Windows 7 Cannot Install Windows 7 Updates

[Keith Balanis]

I have about 12 updates that are taking way too long to install. Right now they're at 65%, tomorrow they might be at 68%, or even 72%. But the point is that they never completely install. Normally I shut my computer off at the end of the work day but nothing updates before the computer shuts all the way down. Last night I kept the computer on all night while trying to install updates and I ended up getting an error message saying that they couldn't install because of missing components, but it didn't mention what was missing. I believe that I might be missing some .dll files. I HAVE had success installing a couple Microsoft Office updates but, when it comes to Windows updates, they never happen. I've tried the Microsoft Fix-It and the System Update Readiness Tool but neither of those things worked. Usually the error code that I get is 0x80010108 if that helps at all. I did have a virus that I ended up removing, and I'm sure that's what caused the problem. If you need the name of that virus I can find it out for you. Also, if you need the WindowsUpdate.log, please let me know. Thank you for the help.

 

[Saltgrass]

Are you running any Anti-virus or firewall programs that are not Microsoft. If so you might try turning off Real Time Checking and any operations that might take place during a reboot, like Rootkit discovery.

Go ahead an send the logs either by zipping and attaching here using the paperclip or directly to me. I will check to see if I can find something that may be relevant.

Make sure you add the Checksur.log mentioned in the Update Readiness tool.

Some of the language updates do take a long time, but not overnight.

The 80010108 error seems to be a RPC_E_Disconnected. Checking the net for that message may help, or something may be in the log. Perhaps one of your RPC (Remote Procedure Call) services is not running. The best place to check is using the services.msc utility. Mine shows Remote Procedure Call (RPC) running and started automatically, but RPC locator not running and started manually.

Edit: It might also be good to run a system file check. Open an Administrative Command Prompt and type the following and enter after.

SFC /scannow

Let it finish, and if it shows any unrepairable files, let us know.

 

[Keith Balanis]

I've had McAfee and MSE installed for a while now and never had any problems before so I don't think it's the firewall or virus problem. I checked my RPC services and I actually had the RPC Locator started and set to manual while the Remote Procedure Call (RPC) was stopped, so I started that and stopped the RPC Locator. Nothing seems to have changed as far as updates downloading though. I've already done an SFC a couple times and it never found any unrepaired files, but I can do another one and let you know if it finds anything. Where do I find the CheckSUR.log though? I did a search on my C drive but I didn't find it, should I run the Update Readiness Tool again?

I couldn't upload a .log file so I copied it into a .txt file and attached it.

 

[Saltgrass]

I will check your log, perhaps the RPC changes will help, or at least cause some change in the log because of the change.

When you attach further versions of the log, just copy the newer parts for the days at the bottom and just make them a text file, so the file won't be so large. And I would like to see the end of the log showing updated info after it has had a couple of update trials.

Look here for the other log. If it finished, it should leave a log.
C: \Windows \Logs\CBS\CheckSUR.log

 

[Saltgrass]

From the errors I am seeing in the log, I would have to guess something is blocking some type of access. Most of the AutomaticUpdates entries state they are not online when the attempt is made. This access problem may not just be online, but access to some folders/files on your system. Hard to tell if one problem is leading to another.

Do you know for a fact your internet is on when you are trying to do updates? Are you showing any error or warning messages in the Event Viewer that might be persistent?

Are you running both McAfee and MSE at the current time? If not, did you use any special process to remove McAfee?

How long ago did you remove the virus, and which one was it? It the problem occurred during this time, it might take Windows Update a few days to repair itself.

You are shutting your system all the way down on occasion?

I am currently trying to tell if you might need to update one of the Update services.

 

[Keith Balanis]

-My internet is always on, we're on a T1 line that's never shut down.

-Yes, I'm running both McAfee and MSE at the same time. I tried unchecking the "real-time protection" for MSE to see if that worked but it didn't.

-I had to go to my Event Viewer to see when, and what, was found during my scan. I went all the way back to July 20th and it seems that MSE found more than one, here they are:

Exploit:Java/CVE-2010-0840.DR
TrojanDownloader:HTML/Renos
Exploit:JS/Mult.DU
TrojanDownloader:Win32/Ponmocup.A

As far as shutting my system down, yes I do shut it down every night before I go home. Because of the updates not installing and "hanging", the computer doesn't fully shut down for at least an hour. Usually when I restart my computer the next day, no updates had been installed.

Here is the CheckSUR.log, I don't think it'll help since it doesn't show that it found anything.

Also, does the Windows Modules Installer service need to be started? When I checked, it was stopped and set to manual. I started it and set it to Automatic start, is that right?

 

[Saltgrass]

The CheckSur.log says not problems were found. But I am not sure if it actually checks the connection, or components necessary on your system for Windows Update to work.

Is the RPCSS service still running? Hopefully it is and maybe that is what is keeping normal communication from occurring. If it stops again, you can right click on it and look at the dependencies where you might see other components that need to be running for it to continue to work.

I will have to look through those viruses, I was hoping some uninstall process for them might lead to an answer.

Before you go home, try to copy the new entries in the WindowsUpdate.log and attach them.

 

[Saltgrass]

I found a couple of references for the viruses you had. At least two refer to Java and recommending as part of the cleanup to remove older version and reinstall.

Another one speaks of system changes that might be effected (hosts file) and what you might check to help clean the system.

If you have seen these on the Microsoft site, then don't bother, but here are two of the references.

Encyclopedia entry: Exploit:Java/CVE-2010-0840.DR - Learn more about malware - Microsoft Malware Protection Center

Encyclopedia entry: TrojanDownloader:Win32/Ponmocup.A - Learn more about malware - Microsoft Malware Protection Center

 

[Keith Balanis]

Here's the update log from around 12pm to about 4:20pm. The RPCSS service IS still running for your information.

 

[Medico]

Most experts agree that you should NOT have 2 AV apps running in real time at the same time. They tend to interfere with each other. I would use the Link Removedand uninstall McAfee (they have really taken a beating recently) and just use MSE. MSE has a very good reputation and uses very few resources.

 

[Keith Balanis]

I'm pretty sure I cannot uninstall McAfee as this is a work computer and McAfee is installed on everyone's computer at the office. I can uninstall MSE however since Windows 7 has Defender still. Should I do that?

 

[Saltgrass]

Since you are back at work, I was hoping the RPCSS situation would help your updates...

The fact that RPCSS was turned off is a little troublesome. Since it is fairly necessary to the OS, what might have turned it off? Could it have been the virus or the repair because of the virus? But what bothers me now is if RPCSS was off, is something else off and adding to problems. If you are at work, I suppose you could compare the Services to see if they match others. But they may not be exact if one system has installed something, like a wireless printer, that might need some services started automatically that other systems might not.

 

[Keith Balanis]

I was able to install 2 updates. One of them installed while my computer was shutting down on Friday and another one installed as I restarted my computer this morning. I suppose the virus could have shut the service off, what I can do is ask a coworker to do a screenshot of his services. He's in the same department as I am so I know he's got nothing extra installed so the services should be pretty close to the same.

I checked my coworkers' services and there were a couple things that he had started and that I didn't. I started these services but nothing seems to have changed. I'm not familiar with all the services and what they do but I'm pretty sure every service that is involved with updating is started at this point.

Should the Windows Modules Installer be started? Mine was started but my coworker's wasn't.

 

[Saltgrass]

The Windows Modules Installer (Trusted Installer) is set to a manual start. I just tried mine, and when I ran an SFC, it started (must refresh the services view to see).

It is also important as to which updates are working and which ones are not. It seems the Microsoft Security Essentials updates work well, but the Windows 7 updates may still be messed up. Different clients handle different updates, which is why I ask for an WindowsUpdate.log so I can check.

I am still learning what to look for in the logs, but I know a lot more now than I did a few months ago... Hopefully your system will recover over the next few days, but please post the new log entries every now and then.

 

[Keith Balanis]

My MSE updates don't update automatically, I have to d/l the latest definitions and install them that way. It seems that the percentage of complete goes up at least 1% every day. Obviously that's very slow but it's better than no change I guess. Here is the log for the past 2 days, thank you for your help.

How long should it take for it to recover? I've had this issue for over a month, I would think that it should have recovered by now. Or are you saying that it might take a few days for it to recover now that the RPCSS service is back on?

 

[Saltgrass]

It looks like the following update has downloaded and set to install at 3 p.m., unless you go ahead and install now. This update has been shown for several days on your logs, so maybe something is moving. But I had hoped to see more activity without the error messages. Make sure if the Sleep/shutdown button says to shutdown that you do so to complete these installs, if it gets that far.

Security Update for Windows 7 for x64-based Systems (KB2560656)

 

[Keith Balanis]

I've had no luck trying to install updates manually so I'm just going to wait to see if it updates at 3 pm. There's something that I noticed while looking through the Event Viewer. In the GroupPolicy section, I kept coming across Errors with error codes 0x77F, 0x6BA, and 0x54B. I don't know if this could have something to do with the updates not going through or not. But I figured I would let you know about this.


So you know: I didn't realize until now but earlier today I successfully installed the Windows Malicious Software Removal Tool. According to the history it updated at 8:02 am, which is right after I turned my computer on.

 

[Saltgrass]

For me it is a little hard to tell what error numbers mean, except the 6BA seems to refer to the RPC and the 77F seems to refer to some type of site error.

In event Viewer, if you double click the error, it might give you a more detailed explanation. There may also be an option to send the information to Microsoft to see if they have a solution.

Along the same line, if you left click the white flag in the tray, it might list known problems and give some more info. If not, go ahead and open the action center to see if anything there might be related.

You said this computer is in a work environment? If your updates come from a local server, perhaps it is involved. Is there a system manager? I know basically nothing about a work environment, but if you need to describe how the system is set up, someone else here probably will.

The one mention I see about the Update you seem to have installed is possibly it is KB2560656 and was first noticed on Sept 28th in your log. You have or had 11 or 12 updates waiting.

 

[Keith Balanis]

Somehow all my updates installed. This is basically a step-by-step of what happened...

-Decided to turn off the MSE service and see if I can d/l the updates.

-Individually attempted to download each update separately, when I clicked on the 6th update to d/l, I was able to get it to d/l and install.

-Restarted my computer as instructed and attempted to install the remaining 9 updates. They all installed with no problem. This is with the MSE service running now so I don't think having that service off had anything to do with it, maybe just a coincidence.

-Restarted again. Did an update on my MSE to see if it would work, it did.

-Did another search for updates, came up with 3. All of them for MS Office 2003.

-Tried to d/l and install the updates. All 3 failed with a 57E error code. I did manually install one of the updates through Microsoft but the other 2 didn't give me an option to d/l those files from the website. So now 2 MS Office updates are still pending. The WindowsUpdate.log says that they are scheduled to install Wed. the 5th at 8 am.


So I don't know if it's completely fixed, or if MSE had anything to do with the updates taking too long but I'll let you know if I have the same issues with the next batch of updates. I still have the issue with the last 2 updates, but maybe they will install tomorrow. The Update Log is attached.

UPDATE: I was able to manually install the other 2 updates so now everything is updated at the moment.

 

[Saltgrass]

The log does show 3 office updates failing to install. It is funny, but after each failure it states this is the first failed attempt.

The files are downloaded, but they are different from other updates and use a different utility to install them. Looks like, as you say, the Junk e-mail was install, or at least disappeared. The other two are still giving install failed errors. I suppose if you say the updates did complete, it is after the log.

You might want to stop the Office 2003 updates until you get you normal updates working. Or if the manual installs seem to work, do it that way rather than Windows Update doing them.