CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 949
Comments: 28
block bottom
spacer spacer

[SERIOUS]XP Repair Woes

 
Post new topic   Reply to topic       All -> FavForums -> Windows NT/2000/2003/XP [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
Bill_Bright

General
General
Premium Member

Joined: Jan 16, 2004
Posts: 8963
Location: Nebraska, USA
MVP Premium

PostPosted: Thu Sep 27, 2007 1:20 pm    Post subject: XP Repair Woes
Reply with quote

Windows Secrets - Stealth Windows update prevents XP repair


_________________
image Bill, AFE7Ret
Freedom is NOT Free!

image
Back to top
View users profile Send private message
PCBruiser

SRT Team Lead
SRT Team Lead
Forums Admin

Joined: May 11, 2005
Posts: 11723

1st Responder Mentors 1st Responders Forums Admin MIRT Moderators Premium Rootkit Experts Security Experts SRT Team CC Committee

PostPosted: Thu Sep 27, 2007 5:16 pm    Post subject:
Reply with quote

Thanks for spotting this, Bill. I've put up some links to this topic in some Staff forums. This is really quite a critical issue, and with such a simple workaround, it is shocking that MS hasn't included it in a revised version of the patch, not good. Frankly, why those dlls weren't registered in the first place is a complete puzzle.


_________________
Don't read? Can't learn!
Back to top
View users profile Send private message
Mister2

SRT Team Lead
SRT Team Lead
Premium Member

Joined: Oct 28, 2004
Posts: 7294

Moderators MVP Premium SRT Team F@H

PostPosted: Thu Sep 27, 2007 6:35 pm    Post subject:
Reply with quote

Yes, Thanks Bill. Very Happy
That is quite unacceptable, but the article you linked to will save a lot of grief.


_________________
Never stop learning
Back to top
View users profile Send private message
Bill_Bright

General
General
Premium Member

Joined: Jan 16, 2004
Posts: 8963
Location: Nebraska, USA
MVP Premium

PostPosted: Thu Sep 27, 2007 8:46 pm    Post subject:
Reply with quote

PCB wrote:
and with such a simple workaround, it is shocking that MS hasn't included it in a revised version of the patch, not good.
Agreed.
Quote:
Frankly, why those dlls weren't registered in the first place is a complete puzzle.
And I really don't think these "mistakes" are intentional - I think it is a lack of peer-to-peer reviews, inadequate or no quality control/assurance policies, and no program management oversight. In other words, over all incompetent management! Mad What I don't get is with all the scrutiny they know they are under, why and how are these examples of incompetence still getting out? Registering the .dlls should be a simple checklist item for the developers, as well as whoever reviews their work (that is, if someone does review their work - Sad).

The stealth issue was bad enough, other than the fact that never should have happened, that is irrelevant now. It is likely the unregistered dlls would have gone out whether stealthed or not.
Mr2 wrote:
the article you linked to will save a lot of grief.
I hope but I already know of 1 case where the user, not knowing of this workaround, reformatted and reinstalled because repair failed. Of course, then he was YEARS behind in critical updates, security, etc.


_________________
image Bill, AFE7Ret
Freedom is NOT Free!

image
Back to top
View users profile Send private message
PCBruiser

SRT Team Lead
SRT Team Lead
Forums Admin

Joined: May 11, 2005
Posts: 11723

1st Responder Mentors 1st Responders Forums Admin MIRT Moderators Premium Rootkit Experts Security Experts SRT Team CC Committee

PostPosted: Thu Sep 27, 2007 10:05 pm    Post subject:
Reply with quote

I agree, there's no reason in the world why MS should do something like that intentionally. It wasn't malevolent. It was solely a programming and quality control issue, but the harm it can cause ...

The true "crime" is not fixing it immediately when they learned of the problem. That was someone's conscious decision.

BTW, I have "stuck" this topic, considering it's importance.


_________________
Don't read? Can't learn!
Back to top
View users profile Send private message
Prince_Serendip

Site Moderator


Joined: Sep 07, 2002
Posts: 17541

1st Responders MIRT Moderators MVP Premium RootKit Detection Hosts Rootkit Experts Rootkit Responders

PostPosted: Fri Sep 28, 2007 4:29 am    Post subject:
Reply with quote

I see MS has really stepped in it this time. I bookmarked that article for later reference as it has a manual fix for the problem. Thanks Bill. Very Happy


_________________
image
Microsoft MVP Consumer Security 2006, 2007 & 2008
Back to top
View users profile Send private message
tetak

MIRT Team Lead
Premium Member

Joined: Jan 19, 2007
Posts: 5800

MIRT Premium

PostPosted: Sat Sep 29, 2007 2:24 pm    Post subject:
Reply with quote

Fix from MS: http://support.microsoft.com/?kbid=943144


_________________
Got Windows XP? Help protect your PC from malware with Microsofts anti-spyware program Windows Defender.

Download it for free from http://www.microsoft.com/athome/security/spyware/software/default.mspx
Back to top
View users profile Send private message
Bill_Bright

General
General
Premium Member

Joined: Jan 16, 2004
Posts: 8963
Location: Nebraska, USA
MVP Premium

PostPosted: Sat Sep 29, 2007 7:03 pm    Post subject:
Reply with quote

Hmmm, it "appears" that KB addresses this problem, but the symptoms and causes don't exactly match up.

MS claims,

Quote:
This problem occurs because of how the Windows XP repair operation replaces Windows system files.
while Windows Secrets reports,
Quote:
The problem apparently arises because seven of the DLLs (dynamic link library files) used by WU fail to be registered with Windows. ... Registering DLL files is normally the role of an installer program.


I guess at this point we will have to wait for someone to stumble upon or recreate the problem, then see if the steps in that KB article fixes it.


_________________
image Bill, AFE7Ret
Freedom is NOT Free!

image
Back to top
View users profile Send private message
Dragan_Glas

Team CC Chief Host
Team CC Chief Host
Chess Board Host
Chess Board Host

Joined: May 27, 2004
Posts: 2904

Premium RootKit Detection Hosts Rootkit Responders SRT Team CC Committee

PostPosted: Mon Nov 05, 2007 12:53 am    Post subject:
Reply with quote

Greetings,

tetak wrote:
Fix from MS: http://support.microsoft.com/?kbid=943144

"Bill_Bright wrote:
I guess at this point we will have to wait for someone to stumble upon or recreate the problem, then see if the steps in that KB article fixes it.

There's a missing quote from the command in step 3 of Method 2 - if anyone attempts to follow it as is, it won't work.

Unless they know where the missing quote should be...

Kindest regards,

Dragan Glas


_________________
Quote:
The only secure computer is one that's unplugged, locked in a safe, and buried 20 feet under the ground in a secret location... and I'm not even too sure about that one
Dennis Hughes, FBI
Back to top
View users profile Send private message
Bill_Bright

General
General
Premium Member

Joined: Jan 16, 2004
Posts: 8963
Location: Nebraska, USA
MVP Premium

PostPosted: Mon Nov 05, 2007 3:43 am    Post subject:
Reply with quote

According to MowGreen here, it should be:

"C:\WindowsUpdateAgent30-x86.exe" /wuforce


_________________
image Bill, AFE7Ret
Freedom is NOT Free!

image
Back to top
View users profile Send private message
mrsugg

Special Response Team
Premium Member

Joined: Aug 15, 2006
Posts: 2756
Location: Somewhere, over the rainbow...
Premium SRT Team F@H

PostPosted: Fri Dec 14, 2007 12:35 am    Post subject:
Reply with quote

Is this still a problem? What kind of problems are users encountering due to the unregistered dlls, besides updates not working? Does everyone who does a reinstall need to do the "fix" as well?

Thanks


_________________
"We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness." -- Thomas Jefferson
Back to top
View users profile Send private message
Bill_Bright

General
General
Premium Member

Joined: Jan 16, 2004
Posts: 8963
Location: Nebraska, USA
MVP Premium

PostPosted: Fri Dec 14, 2007 5:01 am    Post subject:
Reply with quote

I think it has passed.


_________________
image Bill, AFE7Ret
Freedom is NOT Free!

image
Back to top
View users profile Send private message
grsamf

1st Responder
Site Moderator

Joined: Oct 08, 2006
Posts: 1275

1st Responders Moderators Premium

PostPosted: Sat Jan 05, 2008 3:40 am    Post subject:
Reply with quote

Looks like it hasn't passed completely. An OP in the HJT forum had to do an in-place reinstall. Over 80 updates would not install. I had him run the "Method 1" from MS (link in tetak's post above) and all updates installed smoothly.


_________________
How to be wise in two easy steps: 1) Think of something really stupid to say. 2) Don't say it.

The better I get to know my fellow lawyers, the more I love my dog.
Back to top
View users profile Send private message
mrsugg

Special Response Team
Premium Member

Joined: Aug 15, 2006
Posts: 2756
Location: Somewhere, over the rainbow...
Premium SRT Team F@H

PostPosted: Tue Jan 08, 2008 5:23 am    Post subject:
Reply with quote

It just happened to me also. The "Method #1" from the link above did the trick.


_________________
"We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness." -- Thomas Jefferson
Back to top
View users profile Send private message
Bill_Bright

General
General
Premium Member

Joined: Jan 16, 2004
Posts: 8963
Location: Nebraska, USA
MVP Premium

PostPosted: Tue Jan 08, 2008 12:36 pm    Post subject:
Reply with quote

Then it looks like this sticky should stick around a little longer! Glad you got it going, mrsugg.


_________________
image Bill, AFE7Ret
Freedom is NOT Free!

image
Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Windows NT/2000/2003/XP All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer