Re: Cannot Install Updates

WHAT FILEMON SHOWS
------------------------------
> > Lines 6 and 7 of the desktop's log read:
> > * DoInstallation: CustomizeCall Failed: 0xb7
> > * Cannot create a file when that file already exists.
>
> Shouldn't FileMon show you an access here which does not happen
> in the clean install? Unless you already know which file this message
> is referring to but you're not telling us?

It might have -- but to be honest, the first time I started Filemon I was a
bit overwhelmed by the amount of output (about 60k lines) that was generated
by the KB885222 update process. So I changed the filter to just show log
errors and ran the process again. IIRC, that brought it down to about 4k
lines -- all errors. At that point, I noted all the specific error message
categories (e.g. Name Clashes, Buffer Overflows, etc.), and noted a few key
files/paths where they occurred, then compared that to the results from the
laptop install. But all the errors I thought might be relevant from the
desktop also occurred on the laptop. I did not however do a search for any
of the strings found in the text "DoInstallation: CustomizeCall Failed:
0xb7". I'll have to run the installs again and look for that. I haven't had
the opportunity though to set the laptop up right next to the desktop so I
can do side by side compares in Filemon. I did try saving the Filemon log
from the desktop, thinking I could get both logs on one machine and do a side
by side compare that way. But when I opened the saved log, it was very
difficult to read because of formatting -- or I should say, a lack of
formatting -- so I scrapped that idea. . I guess I’ll have to revisit that
if I can’t get the two machines side by side.

REGMON or FILEMON ?
-----------------------------
> > Lines 6 and 7 of the laptop's log read:
> > * In Function TestVolatileFlag, line 11660, RegOpenKeyEx failed with error
> > 0x2
> > * In Function TestVolatileFlag, line 11692, RegOpenKeyEx failed with error
> > 0x2
>
>
> That's interesting. This perhaps gives some hope that the /verbose
> option would differentiate what key is being accessed (attempted to be
> accessed) in each case. Alternatively, you could try running RegMon
> again with both a clean and problem install, trying to identify this difference.

Did you mean to try running it again with FileMon, or did you really mean
RegMon. If RegMon, I'll see what I can find on that.


SEARCHING for CHANGED FILES
---------------------------------------
> Did you miss the idea of "searching"? In XP I use Search Companion.
> However, in NT4 I would have used the equivalent File Find tool.

Yes and No -- but mostly Yes. ;-) I "searched" in the sense that I
browsed folders I thought might be relevant, but I had never looked into
using XP's search function to look only for changed files. I see now that
can be done (by date, but not by time), so that will help when I go through
this process again.

Also a question -- is "Search Companion" something different than the search
function available in XP from the "Start" menu?


> I have never used your OS but hopefully it has an equivalent tool?

I didn't quite follow that. I'm using XP SP2. I thought you were using XP
also.



FREQUENTLY ASKED QUESTIONS
----------------------------------------
Thanks for the link to the second question you referenced -- I'll take a
look. I'm just "starting" to learn my way around these sites and don't even
know what all is available yet -- so getting a URL is a big help. :-)


In CLOSING
----------------
I hope to get back at this soon, but have very little free time the next two
days and have out-of-state company coming this weekend. So it "might" be a
few days before I can make any more headway.

Thanks again for your help !!!
--
So much to learn... So little time.


"Robert Aldwinckle" wrote:

> "Roughneck" <Roughneck@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:5D34AE8C-0E45-449F-B193-F52B62ACA37E@xxxxxxxxxxxxxxxx
> > COMPARE THE LOGS
> > -------------------------------
> > As suggested, I compared the KB885222 log files from the laptop and desktop.
> > While it's easy to see where they begin to differ, there's nothing that
> > gives me a clue as to why they take a different path where they do. i.e.
> > They both start off the same and list the same instructions, processes, and
> > return codes for the first five lines -- then they differ.
> >
> > Lines 6 and 7 of the desktop's log read:
> > * DoInstallation: CustomizeCall Failed: 0xb7
> > * Cannot create a file when that file already exists.
>
> Shouldn't FileMon show you an access here which does not happen
> in the clean install? Unless you already know which file this message
> is referring to but you're not telling us?
>
>
> >
> > Lines 6 and 7 of the laptop's log read:
> > * In Function TestVolatileFlag, line 11660, RegOpenKeyEx failed with error
> > 0x2
> > * In Function TestVolatileFlag, line 11692, RegOpenKeyEx failed with error
> > 0x2
>
>
> That's interesting. This perhaps gives some hope that the /verbose
> option would differentiate what key is being accessed (attempted to be
> accessed) in each case. Alternatively, you could try running RegMon
> again with both a clean and problem install, trying to identify this difference.
> Of course if it turns out to be the same key but at different locations in the
> script you will be no further ahead on this tack. It would be nice to know
> what file "line 11660" is referring to. Then you could browse the damn
> thing and see exactly what each line would be doing. FileMon might
> help with that goal too, depending on your filter of course. For example,
> if you are running with the filter that I suggested which includes ;Update;
> and the program doing the install was called update.exe I expect that
> that you could be seeing all Reads that the program is doing such as
> whatever Reads are necessary to interpret the script. Etc.
>
>
> >
> > The desktop's log ends soon afterward (see the example in my initial post).
> > The laptop's log is much longer -- probably more than anyone would care to
> > read through, so I won't post it unless someone wants to see it. Bottom line
> > is, I can see where the two logs diverge, but don't know what to make of it.
> > :-(
>
>
> If you can't find the /verbose log post both regular install logs here inline
> or E-mail them to my reply address as attachments.
>
>
> >
> >
> > RUNNING the UPDATE with the /VERBOSE parm
> > -----------------------------------------------------------
> > Again, as suggested, I gave this a whirl and it ran fine (even showed up in
> > the KB885222 log file), but I haven't been able to determine what output, if
> > any, was generated. After running the update with this parm, I did browse
> > the root folder of my C: drive, as well as several windows folders with the
> > files arranged by date created, date modified, etc. -- but didn't see
> > anything I could identify as meaningful/useful.
>
>
> Did you miss the idea of "searching"? In XP I use Search Companion.
> However, in NT4 I would have used the equivalent File Find tool.
> Both allow you to specify you want to find all files which changed
> on a particular day and then sort the results by the Date Modified column.
> Doing that gives you a list in timestamp order (e.g. down to a minute)
> of files which were written that day. Hence any files which were written
> by the update should be grouped together within the small range of minutes
> that it took to run the update. I have never used your OS but hopefully
> it has an equivalent tool? Alternatively, you could use dir/a/od/s/tw *
> at your directory root and, depending on how your dates show, you could
> pipe that through a find filter to list just files which changed on that day
> and a sort filter to just limit your attention to the filenames which changed
> in that short period. E.g. if I was doing this today and since my date format
> is YYYY-MM-DD in a cmd window I would enter:
>
> <example>
> cd /d %SystemDrive%\
> dir/a/od/s/tw * | find "2005-08-11" | sort >chgfiles.txt
> notepad chgfiles.txt
> </example>
>
> In fact, since I probably would know at least the hour and perhaps
> even the tens digit of the minutes value as common factors
> for what I was really interested in I would probably make that find
> argument even more precise than just a specification of a particular
> day. Etc.
>
> Note that an advantage of the Search Companion/File Find
> technique is that you can sort by details without losing track
> of which directory the file comes from. With the dir/s approach
> the directory information would be lost by the find and the sort
> filters so you would have to do subsequent finds of some kind
> based on filename to find out where it was actually located.
>
>
> >
> >
> > RUNNING FILEMON during the UPDATE
> > -----------------------------------------------
> > Finally, as suggested, I found/installed Filemon and had that running during
> > the update attempt on the desktop. I found several error messages that I
> > thought might be relevant at first, so I uninstalled the update from the
> > laptop, installed Filemon there, and re-ran the update on the laptop while
> > Filemon was running. But on the laptop, I saw the same errors reported by
> > Filemon that I saw for the desktop -- so again, I wasn't able to identify
> > anything specific/unique to the failed attempt on the desktop.
> >
> >
> > OTHER THINGS I DID
> > ------------------------------
> > * Disabled the firewire controller, rebooted, ran the update.
> > RESULT -- NO CHANGE.
> > * Removed the PCI card with the firwire ports (eliminating the firewire
> > controller completely). Rebooted, ran the update.
> > RESULT -- NO CHANGE.
> > * Reinstalled the PCI card with the firewire ports (reinstalling the
> > firewire controller). Booted from a hard drive that I had cloned months ago
> > with Norton Ghost. Ran the update.
> > RESULT -- SUCCESS.
> >
> > So.... that tells me it's not a hardware related problem. I am wondering
> > about one thing though. When I ran Windows Update a week or so ago, the
> > update process told me I had to download a new/updated version of the Windows
> > Update software. After doing that, it checked my system to verify I had a
> > legit copy of Windows. It acknowleded I did, but said it detected changes to
> > my system configuration -- I don't remember the exact message, but I
> > understood it to mean hardware changes. It indicated this would not prevent
> > me from applying the updates available at the time, but that it "might" cause
> > problems in the future. There was no further explanation given.
>
>
> See WGA FAQ which Carey (e.g.) has been posting recently?
>
> <quote>
> Q: What is activation?
>
> A: Activation reduces piracy by associating your Windows Product Key
> —the 25-character security code located on your Certificate of Authenticity
> (usually affixed to your software package, PC, or laptop)
> —to a PC hardware key. Microsoft stores this information in a database
> so that no one else can use your Product Key on another PC.
>
>
> </quote>
>
> Hmm... That's less informative than it might be I think.
> Let's look at the Activation FAQ instead:
>
> http://www.microsoft.com/piracy/activation_faq.mspx
>
> (MSN search for
> activation site:microsoft.com
> )
>
> <quote>
> Can hardware components be changed and upgraded?
>
> Product Activation is able to tolerate a certain degree of change
> in a hardware configuration by allowing a current hash value
> to have a degree of difference from the hash value that was
> originally activated. As a result, users can change their hardware
> without the product believing it is on a different PC than the one
> it was activated on. If the user completely overhauls the hardware
> making substantial hardware changes (even over long periods of time),
> reactivation may be required. In that case, users may need to contact
> a Microsoft customer service representative by telephone to reactivate.
> </quote>
>
>
> > I'm still
> > able to run Windows Update and install the critical updates listed -- in
> > fact, I just did that again today. This KB885222 is the only download I'm
> > having (have ever had) trouble with. I don't know what to make of it. The
> > error messages given during the update attempt are worthless in the sense
> > they don't identify what file(s) the process is having trouble with. Ditto
> > for the update's log file, as far as I can tell. Very frustrating.
>
>
> Hang in there. I think you're getting closer to a clear diagnosis. <eg>
>
>
> HTH
>
> Robert
> ---
>
>
>
.

Relevant Pages

  • Re: Cannot Install Updates
    ... I compared the KB885222 log files from the laptop and desktop. ... Shouldn't FileMon show you an access here which does not happen ... that tells me it's not a hardware related problem. ... When I ran Windows Update a week or so ago, ...
    (microsoft.public.windowsupdate)
  • Re: Cannot Install Updates
    ... I compared the KB885222 log files from the laptop and desktop. ... RUNNING FILEMON during the UPDATE ... >>> same error messages as Drew when trying to install the update on my desktop ... >> with extraneous difference such as timestamps etc. edited out so the compare ...
    (microsoft.public.windowsupdate)
  • RE: User rights on Terminal Services
    ... I'm assuming you installed the application in "Install Mode"... ... Go to www.sysinternals.com and download regmon and filemon. ... User rights on Terminal Services ...
    (Focus-Microsoft)
  • Re: Administrator Help
    ... The process can be a little effort, when using the filemon ... ability to write in the install area on disk (and to destroy the ... the applications area in the registry, ... For finding these the regmon and filemon tools are a great ...
    (microsoft.public.security)
  • Re: Please recommend a newsreader that can d
    ... files nec to install some of the larger programs to a flash drive manually. ... I guess I'm going to have to also look up filemon, regmon, and mojopac, ... Filemon and regmon track access to the file system and Windows registry in ...
    (rec.gambling.poker)