Dave-H

Nothing changes with the Malwarebytes scanners and the Windows Firewall switched off. WindowsUpdate.log HTTPSProxy console has - 088 [R][D] "GET https://fe2.update.microsoft.com/v11/3/legacy/windowsupdate/selfupdate/wuident.cab?2201301850" HTTPSConnectionPool(host='fe2.update.microsoft.com', port=443): Max retries exceeded with url: /v11/3/legacy/windowsupdate/selfupdate/wuident.cab?2201301850 (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:600)'),))

Yes, I'm afraid I am often guilty of being one of those delusional people who think they don't need to read the instructions that come with things! Anyway, it's all understood now. I think it was the running of notepad which really threw me, but of course it says in the instructions that's exactly what it does if you don't specify a target program! Anyway, it seems to be all working fine now, and my system now matches yours as far as HTTPSProxy goes. I am only using the standard Windows Firewall, and I have said OK to all the popups about allowing things through it. I did notice that before Microsoft Update fails to load, there is an error icon at the bottom left corner of IE8. It contains - Webpage error details User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1; en-US; Trident/4.0; Sky Broadband; BTRS111060; chromeframe/32.0.1700.107; OfficeLiveConnector.1.5; OfficeLivePatch.1.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; BRI/2) Timestamp: Sun, 30 Jan 2022 17:45:28 UTC Message: Permission denied Line: 590 Char: 17 Code: 0 URI: http://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/redirect.js?637791615008267454 Possibly some help? Sorry about the state of my WindowsUpdate.log file, I only looked at the end of it, but now I see the rest is totally scrambled! I had an unexplained freeze and reboot yesterday, which may well have caused the corruption, although why it would i don't know, as I wouldn't have thought that the file would have been loaded when it happened, but perhaps it's a file that's always loaded. It looks like it got mixed up with the Windows Search information. Anyway, here's a new "clean" one! WindowsUpdate.log

OK, I've fixed the launcher problem. Bothering the read its help file would have helped! I didn't realise you needed to specify the program you want it to run in its shortcut. How strange that it runs notepad by default if you don't though!

Proxycfg looks fine here, I've checked its configuration several times. There's nothing related to Windows or Microsoft Update in my HOSTS file.

I'm not seeing any of that, presumably because I'm running HTTPSProxy.exe directly, which just gives a console. If I'm supposed to be using launcher.exe, that doesn't work for some reason. Al that happens is my Notepad substitute, Notetab, runs and I get an icon in the taskbar which only relates to that. It doesn't run HTTPSProxy.

OK, I've now got HTTPSProxy running insted of ProxHTTPSProxyMII, and my settings are the same as yours. Should I disable SSL 2.0? Anyway the Microsoft Update site is now failing to load with error 0x801901F6, which apparently means "The server, while acting as a gateway or proxy to fulfil the request, received an invalid response from the upstream server it accessed." HTTPSProxy is working fine everywhere else. WindowsUpdate.log

@maile3241 I use Malwarebytes Premium, the last XP version. @AstroSkipper OK, I'll fire up HTTPSProxy, switch off ProxHTTPSProxyMII, and replicate your settings. You're absolutely right that we need to be comparing two systems that are as similar as possible!

I don't see why something would work in HTTPSProxy that wouldn't work in ProxHTTPSProxyMII, as far as I can see they are pretty much the same program! AFAIK my configuration settings are correct for ProxHTTPSProxyMII, it seems to work fine everywhere else. I am a bit puzzled that although we both have our proxy servers configured for https connections only, not for all connections, they are still apparently active when we are using http connections for Microsoft Update.

OK, I did all that, in fact I cleared everything on Internet Explorer except my browsing history, which surely can't be relevant to the problem. No difference, same error message. Log is attached. WindowsUpdate.log

OK, I've disabled NetTime and restored the default Windows system, using your German server, which seems to work fine. We'll see what happens! It's only set to synchronise once a day.

No actual error messages pop up, except the usual one about mixed content, to which I always answer "no". Same end result though. ============================================================================ ProxHTTPSProxyMII v1.5 (urllib3/1.25.7) FrontServer : localhost:8079 RearServer : localhost:8081 ParentServer : None Proxomitron : http://localhost:8081 ============================================================================ [21:33] 001 [D] "HEAD https://www.update.microsoft.com/v11/3/legacy/windowsupdate/selfupdate/wuident.cab?2201282133" 302 216 [21:33] 002 [D] "HEAD https://fe2.update.microsoft.com/v11/3/legacy/windowsupdate/selfupdate/wuident.cab?2201282133" 200 27634 [21:33] 003 [D] "HEAD https://www.update.microsoft.com/v11/3/legacy/windowsupdate/selfupdate/wuident.cab?2201282133" 302 216 [21:33] 004 [D] "HEAD https://fe2.update.microsoft.com/v11/3/legacy/windowsupdate/selfupdate/wuident.cab?2201282133" 200 27634 [21:33] 000 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10054] An existing connection was forcibly closed by the remote host [21:33] 005 [D] "GET https://cupdates.trusteer.com/rapport/update?o=trusteer&policy=&r=5210720&c=3.5.1804.161-standard-release&cr=&rpkg_ver=4&d=2&ms=00000000&cu=0&ext_RapportCerberus=1804077&dext_RapportCerberus=1804077&ext_RapportMS=1804077&dext_RapportMS=1804077&platform=windows&os=5.1.2600&ct=desktop" 302 138 [21:33] 006 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en" 200 5353 [21:33] 007 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/tgar.js?637790024271596849" 200 1223 [21:33] 012 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/spupdateids.js?637790024271596849" 200 2293 [21:33] 008 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/redirect.js?637790024271596849" 200 13805 [21:33] 013 [D] "POST https://fe2.update.microsoft.com/microsoftupdate/v6/redirect.asp?UA=true 13" 200 390 [21:33] 014 [D] "POST https://fe2.update.microsoft.com/microsoftupdate/v6/redirect.asp?OS=5.1&Processor=x86&Lang=en&CurrentSite=6MULive&SP=3&control=7.6.7600.256&MUOptIn=true 24" 200 230 [21:33] 009 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/resultslist.js?637790024271596849" 200 16020 [21:33] 011 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/commontop.js?637790024271596849" 200 12416 [21:33] 010 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/webcomtop.js?637790024271596849" 200 22253 [21:33] 016 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/toc.aspx?ln=en" 200 2222 [21:33] 017 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/splash.aspx?page=0&ln=en" 200 1542 [21:33] 015 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/mstoolbar.aspx?ln=en" 200 2642 [21:33] 018 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/footer.aspx?ln=en" 200 2394 [21:33] 020 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/css/hcp.css" 304 - [21:33] 019 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/tgar.js?637790024291837856" 200 1223 [21:33] 021 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/css/toc.css" 304 - [21:33] 024 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/content.js?637790024291932824" 200 7019 [21:33] 025 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/css/content.css" 304 - [21:33] 026 [D] "GET https://fe2.update.microsoft.com/library/toolbar/3.0/css.aspx?c=/microsoftupdate/v6/Config/en/MU/shell.config" 200 1061 [21:33] 027 [D] "GET https://fe2.update.microsoft.com/library/toolbar/3.0/images/banners/ms_masthead_ltr.gif" 304 - [21:33] 028 [D] "GET https://fe2.update.microsoft.com/library/toolbar/3.0/subbanner.aspx?t=TWljcm9zb2Z0IFVwZGF0ZQ%3D%3D&f=FFFFFF&b=003399&s=5A7CBC&r=False&font=Segoe%2C+13pt&v=0&c=OwagJh8INVeX5VRqgYtTJdq0zss%3D" 200 7681 [21:33] 023 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/tgar.js?637790024291932824" 200 1009 [21:33] 022 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/toc.js?637790024291837856" 200 3721 [21:33] 029 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/arrow.gif" 304 - [21:33] 030 [D] "HEAD https://www.update.microsoft.com/v11/3/legacy/windowsupdate/selfupdate/wuident.cab?2201282133" 302 216 [21:33] 031 [D] "HEAD https://fe2.update.microsoft.com/v11/3/legacy/windowsupdate/selfupdate/wuident.cab?2201282133" 200 27634 [21:33] 032 [D] "HEAD https://www.update.microsoft.com/v11/3/legacy/windowsupdate/selfupdate/wuident.cab?2201282133" 302 216 [21:33] 033 [D] "HEAD https://fe2.update.microsoft.com/v11/3/legacy/windowsupdate/selfupdate/wuident.cab?2201282133" 200 27634 [21:33] 034 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/splash.aspx?page=3&cpuClass=x86&auenabled=false&ln=en" 200 4435 [21:33] 035 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/tgar.js?637790024315092480" 200 1009 [21:33] 037 [D] "GET https://fe2.update.microsoft.com/library/svy/broker.js?637790024315092480" 404 1245 [21:33] 036 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/content.js?637790024315092480" 200 7019 [21:33] 037 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10053] An established connection was aborted by the software in your host machine [21:33] 039 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/bannersmu/en/welcome-left.jpg" 304 - [21:33] 040 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/bannersmu/en/welcome-right.jpg" 304 - [21:33] 043 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_shieldred.gif" 304 - [21:33] 042 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_bg_righttop.gif" 304 - [21:33] 041 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_bg_lefttop.gif" 304 - [21:33] 044 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_button_left.gif" 304 - [21:33] 045 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_button_right.gif" 304 - [21:33] 046 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_bg_leftbottom.gif" 304 - [21:33] 047 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_bg_rightbottom.gif" 304 - [21:33] 048 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_shieldyellow.gif" 304 - [21:33] 049 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/bannersmu/en/welcome-bg.gif" 304 - [21:33] 050 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_shieldgreen.gif" 304 - [21:33] 051 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/news_bg_lefttop.gif" 304 - [21:33] 052 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/news_info.gif" 304 - [21:33] 053 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_bg_leftmiddle.gif" 304 - [21:33] 054 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/news_bg_righttop.gif" 304 - [21:33] 055 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/news_bg_leftbottom.gif" 304 - [21:33] 056 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_button_middle.gif" 304 - [21:33] 057 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/news_bg_rightbottom.gif" 304 - [21:33] 058 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_bg_rightmiddle.gif" 304 - [21:33] 059 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/au_bg_bottommiddle.gif" 304 - [21:33] 060 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/news_bg_topmiddle.gif" 304 - [21:33] 061 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/news_bg_leftmiddle.gif" 304 - [21:33] 062 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/news_bg_rightmiddle.gif" 304 - [21:33] 063 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/news_bg_bottommiddle.gif" 304 - [21:33] 064 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/news.aspx?ln=en&ismu=true" 302 167 [21:33] 065 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/errorinformation.aspx?Error=15" 200 3744 [21:33] 068 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/content.js?637790024324936413" 200 5574 [21:33] 067 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/tgar.js?637790024324936413" 200 1009 [21:33] 070 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/bannersmu/en/banner-right.jpg" 304 - [21:33] 072 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/banner-bg.jpg" 304 - [21:33] 071 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/warning.gif" 304 - [21:33] 069 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/images/bannersmu/en/information.jpg" 304 - [21:33] 000 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10054] An existing connection was forcibly closed by the remote host [21:33] 074 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/errorinformation.aspx?error=-2147012721&ln=en&IsMu=true&wgaerrorcode=0&wgaend=https://fe2.update.microsoft.com/microsoftupdate/v6/default.aspx" 200 3518 [21:33] 075 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/tgar.js?637790024357753815" 200 1009 [21:33] 076 [D] "GET https://fe2.update.microsoft.com/microsoftupdate/v6/shared/js/content.js?637790024357753815" 200 7019 [21:33] 038 [R][D] "GET https://c.microsoft.com/trans_pixel.asp?source=fe2.update&TYPE=PV&p=microsoftupdate_v6_default.aspx" HTTPSConnectionPool(host='c.microsoft.com', port=443): Max retries exceeded with url: /trans_pixel.asp?source=fe2.update&TYPE=PV&p=microsoftupdate_v6_default.aspx (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x0368B930>: Failed to establish a new connection: [Errno 11001] getaddrinfo failed',)) [21:33] 038 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10054] An existing connection was forcibly closed by the remote host [21:34] 066 [R][D] "GET https://c.microsoft.com/trans_pixel.asp?source=fe2.update&TYPE=PV&p=microsoftupdate_v6_default.aspx" HTTPSConnectionPool(host='c.microsoft.com', port=443): Max retries exceeded with url: /trans_pixel.asp?source=fe2.update&TYPE=PV&p=microsoftupdate_v6_default.aspx (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x03683C90>: Failed to establish a new connection: [Errno 11001] getaddrinfo failed',)) [21:34] 073 [R][D] "GET https://c.microsoft.com/trans_pixel.asp?source=fe2.update&TYPE=PV&p=microsoftupdate_v6_splash.aspx&r=https%3A//fe2.update.microsoft.com/microsoftupdate/v6/default.aspx%3Fln%3Den" HTTPSConnectionPool(host='c.microsoft.com', port=443): Max retries exceeded with url: /trans_pixel.asp?source=fe2.update&TYPE=PV&p=microsoftupdate_v6_splash.aspx&r=https%3A//fe2.update.microsoft.com/microsoftupdate/v6/default.aspx%3Fln%3Den (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x03683F70>: Failed to establish a new connection: [Errno 11001] getaddrinfo failed',)) [21:34] 073 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10054] An existing connection was forcibly closed by the remote host [21:34] 077 [R][D] "GET https://c.microsoft.com/trans_pixel.asp?source=fe2.update&TYPE=PV&p=microsoftupdate_v6_errorinformation.aspx&r=https%3A//fe2.update.microsoft.com/microsoftupdate/v6/default.aspx%3Fln%3Den" HTTPSConnectionPool(host='c.microsoft.com', port=443): Max retries exceeded with url: /trans_pixel.asp?source=fe2.update&TYPE=PV&p=microsoftupdate_v6_errorinformation.aspx&r=https%3A//fe2.update.microsoft.com/microsoftupdate/v6/default.aspx%3Fln%3Den (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x03653D90>: Failed to establish a new connection: [Errno 11001] getaddrinfo failed',)) [21:34] 005 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10054] An existing connection was forcibly closed by the remote host [21:34] 069 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10054] An existing connection was forcibly closed by the remote host [21:34] 076 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10054] An existing connection was forcibly closed by the remote host [21:34] 074 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10054] An existing connection was forcibly closed by the remote host [21:34] 066 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10054] An existing connection was forcibly closed by the remote host [21:34] 077 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10054] An existing connection was forcibly closed by the remote host [21:34] 075 ProxHTTPSProxyMII FrontProxy/v1.5 [WinError 10054] An existing connection was forcibly closed by the remote host

I'm using a program called NetTime to set my clock, and it's set to use its default server nettime.pool.ntp.org as its time source. I've been using it for years now, as I had problems with the default Windows time service, which is disabled. As a test, I have tried switching back to the default Windows system and doing a sync with time.windows.com, but it made no difference. There is no doubt as far as I'm concerned that my system clock is completely correct! My computer is not part of a domain.

No difference I'm afraid.

OK, I've been through the whole process again, following the Microsoft instructions first. The appidsvc service doesn't seem to exist, I guess it's not in XP. I also had four errors during the (very long!) file registration process, Mshtml.dll, sccbase.dll, wucltux.dll, and wuwebv.dll all had errors. In fact the last two could not be found, I guess they're not XP files either. Apart from that, everything seemed to go fine, and I then went on to stages 13-18, which also seemed fine, although I had to change the wuaueng.dll file manually again. I've checked the registry entries, and they are all present and correct. Unfortunately, no difference at all, still the same 0x80072F8F error. This error seems to be ERROR_INTERNET_DECODING_FAILED, and I found a blog entry here which seemed relevant, although it isn't about XP. Anyway, I have attached my update log as requested. Cheers, Dave. WindowsUpdate.log

Thanks! I won't be doing all that tonight though, I'll give it a try tomorrow!

OK, I did that. Absolutely no difference I'm afraid, same error message. I guess maybe I should do the whole process again now I have the right version of WU 7.6!

Actually I've just noticed something. My WU7.6 installation file, which I've had for ages, is 6.47MB. Just in case I looked for another download of it, and the one I've got now is 9.27MB. I'm now wondering if I've got an out of date version. The file version information is no help at all of course, but my archived file says it's 6.2.29.0, the one I've just downloaded says it's 6.3.21.0.

OK, I ran the cmd file again, and got this. Presumably this is because the cmd didn't stop the Automatic Updates service. I assume the file manipulation should happen on reboot. It has made a difference, on reboot, trying Windows Update again gave this again!

Windows Update looks more promising. Scanning immediately produces the same error though.

It just immediately redirects to the fe2 address.

I tried that, and registering wuaueng.dll. No difference.

Thanks, that's better. I was now prompted to switch to Microsoft Update, but when i did it said the necessary files weren't registered and offered to do it for me. If I click continue, the window goes blank but nothing then appears to happen.

I did re-register those files some time ago, but it didn't change anything. Initpki.dll took a long time before it reported that it was registered, the other three were pretty instant. Anyway, I've given all that a try, and the only thing which didn't seem to work in the cmd file was replacing wuaueng.dll. After rebooting I found there was no wuaueng.dll in the DLLCache folder, and the one in System32 was version 5.4.3790.5512, the one from SP3. Anyway, I corrected that manually, and the version now in System32 and the DLLCache is 7.6.7600.256. I'm now getting this - There are a number of sites now listed in the Trusted Sites list, more than before, and more than the message says. They are - *.microsoft.com *update.microsoft.com *windowsupdate.com *windowsupdate.microsoft.com http://update.microsoft.com http://www.update.microsoft.com https://www.update.microsoft.com ProxHTTPSProxy appears to be working fine on other sites, but shows no output now on Microsoft Update.

I just tried completely removing my SoftwareDistribution folder, and trying again. This should have forced Microsoft Update to have to be set up again from scratch with an empty database, and it was. Still the same error after a short scan though.

One thing I don't want is to lose my update history, and I guess resetting will do that. I do have backups though, so I guess I can always restore it if this does not restore the updates to working.