Solved PC won't start after installing windows update KB915597 today

[hwilker]

Windows update offered up an important update today KB915597 (Definition 1.149.884.0). I installed it. It did not require a restart but I needed to shut down for other reasons unrelated to the computer. Upon rebooting the computer wouldn't complete the startup procedure but hung at some point after the desktop appeared. The hourglass cursor was visible but the PC wouldn't respond to mouse clicks etc.

I rebooted several times to the same effect, so I started in safe mode and used the Windows Update restore point to remove this update. After doing that everything booted fine.

Are others running into problems installing this update or is it something specific to my system?

I'm running Windows 7 64 bit SP1

I'm attaching a CBS.zip file although the process encountered no issues and no Windows update errors were reported.

Thanks in advance,

hwilker

 

[NoelDP]

Windows Defender updates (KB915597) are ALWAYS 'Optional' - but installed by default.

Your CBS folder upload is missing the most important file - the CBS.log file which probably contains the results of the SFC scan.

Please copy the CBS.log file to your desktop, and the upload the copy on its own.

I have never heard of a WD definitions update crashing Windows - and I suspect that either your system is infected already, or you have other problems.

What Anti-Virus software is currently installed? - What other AV systems have EVER been installed??

 

[hwilker]

Windows Defender updates (KB915597) are ALWAYS 'Optional' - but installed by default.

Thanks for the reply!

I have Windows Update set to "Download updates but let me choose whether to install them". This update showed up as "important update is available". I always install updates that are listed as "important".

Your CBS folder upload is missing the most important file - the CBS.log file which probably contains the results of the SFC scan.

Please copy the CBS.log file to your desktop, and the upload the copy on its own.

Not sure how I missed it, but it is attached to this reply.

I have never heard of a WD definitions update crashing Windows - and I suspect that either your system is infected already, or you have other problems.

It didn't exactly "crash" Windows. It ran after it was installed. A little later I had to turn off the computer. When I rebooted about half an hour later, it booted to the desktop but wouldn't complete the startup process. The desktop was there and everything looked fine, but the hourglass cursor was displayed and nothing could be invoked by clicking on it or by keyboard. Ctrl-Alt-Del was not operational. Rebooting in Safe Mode and uninstalling the update, corrected the problem.

What Anti-Virus software is currently installed? - What other AV systems have EVER been installed??

Kaspersky Pure is the only AV software installed. There's never been any other AV software active on the computer, although there have been a few version upgrades to Kaspersky since I first installed it. I'm not using Security Essentials and Windows Firewall is off. I use my own hardware router/firewall. It's always conceivable that I have a virus, but I'm always very careful and run a full scan twice a week automatically. Kaspersky has always protected me well and it shows no problems. Windows Defender also reports no problems. I check grc.com periodically. It always reports that my router is secure and properly configured.

Again, thanks for helping. Let me know if you require anything further.

 

[NoelDP]

With Kaspersky installed, it should have disabled Windows Defender, so it shouldn't be getting any updates at all.


Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

The SFC results appear to have rolled off into the latest Persist cab file - please post that.

 

[hwilker]

NoelDP,

I think I've managed to get myself pretty confused. somehow the definition (Definition 1.149.884.0) now shows in my update history as being installed. Another one came along today (Definition 1.149.1143.0) and when installed the same thing happened.

Plus I think I've gotten confused between restore points.

I figured it best to start again, using your major point - that Windows Defender shouldn't be needed if Kaspersky is running. I've disabled it and, as you suggested, Windows Update is no longer telling me to install the new definitions file.

I've attached the FSS.txt file you requested, after disabling Windows Defender.

Also, I wasn't sure what you meant by "The SFC results appear to have rolled off into the latest Persist cab file - please post that." so I reran the SURT process and have attached the zip of the whole folder after that process. I've checked and made sure that all the files currrently in the CBS folder are in the zip

I'm also posting a screen capture of my update history from windows update, since I'm confused that my restores seem to have left in place the definitions that I thought I was removing by restoring the previous state.

I realize this may now be a moving target in terms of establishing a clear history and therefore more difficult to debug. It seems to me that, unless the attached diagnostic files show something jumping out at you that is screwing up, we wait and see what transpires now that Windows Defender is no longer in play and Windows Updates does not seem to be asking for me to install any Windows Defenders definitions updates.

I do appreciate your help with this. Thank you.

 

[NoelDP]

The FSS and CBS results are pretty much as expected.
Having said that, the WinDefend service is set to 'Demand' rather than 'Disabled' - which I would have thought was the 'normal' value with KIS installed.
What other Anti-virus programs have EVER been installed on this machine?

 

[hwilker]

None, except earlier versions of Kaspersky, and I never manually activated Defender. I wasn't even really sure what it did. Just dutifully installed the updates that Windows Update "told" me were "important". I can't speak to the fact that it's status is set to "Demand" rather than "Disabled". I just turned it off and it did what it did.

I do see that under Services from the Computer Management "Services" list Windows Defender shows as not started (blank) and as Startup Type of "Manual" (image attached).


Thanks.

 

[NoelDP]

I'd change its startup type to Disabled, I think.
Windows Defender is the early incarnation of MS's anti-spyware tool (NOT an AV), and by default, it would be set to Automatic, until a third-party AV such as Kaspersky is installed, which is supposed to disable it to prevent clashes and crashes.

With Defender on Manual, that would explain why you're still getting calls for updates to it - which usually happen on a near-daily basis.

 

[hwilker]

Ok. I've done that. Let's see what happens. Do understand though that, I have no idea what it was set to during the time I was having this problem. The setting of "Manual" is from after I disabled Windows Defender. When I disabled it, there was a Windows Defender update waiting in Windows Update for me to install. When I disabled Windows Defender, it immediately disappeared from Windows Update.

Still I agree, setting the service to "Disabled" is worth a try to keep these from coming back. Let's see what happens going forward.

Thanks for your help.

 

[NoelDP]

IF in any doubt, the best thing would probably be to uninstall KIS, run their cleanup tool and reset Defender to Automatic, then re-install KIS (or MSE), and see what happens.

 

[hwilker]

IF in any doubt, the best thing would probably be to uninstall KIS, run their cleanup tool and reset Defender to Automatic, then re-install KIS (or MSE), and see what happens.

I know it's been a bit but I just wanted to report back. After a lot of testing and further investigation, I no longer think either Defender or Kaspersky was the cause of the problem. The system continues to hang intermittently on reboot. Maybe one time out of three.

Today, I think I discovered the problem - Driver problems with my HP Printer. I noticed the following in the event viewer log:

The driver \Driver\WUDFRd failed to load for the device WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_HP&PROD_PHOTOSMART_C4700&REV_1.00#7&36C8BFAC&0&CN08JM20F105J7&0#.

I uninstalled the printer drivers and re-installed it. As it's an intermittent problem I'm not sure I've found the cause, but I rebooted two or three times after this without incident.

Time will tell.

Thanks for you help.

 

[Layback Bear]

If I may; I would check if Windows Defender stay off. Check a couple time a day for a little while.
Start Orb and type Defender and tick on Windows Defender.

View attachment 267823

I will go back to watching.
Happy computing.