Windows Update results in no internet access icon

[kainwolf]

I am having the perpetual problem with Windows Updates running and causing the yellow "no internet access" icon to appear. Browsers can go online ok and the machines can browse networks including connecting to remote VPNs (SonicWall) indicating that this is not a problem with the network connection; however, because of the "no internet access", Microsoft Office 2013 is showing offline (and won't activate).

The network driver (Intel 82567 LM-3) is now the most current from Intel's site.

Thus far, I have identified the problem when the following updates are applied (on a W7 32-bit installation):
2749655, 2756921, 2742599, 2736422, 2735855, 2797052, 2661254, 2677070, 2533552, 2552343, 2718704, 2790655, 2790113, and the following Office updates: 2752100, 2760624, 2760621, 2760350, 2760339, 2726996, 2737954, 2726954, 2737968, 2760244, 2767861, 2767852, 2767845, 2760318, 2752025, 2760512, 2760224.

I still have about 50 more updates to try on this particular installation.

Sometimes even leaving a previously known working machine and coming back to it a couple of weeks later will cause the "no internet access" flag to appear, even with no new updates. I have had to disable automatic updates for all Windows 7 machines (32 and 64 bit), including not having WSUS updates pushed to them.

Previously suggested solutions such as removing anti-virus (Trend Micro), updating the network card driver, or unplugging and reconnecting the network cable don't have any effect. Nor does uninstalling the offending update, or occasionally, even doing a system restore. The only way to avoid the problem is to image the machine with Clonezilla to prior to any windows updates, and install updates one at a time, avoiding the offending updates.

Does anyone have any further solutions or possibilities?

 

[NoelDP]

What security software is running?

 

[kainwolf]

The only "security" software running is Trend Micro OfficeScan, and IIRC that just does AV.

 

[NoelDP]

Please follow the http://www.sevenforums.com/windows-...4840-windows-update-posting-instructions.html on one of the affected machines, and post the results - it may give us some clues.

 

[kainwolf]

I've attached the CBS log files from both the x86 and x64 machines, as there are different issues with each (usually it's Office updates causing the problems).

In both instances, there are no errors when installing the updates, they install successfully, and it is only after a restart that the "No internet access" icon appears. Also, the "sfc /scannow" in both instances concludes with "Windows Resource Protection did not find any integrity violations."

 

[NoelDP]

32-bit
The problem seems to be this....

2013-02-15 13:09:28, Info                  CBS    Exec: DPX job state saved for one or more packages, aborting the staging and install of execution.
2013-02-15 13:09:28, Info                  CBS    Perf: Stage chain complete.
2013-02-15 13:09:28, Info                  CBS    Failed to stage execution chain. [HRESULT = 0x800f0816 - CBS_E_DPX_JOB_STATE_SAVED]
2013-02-15 13:09:28, Error                 CBS    Failed to process single phase execution. [HRESULT = 0x800f0816 - CBS_E_DPX_JOB_STATE_SAVED]
2013-02-15 13:09:28, Info                  CBS    WER: Failure is not worth reporting [HRESULT = 0x800f0816 - CBS_E_DPX_JOB_STATE_SAVED]

and seems to relate to KB2789645 and to KB2799494

It's not a problem I'm familiar with

64-bit

I can't see any clues in the CBS log at all.

In both cases, the CheckSUR log is clear of errors.

Perhaps the Event Viewer would be more informative - please Export the Windows Logs\Application and \System logs as evtx files, and attach them to a reply - I'll take a look tomorrow.

 

[kainwolf]

Sorry for the delay, I've been dealing with other issues, I'm sure you know what it's like.
I have the Event Viewer files attached. All 4 event logs are in the zip file.
Thanks again!

 

[NoelDP]

There are a number of errors in the x64 log....

The content source <csc://{S-1-5-21-3052727079-4066388812-728200547-1000}/> cannot be accessed.
Context: Application, SystemIndex Catalog
Details:
(HRESULT : 0x80004005) (0x80004005)

This is the GUI code for the initial User account - and suggest that the account is corrupted.
I would try creating a new administrator user account, and see if the problems persist there.

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. 
DETAIL - 
17 user registry handles leaked from \Registry\User\S-1-5-21-444295943-790164492-2447341002-4615:
Process 3196 (\Device\HarddiskVolume2\Users\kain\Downloads\PROWinx64.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615
Process 3196 (\Device\HarddiskVolume2\Users\kain\Downloads\PROWinx64.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software
Process 3196 (\Device\HarddiskVolume2\Users\kain\Downloads\PROWinx64.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software
Process 520 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software
Process 3196 (\Device\HarddiskVolume2\Users\kain\Downloads\PROWinx64.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Process 3196 (\Device\HarddiskVolume2\Users\kain\Downloads\PROWinx64.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Process 3196 (\Device\HarddiskVolume2\Users\kain\Downloads\PROWinx64.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
Process 520 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 520 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 3196 (\Device\HarddiskVolume2\Users\kain\Downloads\PROWinx64.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 520 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 3196 (\Device\HarddiskVolume2\Users\kain\Downloads\PROWinx64.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 3196 (\Device\HarddiskVolume2\Users\kain\Downloads\PROWinx64.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Policies
Process 3196 (\Device\HarddiskVolume2\Users\kain\Downloads\PROWinx64.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Policies
Process 520 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Policies
Process 520 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Microsoft\Internet Explorer\Main
Process 3196 (\Device\HarddiskVolume2\Users\kain\Downloads\PROWinx64.exe) has opened key \REGISTRY\USER\S-1-5-21-444295943-790164492-2447341002-4615\Software\Microsoft\Windows\CurrentVersion\Explorer

It's unusual to see the \Policies key referenced here - and also unusual to see something running direct from the Downloads folder.
I think that file is part of the Intel Wireless drivers installer?
Please check that it's not loading by default at boot.