IE 11 fails to update with KB2909921

NoelDP · 10 Mar 2014

The only thing that the WU log shows is that it's repeatedly attempted to install the following update -
Cumulative Security Update for Internet Explorer 11 for Windows 7 for x64-based Systems (KB2909921), and that the install is actually refused by the user at shutdown.

Code:

2014-03-09 20:52:27:511  336 8b4 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
2014-03-09 20:52:27:511  336 8b4 Agent *********
2014-03-09 20:52:27:511  336 8b4 Agent   * Online = No; Ignore download priority = No
2014-03-09 20:52:27:511  336 8b4 Agent   * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
2014-03-09 20:52:27:511  336 8b4 Agent   * ServiceID = {7971F918-A847-4430-9279-4A52D1EFE18D} Third party service
2014-03-09 20:52:27:511  336 8b4 Agent   * Search Scope = {Machine}
2014-03-09 20:52:29:311  336 5a0 AU AU received handle event
2014-03-09 20:52:42:509  336 5a0 AU Launched new AU client for directive 'Reboot Pending', session id = 0x1
2014-03-09 20:52:42:569  336 5a0 AU AU received handle event
2014-03-09 20:52:44:745  336 5a0 Shutdwn user declined update at shutdown
2014-03-09 20:52:44:745  336 5a0 AU Successfully wrote event for AU health state:0
2014-03-09 20:52:44:745  336 5a0 AU AU initiates service shutdown

Try using a Clean Boot process and installing the update that way..
How to perform a clean boot in Windows

taponick · 10 Mar 2014

Did a clean boot - same problem.

Did another clean boot, this time looking for a way to NOT decline the update, and I didn't find anything.

Clean boot doesn't help.

What I don't understand is: How could I decline the update if I wanted to? Where is this option offered? I never knowingly declined any updates.

What is interesting is that you've isolated the problem. I never knew that the user decline was a real error because I never saw a log without it!

NoelDP · 10 Mar 2014

It sounds like this could be due to some kind of a setting somewhere - perhaps in the registry. Unfortunately I have no idea where

You say you're using 'website blocking' - who from? it's possible that there's something there that is triggering the cancel, possibly by preventing internal links.
Is it just a simple HOSTS file, or something more complex?

Let's check something - please run the following commands in an Elevated Command Prompt, and post the results.

NET START TRUSTEDINSTALLER
SC QC TRUSTEDINSTALLER
SC QUERYEX TRUSTEDINSTALLER

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

taponick · 10 Mar 2014

OK - here's the command prompt record:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>Net start trustedinstaller
The Windows Modules Installer service is starting.
The Windows Modules Installer service was started successfully.

C:\Windows\system32>sc qc trustedinstaller
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: trustedinstaller
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\servicing\TrustedInstaller.exe
LOAD_ORDER_GROUP : ProfSvc_Group
TAG : 0
DISPLAY_NAME : Windows Modules Installer
DEPENDENCIES :
SERVICE_START_NAME : localSystem
C:\Windows\system32>sc queryex trustedinstaller
SERVICE_NAME: trustedinstaller
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 3524
FLAGS :
C:\Windows\system32>

taponick · 10 Mar 2014

By the way: I don't knowingly have any website blocking set up, and I don't *think* I said that I do.

NoelDP · 10 Mar 2014

Post #5

Running windows defender and MalwareBytes file system protection and website blocking.

:)
Presumably it's just part of MBAM you were referring to?

all the above output is normal.

I'll have to do some thinking about this

taponick · 10 Mar 2014

Ooops - sorry - MBAM and Windows Defender are indeed running, but the problem occurs whether they are or not.

taponick · 10 Mar 2014

Just for drills, I set Windows Update to "Update Automatically" at a fixed time, then shut down. At this point, auto updating kicks in, whatever time you've set. I figured that maybe this time, windows itself would be the 'user', and maybe it wouldn't decline the update.

Wrong - update failed.

But there was an additional line in the WUpdate.log, different from the one you listed above.

Maybe this is a clue?

==================
2014-03-10 08:52:51:034 940 fac AU Launched new AU client for directive 'Download Approval', session id = 0x1
2014-03-10 08:58:33:971 940 fac AU AU received handle event
2014-03-10 08:58:33:971 940 fac AU AU setting pending client directive to 'Download Approval'
2014-03-10 08:58:37:133 940 fac Shutdwn user declined update at shutdown
2014-03-10 08:58:37:133 940 fac AU Successfully wrote event for AU health state:0
2014-03-10 08:58:37:133 940 fac AU AU initiates service shutdown
2014-03-10 08:58:37:133 940 fac AU ########### AU: Uninitializing Automatic Updates ###########
2014-03-10 08:58:37:164 940 fac Report CWERReporter finishing event handling. (00000000)
2014-03-10 08:58:37:211 940 fac Service *********
2014-03-10 08:58:37:211 940 fac Service ** END ** Service: Service exit [Exit code = 0x240001]
2014-03-10 08:58:37:211 940 fac Service *************

taponick · 13 Mar 2014

Well, just to close this one out, let it be known that I finally gave up and did a repair in place which fixed the problem - I now have IE 10 installed and fully updated and did NOT install IE 11 - I was chicken.

We'll never know what I did to make IE 11 immutable (no update, no uninstall) in the old setup. Probably some tangling in the intricacies of windows update, almost certainly not caused by malware or virus, but what made it happen will remain a mystery.

NoelDP · 14 Mar 2014

Sometimes, it's better not to know :)

Thanks for coming back to tell us.

Good luck with it!