Failure to configure IE10 security update (KB2962872)

NoelDP · 25 Jul 2014

The file found by the system appears to still be the wrong version - it's one from IE9, rather than IE10.

This probably means that the files were actually place wrongly - let's do a couple of quick checks...

Open an Elevated Command Prompt, and run the following commands...

DIR C:\d15aa
DIR C:\Windows\Winsxs\d15aa

Post the results.

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

dynasty15 · 25 Jul 2014

Hi NoelDP, thanks a lot for your patience on this, I pasted the results below. As a note, when I followed your startup repair commands, there was no d15aa subfolder created in the \windows\winsxs folder, rather the contents of the d15aa folder (which themselves were grouped in a folder called x86_microsoft-windows-ie-ratings_31bf3856ad364e3
5_10.2.9200.16521_none_e94d3c6514d16754) were copied into the winsxs folder. Based on the file sizes, it seems like the right files got copied. Did I make a mistake here?

The Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\Xiaofan>dir c:\d15aa
Volume in drive C is Windows7_OS
Volume Serial Number is 6A2C-76C6

Directory of c:\d15aa

23/07/2014 11:23 PM <DIR> .
23/07/2014 11:23 PM <DIR> ..
23/07/2014 11:23 PM <DIR> x86_microsoft-windows-ie-ratings_31bf3856
ad364e35_10.2.9200.16521_none_e94d3c6514d16754
0 File(s) 0 bytes
3 Dir(s) 68,178,751,488 bytes free

C:\Users\Xiaofan>dir c:\windows\winsxs\d15aa
Volume in drive C is Windows7_OS
Volume Serial Number is 6A2C-76C6

Directory of c:\windows\winsxs

File Not Found

C:\Users\Xiaofan>dir c:\d15aa\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_
10.2.9200.16521_none_e94d3c6514d16754
Volume in drive C is Windows7_OS
Volume Serial Number is 6A2C-76C6

Directory of c:\d15aa\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_10.2.92
00.16521_none_e94d3c6514d16754

23/07/2014 11:23 PM <DIR> .
23/07/2014 11:23 PM <DIR> ..
23/07/2014 11:23 PM 8,798 icrav03.rat
23/07/2014 11:23 PM 163,840 msrating.dll
23/07/2014 11:23 PM 1,988 ticrf.rat
3 File(s) 174,626 bytes
2 Dir(s) 68,178,923,520 bytes free

C:\Users\Xiaofan>dir c:\windows\winsxs\x86_microsoft-windows-ie-ratings_31bf3856
ad364e35_10.2.9200.16521_none_e94d3c6514d16754
Volume in drive C is Windows7_OS
Volume Serial Number is 6A2C-76C6

Directory of c:\windows\winsxs\x86_microsoft-windows-ie-ratings_31bf3856ad364e3
5_10.2.9200.16521_none_e94d3c6514d16754

23/07/2014 11:23 PM <DIR> .
23/07/2014 11:23 PM <DIR> ..
23/07/2014 11:23 PM 8,798 icrav03.rat
23/07/2014 11:23 PM 163,840 msrating.dll
23/07/2014 11:23 PM 1,988 ticrf.rat
3 File(s) 174,626 bytes
2 Dir(s) 68,178,825,216 bytes free

Finally, I should also note that when I had previously tried to turn off the internet explorer feature from the windows feature list, for some strange reason it is listed as ie11 instead of ie10, which is what I get when I check 'about internet explorer' when running the browser (which has been since reactivated). Not sure if that is at all relevant. I had previously tried updating ie10 to ie11, but ran into similar troubles with this whole failure to configure updates + reverting changes business.

NoelDP · 25 Jul 2014

Nope, it looks like you did everything right - I think that Windows is confused!

Lets see if there's a symlink or something pointing where it didn'orta...

Open an Elevated Command Prompt, and run the following commands..

DIR C:\Windows /AL /S

- if it comes back anything other than 'File not found' please post the results.

If it comes back as expected, then download NTFS Links View from here - NTFSLinksView - View NTFS symbolic links and junction points

extract it and set it to scan C:\Windows at Infinite depth

If it comes back with anything - save a report, and post it.

dynasty15 · 25 Jul 2014

Here are the results from the dir c:\windows /AL /S

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\Xiaofan>dir c:\windows /AL /S
Volume in drive C is Windows7_OS
Volume Serial Number is 6A2C-76C6

Directory of c:\windows\SysWOW64\config\systemprofile

04/10/2012 11:20 AM <JUNCTION> Application Data [C:\Windows\system32\con
fig\systemprofile\AppData\Roaming]
04/10/2012 11:20 AM <JUNCTION> Cookies [C:\Windows\system32\config\syste
mprofile\AppData\Roaming\Microsoft\Windows\Cookies]
04/10/2012 11:20 AM <JUNCTION> Local Settings [C:\Windows\system32\confi
g\systemprofile\AppData\Local]
04/10/2012 11:20 AM <JUNCTION> My Documents [C:\Windows\system32\config\
systemprofile\Documents]
04/10/2012 11:20 AM <JUNCTION> NetHood [C:\Windows\system32\config\syste
mprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
04/10/2012 11:20 AM <JUNCTION> PrintHood [C:\Windows\system32\config\sys
temprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
04/10/2012 11:20 AM <JUNCTION> Recent [C:\Windows\system32\config\system
profile\AppData\Roaming\Microsoft\Windows\Recent]
04/10/2012 11:20 AM <JUNCTION> SendTo [C:\Windows\system32\config\system
profile\AppData\Roaming\Microsoft\Windows\SendTo]
04/10/2012 11:20 AM <JUNCTION> Start Menu [C:\Windows\system32\config\sy
stemprofile\AppData\Roaming\Microsoft\Windows\Start Menu]
04/10/2012 11:20 AM <JUNCTION> Templates [C:\Windows\system32\config\sys
temprofile\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes

Directory of c:\windows\SysWOW64\config\systemprofile\AppData\Local

04/10/2012 11:20 AM <JUNCTION> Application Data [C:\Windows\system32\con
fig\systemprofile\AppData\Local]
04/10/2012 11:20 AM <JUNCTION> History [C:\Windows\system32\config\syste
mprofile\AppData\Local\Microsoft\Windows\History]
04/10/2012 11:20 AM <JUNCTION> Temporary Internet Files [C:\Windows\syst
em32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Fil
es]
0 File(s) 0 bytes

Directory of c:\windows\SysWOW64\config\systemprofile\Documents

04/10/2012 11:20 AM <JUNCTION> My Music [C:\Windows\system32\config\syst
emprofile\Music]
04/10/2012 11:20 AM <JUNCTION> My Pictures [C:\Windows\system32\config\s
ystemprofile\Pictures]
04/10/2012 11:20 AM <JUNCTION> My Videos [C:\Windows\system32\config\sys
temprofile\Videos]
0 File(s) 0 bytes

Total Files Listed:
0 File(s) 0 bytes
16 Dir(s) 68,208,848,896 bytes free

C:\Users\Xiaofan>

The NTFS links report is attached as well

Thanks!

NoelDP · 26 Jul 2014

This looks to me to be the residuals of a malware attack, or the results of using an automated 'fix' tool from an incompetent company.
There is no way that these links should be present - and I have no idea what the effect of removing them would be.

My immediate thought is to do a reformat/reinstall, as there's a possibility that the machine is highly compromised.

Second thought is to do a repair install.

dynasty15 · 25 Aug 2014

Been busy the last little while, but finally yesterday got around to doing a repair install as you recommended - worked like a charm, windows is fully up to date again. Thanks for your help!

NoelDP · 25 Aug 2014

Glad I was able to point you in the right direction!

Good luck with it!