A silent update that Microsoft deployed widely in July and August is preventing the “repair” feature of Windows XP from completing successfully.

Ever since the Redmond company’s recent download of new support files for Windows Update, users of XP’s repair function have been unable to install the latest 80 patches from Microsoft.

Repaired installations of XP can’t be updated

The trouble occurs when users reinstall XP’s system files using the repair capability found on genuine XP CD-ROMs. (The feature is not present on “Restore CDs.”) The repair option, which is typically employed when XP for some reason becomes unbootable, rolls many aspects of XP back to a pristine state. It wipes out many updates and patches and sets Internet Explorer back to the version that originally shipped with the operating system. (more…)

automatic updates, internet explorer, microsoft, operating system, patches, redmond company, reinstall xp, repair capability, repair function, repair windows, system files, test machine, Windows, windows update site, xp

I am indebted to the excellent Windows Secrets website for news of an alarming development last August involving Windows XP and Vista silently installing executable files, even though users had disabled automatic updates. So fare nine files have been identified, there may be more, and whilst the files appear to be benign it does raise the very serious question about Microsoft loading programs on PCs without users knowledge or permission.

The file downloads occur when users select the ‘Let me choose when to install or notify me but don’t automatically download or install’ option in Security Centre. The revelation appears to have embarrassed Microsoft into issuing an explanation and guarded apology, which basically says that whilst deselecting Automatic Updates does indeed stop any new updates, it doesn’t stop Windows Update updating itself. (more…)

apology, automatic updates, executable files, microsoft, revelation, security centre, silently, Windows, windows update, windows updates

It’s important to note that there is no reason to remove or roll back the updated support files that Windows Update may have installed on a PC. There’s no evidence that these files are harmful or cause any software conflicts.

Furthermore, if you use a corporate patch management solution, such as Microsoft’s WSUS (Windows Server Update Services), you circumvent Windows Update and no files will be installed by WU.

But if you’re an individual or a small business using Windows Update (or its enhanced sibling, Microsoft Update), you may be concerned about Microsoft installing patches before you’ve had a chance to research their reliability. In that case, you can completely turn off the Automatic Updates Agent, thereby preventing updates or even notifications from occurring. (more…)

automatic updates, balloons, cause windows, computer, launch windows, microsoft patches, microsoft update, software conflicts, support files, taskbar tray, vista, Windows, windows update, wsus, xp

Just received the following that is related to the SVCHOST issues that I’ve written about in the past…

MS has released “Microsoft Security Advisory (927891) - Fix for Windows Installer (MSI)” that’s not really a direct security concern, but actually addresses concerns that might prevent people from getting critical security or other updates.

As previously mentioned, it involves MS KB 927891 - “You receive an access violation error and the system may appear to become unresponsive when you try to install an update from Windows Update or from Microsoft Update“, and the current revision of the article (8.0) states “This fix is one component of a two-part fix that includes a Windows Update client software update. These updates will be deployed automatically using Windows Update in May 2007 and June 2007.”

Again, this update is one of two that need to be applied to fully address the issue. The other update is version 3.0 of the Windows Update Client Software, available from MS KB 932494, “When you use Automatic Updates to scan for updates or to apply updates to applications that use Windows Installer, you experience issues that involve the Svchost.exe process“.

One can also hope that this will help address the 0×8ddd0009 problems that MANY have been experiencing…

»

Previously (here and here), I’ve written about isolating shared services so that they run in their own process, with a specific focus on the Windows Update Automatic Updates Service (wuauserv) that typically runs in the NETSVCS SVCHOST.EXE instance. One thing that can be done once this is accomplished is to lower the priority of the process so that when the service winds up consuming 100% of the CPU, the system doesn’t become unresponsive.

Since we’re dealing with a service, setting the priority of such a SVCHOST.EXE process can become problematic - the service may already be running, or, because it is a service, it is not started as non-service processes are, so one is not able to use START / [LOW NORMAL HIGH REALTIME ABOVENORMAL BELOWNORMAL] to impose a priority when the process starts. One can use a utility like Task Manager or Process Explorer to set the priority of a process on an ad hoc basis, but when the service restarts or the system reboots one has to remember to set the priority again.

Though not an ideal solution the following scripts (VBS using WMI, and PowerShell) can be used to set the priority of the SVCHOST.EXE instance hosting the isolated Windows Update Automatic Updates Service service to “below normal”. Note that no check is done to ensure that the SVCHOST.EXE instance is only hosting one service - if wuauserv is found to be a service inside of the process, the priority is adjusted. Note also that no error handling is implemented.

I’ll try to format the code so it looks nice, but I fear I will be limited…

Here’s the code for the VBS / WMI script:

Const BELOW_NORMAL = 16384Set objWMIService = GetObject(”winmgmts:\.rootCIMV2″)Set colServices = objWMIService.ExecQuery( _    “SELECT * FROM Win32_Service where name=’wuauserv’”)For Each oService in colServices    Set colProcesses = objWMIService.ExecQuery( _        “SELECT * FROM Win32_Process where ProcessId=” & oService.ProcessId )    For Each oProcess in colProcesses        oProcess.SetPriority(BELOW_NORMAL)    NextNext

Here’s the code for the PowerShell script:

(gps -id (get-wmiobject win32_service  where {$_.name -eq “wuauserv”}).ProcessId).PriorityClass=”BelowNormal”

The different values for the priority parameter of the SetPriority method of the Win32_Process WMI class can be found in the documentation for the SetPriority method.

The different values for the PriorityClass in the PowerShell script are “Normal”, “Idle”, “High”, “RealTime”, “BelowNormal”, or “AboveNormal”. Or, to get a list of the available options, one can use the following PowerShell command:

[ENUM]::getNames(”System.Diagnostics.ProcessPriorityClass”)

Once the script is in place and working, one can cause it to be invoked at will, or via scheduled task at specific times, or after logon, or any other way that one can get something to happen when Windows boots or a user logs on.

»

In the past, I’ve written about both high CPU utilization by SVCHOST.EXE as well as the 0×8ddd0009 Windows Update / Microsoft Update error, so I thought I would mention this…

MS KB 932494 (When you use Automatic Updates to scan for updates or to apply updates to applications that use Windows Installer, you experience issues that involve the Svchost.exe process) references problems that are addressed by MS KB 916089 (FIX: When you run Windows Update to scan for updates that use Windows Installer, including Office updates, CPU utilization may reach 100 percent for prolonged periods) and MS KB 927891 (You receive an access violation when you try to install an update from Windows Update after you apply hotfix package 916089). However, even after applying the patch associated with 927891 (which replaces the patch associated with 916089), 932494 indicates that the following problems remain:

1) Certain 100 percent CPU issues are still present when you use the Svchost.exe process.
2) An access violation may occur in the Svchost.exe process.

I (as well as others) have speculated in the past that 916089 (and its succedent patches) can also help with the 0×8ddd0009 error message that one might receive from Windows Update / Microsoft Update.

»