AstroSkipper

2022-04-07 23:52:16:544 1084 f4 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates] 2022-04-07 23:52:16:544 1084 f4 Agent ********* 2022-04-07 23:52:16:544 1084 f4 Agent * Online = No; Ignore download priority = No In your WindowsUpdate.log the AU client reported your are not online. Can you explain what's going on in your system? You aren't online but you are searching for updates? Very strange! In my logs the AU client always reports that I am online: 2022-04-08 02:05:29:584 1128 1294 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates] 2022-04-08 02:05:29:584 1128 1294 Agent ********* 2022-04-08 02:05:29:584 1128 1294 Agent * Online = Yes; Ignore download priority = No

Ok, now I understand what you mean with 0 bytes. You're absolutely right, AU does not trust its own file, therefore it can't be stored i.e. no file. no bytes. No errors in my event log too but the shield doesn't appear anymore. PS: Thanks for uploading your logs! I love to read a million of these f**king logs!

Just to clarify, you said it works perfectly in your Windows XP system. Even now?

I'm able to download them, size 20 KB. But what is BFilter? Do you mean the BFilter, a filtering web proxy?

Thanks for this information! I had success once yesterday but after restarting system it didn't work anymore. No idea why!

Yes, it works perfectly. Thanks for reply! What's your version of crypt32.dll? Under which conditions do you run AU? If AU works perfectly in your system, then there has to be a significant difference from my system to your. Maybe we can find it. I think there is a problem with the certificate of wuident.cab. It can't be verified. In XP the signature is not valid. A timestamp is missing and it's not counter-signed.

Is AU still working in your Windows XP system despite error codes in WindowsUpdate.log?

@maile3241 What kind of patch did you mean in your comment from January? Was it patched wuaueng.dll?

Is it really working anymore? After restarting and without accessing MU or WU web site? I don't believe that. Can you post a proof?

In my system AU and notification shield worked exactly one Windows session. After restart it didn't work anymore. I have to find out what's going wrong here. Therefore one question. Which version of crypt32.dll do you have currently in your Windows XP system? My version is 5.131.2600.6459 from Oktober of 2013.

AFAIK for SHA-2 support in Windows XP update KB2868626 was required (Oktober of 2013). This update contains crypt32.dll in version 5.131.2600.6459.

Thanks for reporting! Glad it works for you. In my case it worked only one Windows session. After restart it didin't work anymore. I have to find out what's going wrong here.

Hi @xpandvistafan, can you clarify why installing windowsserver2003-kb2868626-x86-xxx.exe is necessary for restoring MU web site functionality? You know I was the person who found out that wuaueng.dll didn't install properly due to SFC. I restored MU web site version in January. Today I did a deeper examination of MU/WU related files in my system and found out that the update windowsserver2003-kb2868626-x86-deu.exe wasn't installed properly too, although MU web site is working flawlessly in my system. Both files, crypt32.dll and w03s3407.dll, weren't copied in folders c:\WINDOWS\system32\dllcache and c:\WINDOWS\system32. I still have the original Windows XP files. crypt32.dll in version 5.131.2600.6459 (xpsp_sp3_qfe.131005-0434) is from 04-14-2020 and w03s3409.dll in version 5.2.3790.3959 (srv03_sp2_rtm.070216-1710) is from 02-18-2007. Your provided crypt32.dll is in version 5.131.3790.5235 (srv03_sp2_qfe.131004-1550) from 10-07-2013 and the file w03s3407.dll doesn't exist in mentioned folders at all. And I definitely know that I executed your install.cmd at that time. My conclusion is either your script didn't work properly at that time or SFC did its job once again. Nonetheless my question remains to be clarified: Why do we need to install the update windowsserver2003-kb2868626-x86-xxx.exe at all? Kind regards, AstroSkipper

Did you read my post above? Try if it works for you! In my system no problems so far.

@Dave-H I did a deeper examination of AU related problems. It seems we do not need to patch other files. And it doesn't matter if error 0x80096010 occurs in WindowsUpdate.log. In my system following steps are working to get AU notification shield: 1. Enable ProxHTTPSProxy. 2. Set AU to 'Notify but don't automatically download or install them'. 3. It's not necessary to set proxy system-wide by command proxycfg -u. 4. Execute following command: wuauclt /resetauthorization /detectnow. (I had to execute this command only once. After disabling AU notification shield disappears and subsequent enabling it appears again if ProxHTTPSProxy is enabled permanently). 5. AU notification shield appears if important updates are available. Here is a proof: Cheers, AstroSkipper

I've tested this file. Unfortunately it does not change anything. Same problem occurs. Therefore no working patch!

Thanks for clarifying! I forgot about it completely! BTW I already deactivated AU many years ago. I always use WU/MU web site for searching updates.

@Dave-H But one positive thing is for sure: we are able to delay Windows XP services.

Ok, thinking, the system is Windows 7 or whatever, AU tries to download a wrong file version due to the patch. But why does it still work? The last time I got the notification shield with missing updates. And why doesn't occur a similar error while connecting to MU website? Anyway, I can confirm if ProxHTTPSProxy is enabled and set to system-wide, the new error code is 0x80096010. Just to complete information: 0x80096010 = Trust_E_Bad_Digest = The digital signature of the object did not verify. That means the digital signature of wuident.cab couldn't be verified. I think no chance to solve error without more patching. My recommendation is to disable AU in system panel because it's useless.

I think AU tries to download a file for Windows 7 SP1. Have a look: https://fe2.update.microsoft.com/v11/3/win7sp1/windowsupdate/selfupdate/wuident.cab I've downloaded this file manually and it is not identical to the version located in my system.

The file which cannot be updated by AU is wuident.cab from url https://fe2.update.microsoft.com/v11/3/win7sp1/windowsupdate/selfupdate/wuident.cab with error code 0x80072efe. So we have to find out why AU is not able to download it. Is service wuauserv still in your exclusion list of your firewall? Fact is: error code 0x80072efe = ERROR_INTERNET_CONNECTION_ABORTED = The connection with the server has been terminated.

But only when HTTPSProxy is running. Otherwise it would be senseless.

You can upload your current WindowsUpdate.log if you want. A look at the log can do no harm. Maybe there is any useful information! I would say: same procedure as last time!

This time I've tested both files and they are working fine. Maybe your security scanner could produce false positives. Avast does not have any problems with my files. Code is absolutely clean. If problems occur, add both files to exclusion list.

I didn't test my code yet. I just wrote it and it should work. The StopWU.bat is meant to disable both services before shutting down system. Once you want to start your system again, both services should be disabled, otherwise they would start as usual. I did in this moment a test and it seems if once both services are disabled they stay in that status and can't be started without setting them to demand start. Therefore we have to change code of StartWU.bat. Change code of StartWU.bat to: @echo off ping localhost -n 60 > nul sc config "wuauserv" start= demand sc start "wuauserv" sc config "bits" start= demand sc start "bits" exit Leave code of StopWU.bat as it is: @echo off sc config "wuauserv" start= disabled sc stop "wuauserv" sc config "bits" start= disabled sc stop "bits" exit StartWU.bat set both services to demand start and will start them. StopWU.bat set both services to disabled start and will stop them. Therefore both files are necessary. Sorry for confusion! And here both batches as executables exe files without annoying black console windows: https://www.mediafire.com/file/ui7casl48g20ke0/Start_and_Stop_WU.7z/file If another delay time is necessary, let me know! PS: And what did we learn? First you have to test your code, then you can publish it! I should know that!