, using the Automatic Updates control panel or navigating directly to Microsoft's Windows Update site.

However, after using the repair option from an XP CD-ROM, Windows Update now downloads and installs the new 7.0.600.381 executable files. Some WU executables aren't registered with the operating system, preventing Windows Update from working as intended. This, in turn, prevents Microsoft's 80 latest patches from installing — even if the patches successfully downloaded to the PC.

I was able to reproduce and confirm the problem on a test machine. When WU tries to download the most recent patches to a "repaired" XP machine, Microsoft's Web site simply states: "A problem on your computer is preventing the updates from being downloaded or installed." (See Figure 1.)

Figure 1. After a repair install of XP, which resets the operating system to its original state, Windows Update can't install the 80 most-recent patches from Microsoft.
__________

Most ordinary Windows users might never attempt a repair install, but the problem will affect many administrators who must repair Windows frequently. Anyone who runs XP's repair function will find that isolating the cause of the failed updates is not a simple matter.

Beginning in July, it is not possible for Windows users to install updates without first receiving the 7.0.6000.381 version of nine Windows Update support files. (See my Sept. 13 story for details.) If Automatic Updates is turned on, the .381 update will be installed automatically. If AU is not turned on, you'll be prompted to let Windows Update upgrade itself before you can installing any other updates. Consequently, users are forced to get the silent update before they can attempt to install Microsoft's latest security patches.

The problem apparently arises because seven of the DLLs (dynamic link library files) used by WU fail to be registered with Windows. If files of the same name had previously been registered — as happened when Windows Update upgraded itself in the past — the new DLL files are registered, too, and no problem occurs. On a "repaired" copy of XP, however, no such registration has occurred, and failing to register the new DLLs costs Windows Update the ability to install any patches.

Registering DLL files is normally the role of an installer program. Unlike previous upgrades to WU, however, Microsoft has published no link to an installer or a downloadable version of 7.0.6000.381. Strangely, there's no Knowledge Base article at all explaining the new version. The lack of a KB article (and the links that usually appear therein) makes it impossible for admins to run an installer to see if it would correct the registration problem.

One possible fix is to install an older version of the Windows Update files (downloadable from Step 2 of Microsoft Knowledge Base article 927891) over the newer version. This involves launching the installer from a command line using a switch known as /wuforce.

That corrects the registration problem, although even in this case you must still accept the .381 stealth update (again) before you can get any updates. The fact that the /wuforce procedure solves the problem suggests that the installer for .381 is the source of the bug.

Manually registering files solves the problem
If you find that Windows Update refuses to install most patches, you can register its missing DLLs yourself. This can be accomplished by manually entering seven commands (shown in Step 2, below) at a command prompt. If you need to run the fix on multiple machines, it's easiest to use a batch file, as Steps 1 through 5 explain:

Step 1. Open Notepad (or any text editor).

Step 2. Copy and paste the following command lines into the Notepad window (the /s switch runs the commands silently, freeing you from having to press Enter after each line):

regsvr32 /s wuapi.dll
regsvr32 /s wuaueng1.dll
regsvr32 /s wuaueng.dll
regsvr32 /s wucltui.dll
regsvr32 /s wups2.dll
regsvr32 /s wups.dll
regsvr32 /s wuweb.dll

Step 3. Save the file to your desktop, using a .bat or .cmd extension.

Step 4. Double-click the icon of the .bat or .cmd file.

Step 5. A command window will open, run the commands, and then close.

The next time you visit the Windows Update site, you should not have any problem installing the latest patches.

In my articles in the last two weeks on the silent installation of the Windows Update support files, I stated that the stealthy upgrade seemed harmless. Now that we know that version .381 prevents a repaired instance of XP from getting critical patches, "harmless" no longer describes the situation. The crippling of Windows Update illustrates why many computer professionals demand to review updates for software conflicts before widely installing upgrades.

"I understand the need to update the infrastructure for Windows Update," says Gordon Pegue, systems administrator for Chavez Grieves Engineers, a structural engineering firm in Albuquerque, N.M. "But I think Microsoft dropped the ball a little bit communicating how the system works. Administrators should know these sorts of things, in case problems arise."

A Microsoft spokeswoman offered to provide an official response about the situation, but I received no reply by press time.

If you ever need to run the repair option on XP, first see the detailed description provided by the Michael Stevens Tech Web site.

I'd like to thank Windows Secrets contributing editor Susan Bradley for her help in bringing reports of this problem to light.

[Slapshot68]

I’ve heard similar problems. I’m in the market for a new gaming PC but I’m limiting my search to those who still offer XP.

[JRios1968]

...but at least I don’t have to deal with the photos of Helen Thomas.

How did you manage to set it up to block her voice?

[KoRn]

lol!!

[2nd amendment mama]

Bookmarking

[Virginia Ridgerunner]

I would not be at all surprised if this was a deliberate ploy by MS to force users to upgrade to the hated Vista. I run XP right now, but when my computer finally decides to kill over, I’m going to Linux or Mac. Screw MS, their crappy software, and their draconian licensing policies.

[Publius6961]

BUMP!

[shineon]

The FUD (fear uncertainty and doubt) are finally and I mean finally coming back to haunt good old Microsoft.

Mr. Bill has finally left the building and the rats are going after the cheese.

Microsoft could recover from this one, they still have Bills Billions, but it’s going to take a little bit of work and some good ole american ingenuity.

FUD is not quite going to do it for them this time. And everyone can get just about everything they offer now , legally for free as open source. Bwwaaaaahhhh...

After taking down company after company by selling their products for less and bundling with their OS.

They are finally going to have to eat their good ole we’re smarter and cheaper than everyone else dog food.

[HonorInPa]

I too have a new laptop. Did my research, ordered plenty of memory and have had ZERO problems with Vista in over 6 months. Different in places - Yes, Crap - couldn’t be more inaccurate.

[mmichaels1970]

I have an Inspiron 9400 with Vista Ultimate. I love it. Had an issue here or there, and I’ll admit the changes are mostly cosmetic, but I certainly wouldn’t call it trash.

The search functions within folders and on the start bar are my favorite new features.

Probably the crappiest thing in Vista though is the User Account Control feature. As soon as you unpack a Vista system, turn it off. Turn it off right away.

[13foxtrot]

I have moved to Apple.

Over a year and not a single problem. This is with my teenager doing his best to screw it up. Before the windoze box died it was always getting infested and crashing.

Just bought a second laptop the other week. (from craigslist).

[jveritas]

TC,

Thanks for the info, I will call them and see what will happen.

[jveritas]

I did increase the RAM memory on my new laptop but Vista is simply unfriendly and silly.

[CheyennePress]

>>>but a lot of it came down to “You have to BUY the Vista version of the app...”, speaking of forcing upgrades, “as 2006 and earlier versions are not supported...”<<<

I have a feeling Microsoft took aim at people like me still running Word 97.

I see no reason to upgrade at all. It works just fine for me and my needs as is.

[Jo Nuvark]

Yes.
I installed a new XP hard drive.
Didn’t need a repair CD.

[federal]

bookmark

[dangerdoc]

I’m running Word 97 on Vista at home.

[Calvin Locke]

On XP, I still run Word97, but only as a convenience for printing out envelopes. I've migrated almost completely to OO, and intend to eliminate as much M$ garbage as possible, as hardware dies, and just move completely to the Penguin.

Games, and some sw I've invested in (and aforementioned hw) still keep me chained to XP.

[Slump Tester]

I'll bet you could run your Cakewalk in a Virtual PC. I've not went to Vista yet either, but I had fun using Virtual PC to run 98se and WFW on my P4. They flew.

[JerseyHighlander]

This was a direct response to the mublocker hacking group’s crack of every Windows Update, including the update here that is the problem.

It’s technically illegal to link to mublocker, so you will have to find it elsewhere.

You can go through the steps:

One possible fix is to install an older version of the Windows Update files (downloadable from Step 2 of Microsoft Knowledge Base article 927891) over the newer version. This involves launching the installer from a command line using a switch known as /wuforce.

Then use mublocker from there. MuBlocker spoofs Windows Update authentication, saved me when I was one of the few million customers who were blocked from using Windows Update because of Microsoft windows xp license key database problems.

[Grammy]

"Not entirely, the record companies like it.

The record companies may like it but music business people hate it. The fact that he couldn't get a computer with anything but Vista made Mr G go mac..... which he runs XP on.