IE 11 fails to update with KB2909921

[taponick]

I'm running Win7 64 SP1 on a 'standard' workstation setup. KB2909921 (cumulative security update for IE11 for wins for x64 based systems) fails to update. It succeeds on the first install pass then reverts the changes about 80% into the post reboot pass, then restarts the computer. The resulting error is 80073AA2.
All windows updates other than KB2909921 update perfectly.

I've worked on this pretty hard. I ran all the Microsoft fixits, the SUR and SFC tools, deleted the contents of the \software distribution\Data Store folders as directed on technet, reset windows update and deleted the update history.

I then did a very thorough scrub of the machine with the guys at the Malwarebytes help forum - three days worth of scrubbing - and came up mostly clean - a few tracking cookies, etc. They're quite sure I'm virus and malware free.

Then I redid all of the microsoft fixits, tools, resets and folder cleanouts as directed, and the update still reverts on reboot. All of the other recent updates work fine, though none are 'cumulative security' updates.

SFC runs with no errors -100% file integrity.
SURTool also shows no errors, zipped log attached.

So then I read the Windows update.log and the CBS.log carefully and noticed that I was getting errors like

Failed to get session package state for package: Package_3_for_KB2872339.......[HRESULT = 0x80070490 - ERROR_NOT_FOUND]

Leading to three errors of the form
2014-02-28 19:59:36, Error CSI 00000003 (F) Logged @2014/3/1:00:59:36.306 :
[ml:170{85},l:168{84}]"WmiCmiPlugin wevtcfg.cpp(2258): InstrumentationManifestAssert failed. HR=0x80073aa2."

I checked out the web on these error and found no really straight answers.

The offending updates leading to the 80070490 errors are
Update Installed type
KB2872339 9/12/2013 security
KB2904266 12/11/2013 windows
KB2563227 08/14/2011 windows
KB2839894 06/13/2013 security
KB2560656 08/14/2011 security
and I think this list is complete.

Now I saw a couple of posts where problems of this nature were cured by uninstalling the offending updates. I could try this - I can see clearly where they are in my control panel/programs and features/installed updates, and I could easily try uninstalling them and just see what happens.

But some of these updates have been on the machine since August 2011, so I fear that uprooting them may get the auto-updater even more tightly wrapped around its axle than it is.
I thought I would seek some wisdom here before I proceeded.

I could just try a restore in place, but then I wouldn't learn anything, and even this might not work.
Can anyone help out here???

Tony

Attached: Zipfile with 1) CBS.log immediately after a failed update attempt, and 2) CBS.log immediately after running the SUR Tool

 

[NoelDP]

You have errors in the first log that I've never even heard of, let alone seen!
The second is OK.
However - that's not what we need to see.

Please follow the Windows Update Posting Instructions and post all the requested data

 

[taponick]

You have errors in the first log that I've never even heard of, let alone seen!
The second is OK.
However - that's not what we need to see.

Please follow the Windows Update Posting Instructions and post all the requested data

OK -

1. Ran SURT - no errors
2. Ran SFC - no errors
3. Ran Win Update on KB2909921 - note that when changes revert you don't get the errors shown on the front page dialog - you have to go back in to history and right click on the failed item and look at details - here we get one error code = 80073AA2.
4. Copied and zipped the CBS.log immediately after running SURT and SFC - attached.

Hope you see something interesting!

Tony

 

[Layback Bear]

While we are waiting for Noel could you please list all the security programs you are using?

 

[taponick]

Running windows defender and MalwareBytes file system protection and website blocking.

Problem persists with these shut down.

 

[taponick]

Sorry for the bump on this post, but I was kind of wondering - do I have an impossible problem here?

 

[NoelDP]

Sorry about that!

There are no signs of problems in your CBS.log file - or the included SFC scan data.

Please post the CheckSUR.log file (C:\Windows\Logs\CBS\CheckSUR.log)

 

[taponick]

Thx Noel -

I attach the CheckSUR and Persist logs. These look clean too.

Yet the problem persists - I can't update IE 11 with the cumulative security update KB2909921, nor can I remove the IE 11 update and go back to IE 10. The system consistently 'reverts changes' upon reboot.

 

[NoelDP]

Yep - CheckSUR is also clean.
Please post the current C:\Windows\windowsupdate.log file - it may show something

 

[taponick]

I ran a fresh failed IE 11 update attempt, copied the log immediately - it's attached.

 

[NoelDP]

The only thing that the WU log shows is that it's repeatedly attempted to install the following update -
Cumulative Security Update for Internet Explorer 11 for Windows 7 for x64-based Systems (KB2909921), and that the install is actually refused by the user at shutdown.

2014-03-09 20:52:27:511  336 8b4 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
2014-03-09 20:52:27:511  336 8b4 Agent *********
2014-03-09 20:52:27:511  336 8b4 Agent   * Online = No; Ignore download priority = No
2014-03-09 20:52:27:511  336 8b4 Agent   * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
2014-03-09 20:52:27:511  336 8b4 Agent   * ServiceID = {7971F918-A847-4430-9279-4A52D1EFE18D} Third party service
2014-03-09 20:52:27:511  336 8b4 Agent   * Search Scope = {Machine}
2014-03-09 20:52:29:311  336 5a0 AU AU received handle event
2014-03-09 20:52:42:509  336 5a0 AU Launched new AU client for directive 'Reboot Pending', session id = 0x1
2014-03-09 20:52:42:569  336 5a0 AU AU received handle event
2014-03-09 20:52:44:745  336 5a0 [B]Shutdwn user declined update at shutdown[/B]
2014-03-09 20:52:44:745  336 5a0 AU Successfully wrote event for AU health state:0
2014-03-09 20:52:44:745  336 5a0 AU AU initiates service shutdown

Try using a Clean Boot process and installing the update that way..
How to perform a clean boot in Windows

 

[taponick]

Did a clean boot - same problem.

Did another clean boot, this time looking for a way to NOT decline the update, and I didn't find anything.

Clean boot doesn't help.

What I don't understand is: How could I decline the update if I wanted to? Where is this option offered? I never knowingly declined any updates.

What is interesting is that you've isolated the problem. I never knew that the user decline was a real error because I never saw a log without it!

 

[NoelDP]

It sounds like this could be due to some kind of a setting somewhere - perhaps in the registry. Unfortunately I have no idea where

You say you're using 'website blocking' - who from? it's possible that there's something there that is triggering the cancel, possibly by preventing internal links.
Is it just a simple HOSTS file, or something more complex?

Let's check something - please run the following commands in an Elevated Command Prompt, and post the results.

NET START TRUSTEDINSTALLER
SC QC TRUSTEDINSTALLER
SC QUERYEX TRUSTEDINSTALLER


Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[taponick]

OK - here's the command prompt record:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>Net start trustedinstaller
The Windows Modules Installer service is starting.
The Windows Modules Installer service was started successfully.

C:\Windows\system32>sc qc trustedinstaller
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: trustedinstaller
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\servicing\TrustedInstaller.exe
LOAD_ORDER_GROUP : ProfSvc_Group
TAG : 0
DISPLAY_NAME : Windows Modules Installer
DEPENDENCIES :
SERVICE_START_NAME : localSystem
C:\Windows\system32>sc queryex trustedinstaller
SERVICE_NAME: trustedinstaller
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 3524
FLAGS :
C:\Windows\system32>

 

[taponick]

By the way: I don't knowingly have any website blocking set up, and I don't *think* I said that I do.

 

[NoelDP]

Post #5

Running windows defender and MalwareBytes file system protection and website blocking.

Presumably it's just part of MBAM you were referring to?

all the above output is normal.

I'll have to do some thinking about this

 

[taponick]

Ooops - sorry - MBAM and Windows Defender are indeed running, but the problem occurs whether they are or not.

 

[taponick]

Just for drills, I set Windows Update to "Update Automatically" at a fixed time, then shut down. At this point, auto updating kicks in, whatever time you've set. I figured that maybe this time, windows itself would be the 'user', and maybe it wouldn't decline the update.

Wrong - update failed.

But there was an additional line in the WUpdate.log, different from the one you listed above.

Maybe this is a clue?

==================
2014-03-10 08:52:51:034 940 fac AU Launched new AU client for directive 'Download Approval', session id = 0x1
2014-03-10 08:58:33:971 940 fac AU AU received handle event
2014-03-10 08:58:33:971 940 fac AU AU setting pending client directive to 'Download Approval'
2014-03-10 08:58:37:133 940 fac Shutdwn user declined update at shutdown
2014-03-10 08:58:37:133 940 fac AU Successfully wrote event for AU health state:0
2014-03-10 08:58:37:133 940 fac AU AU initiates service shutdown
2014-03-10 08:58:37:133 940 fac AU ########### AU: Uninitializing Automatic Updates ###########
2014-03-10 08:58:37:164 940 fac Report CWERReporter finishing event handling. (00000000)
2014-03-10 08:58:37:211 940 fac Service *********
2014-03-10 08:58:37:211 940 fac Service ** END ** Service: Service exit [Exit code = 0x240001]
2014-03-10 08:58:37:211 940 fac Service *************

 

[taponick]

Well, just to close this one out, let it be known that I finally gave up and did a repair in place which fixed the problem - I now have IE 10 installed and fully updated and did NOT install IE 11 - I was chicken.

We'll never know what I did to make IE 11 immutable (no update, no uninstall) in the old setup. Probably some tangling in the intricacies of windows update, almost certainly not caused by malware or virus, but what made it happen will remain a mystery.

 

[NoelDP]

Sometimes, it's better not to know

Thanks for coming back to tell us.

Good luck with it!