Re: WindowsUpdate_80070005 WindowsUpdate_dt000

"OlsBean" <OlsBean@discussions.microsoft.com> wrote in message
news:1C9D80F1-2349-46D1-8C04-6EBC18ADF30D@microsoft.com...
>
>
> "Robert Aldwinckle" wrote:
>
>> "OlsBean" <OlsBean@discussions.microsoft.com> wrote in message
>> news:ECEDF31B-C22F-4272-A1BE-CBBFD56206C1@microsoft.com...
>> > Running Vista X64 Ultimate
>> >
>> > I've searched and searched and none of the relevant threads found have
>> > provided a solution to the error I have.
>>
>>
>> <repost date="Sept 7, 2007">
>> If the log(s) (including the Event log) aren't giving you enough clues
>> about what your symptom means you could try running ProcMon
>> to supplement them.
>>
>>
>> </repost>
>>
>>
>> BTW I am surprised that searches for this common code aren't giving
>> better results on Google Groups. E.g. this search which was to have
>> demonstrated how to avoid a possible mistake of searching for only unprefixed
>> hex codes (e.g. you never mentioned 0x80070005 in your post)
>> and not filtering for threads with answers or helpful threads, didn't show
>> what I was expecting it could:
>>
>> (0x80070005 OR 80070005) (MSFT OR MVP) group:microsoft.*
>>
>>
>> E.g. I had to add an extra expression to find what I wanted and even
>> then none of the hits mentioned ProcMon, only FileMon.
>>
>> http://groups.google.com/group/micro...5626350e87e559
>>
>> (Google Groups search for
>> (filemon OR procmon) (0x80070005 OR 80070005) (MSFT OR MVP) group:microsoft.*
>> - sorted by date to try to capture current thinking
>> )
>>
>> That post is now over a year old. High time for rediscovery.
>>
>> BTW the web interface still has it and (to my surprise)
>> it has even been voted on so it could at least be found more
>> easily by using that facility's Threads with helpful posts filter.
>> Admittedly it does help to know about FileMon as a search term... ; )
>>
>>
>> FYI the excerpt from your log is not helpful because it does not show
>> the context of the code that you are reporting.
>>
>>
>> Good luck
>>
>> Robert Aldwinckle
>> ---
>>
>>
>>
>
> Thank you, the only access denied process I could find while WU was running
> is the following;
>
> ########################
> Sequence: 18002
> Date & Time: 13/01/2008 20:04:51
> Event Class: Registry
> Operation: RegOpenKey
> Result: ACCESS DENIED
> Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Com ponent Based
> Servicing\Packages\Package_1_for_KB905866~31bf3856 ad364e35~amd64~~6.0.13.0
> TID: 3956
> Duration: 0.0000096
> Desired Access: Read/Write
> ####################
>
> Not sure how to fix this, not sure if it gives anyone else an insight.


Very good! However, if that is a line being reported by ProcMon it is a strange
combination of columns IMO. E.g., I'm surprised that there is only a TID (Thread ID)
and not a PID (Process ID) as well or even more usefully a Process Name.
Not having at least a PID can make it difficult to know which "task" from the
Task bar and Task Manager's perspectives that record applies to.

Or is that TID really the task's PID? E.g. if you checked with Task Manager
and that number made sense as a PID you would know which process name
it was really for.

Nevertheless, it is an excellent clue which helps clarify *which* object
whatever task is involved (not shown) and whatever account that task
is being run under (not shown) is being denied access to.

So, using RegEdit how much of that registry path is apparent to you?
Make sure that you expand all [+] boxes beneath wherever you
navigate to. (E.g. press * on the numeric keypad.)
Then get into the Permissions dialog for the lowest level key on that path
that you can see. (E.g. use the Edit menu or right-click the key name or
press the Menu key.)

BTW because this is Vista you probably need to enter RegEdit via
Run As... Administrator or perhaps it is enough to open a cmd window
which has that authority and start RegEdit from there? I don't know;
I don't use Vista and haven't run into this sort of permissions difficulty.

Even more suprising there is nothing on a Google Groups search which
matches this particular detail, e.g. even not quoting the keyname gives few hits

vista component based servicing permissions group:microsoft.*

so I suspect I'm missing something. I don't want to suggest you change
permissions until we're sure that you have given us *all* the details about
the failure. So I would suggest running ProcMon again with *all* column
details requested. In fact, if you prefer you might find it easier to get the
results we want using the older registry-specific tool, RegMon.

Also, I'm cross-posting this to a Vista specific newsgroup since I don't
use Vista and XP doesn't have that Component Based Servicing key
(at least it isn't apparent to me on my OS.)

Alternatively, you can find examples of other instructions on the Support site
which I'm sure you could adapt to changing permissions on that branch
so you could change your symptom if you wanted to try that approach instead.


Good luck

Robert
---


>
> TIA
>
>

"Robert Aldwinckle" wrote:

> "OlsBean" <OlsBean@discussions.microsoft.com> wrote in message
> news:1C9D80F1-2349-46D1-8C04-6EBC18ADF30D@microsoft.com...
> >
> >
> > "Robert Aldwinckle" wrote:
> >
> >> "OlsBean" <OlsBean@discussions.microsoft.com> wrote in message
> >> news:ECEDF31B-C22F-4272-A1BE-CBBFD56206C1@microsoft.com...
> >> > Running Vista X64 Ultimate
> >> >
> >> > I've searched and searched and none of the relevant threads found have
> >> > provided a solution to the error I have.
> >>
> >>
> >> <repost date="Sept 7, 2007">
> >> If the log(s) (including the Event log) aren't giving you enough clues
> >> about what your symptom means you could try running ProcMon
> >> to supplement them.
> >>
> >>
> >> </repost>
> >>
> >>
> >> BTW I am surprised that searches for this common code aren't giving
> >> better results on Google Groups. E.g. this search which was to have
> >> demonstrated how to avoid a possible mistake of searching for only unprefixed
> >> hex codes (e.g. you never mentioned 0x80070005 in your post)
> >> and not filtering for threads with answers or helpful threads, didn't show
> >> what I was expecting it could:
> >>
> >> (0x80070005 OR 80070005) (MSFT OR MVP) group:microsoft.*
> >>
> >>
> >> E.g. I had to add an extra expression to find what I wanted and even
> >> then none of the hits mentioned ProcMon, only FileMon.
> >>
> >> http://groups.google.com/group/micro...5626350e87e559
> >>
> >> (Google Groups search for
> >> (filemon OR procmon) (0x80070005 OR 80070005) (MSFT OR MVP) group:microsoft.*
> >> - sorted by date to try to capture current thinking
> >> )
> >>
> >> That post is now over a year old. High time for rediscovery.
> >>
> >> BTW the web interface still has it and (to my surprise)
> >> it has even been voted on so it could at least be found more
> >> easily by using that facility's Threads with helpful posts filter.
> >> Admittedly it does help to know about FileMon as a search term... ; )
> >>
> >>
> >> FYI the excerpt from your log is not helpful because it does not show
> >> the context of the code that you are reporting.
> >>
> >>
> >> Good luck
> >>
> >> Robert Aldwinckle
> >> ---
> >>
> >>
> >>
> >
> > Thank you, the only access denied process I could find while WU was running
> > is the following;
> >
> > ########################
> > Sequence: 18002
> > Date & Time: 13/01/2008 20:04:51
> > Event Class: Registry
> > Operation: RegOpenKey
> > Result: ACCESS DENIED
> > Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Com ponent Based
> > Servicing\Packages\Package_1_for_KB905866~31bf3856 ad364e35~amd64~~6.0.13.0
> > TID: 3956
> > Duration: 0.0000096
> > Desired Access: Read/Write
> > ####################
> >
> > Not sure how to fix this, not sure if it gives anyone else an insight.
>
>
> Very good! However, if that is a line being reported by ProcMon it is a strange
> combination of columns IMO. E.g., I'm surprised that there is only a TID (Thread ID)
> and not a PID (Process ID) as well or even more usefully a Process Name.
> Not having at least a PID can make it difficult to know which "task" from the
> Task bar and Task Manager's perspectives that record applies to.
>
> Or is that TID really the task's PID? E.g. if you checked with Task Manager
> and that number made sense as a PID you would know which process name
> it was really for.
>
> Nevertheless, it is an excellent clue which helps clarify *which* object
> whatever task is involved (not shown) and whatever account that task
> is being run under (not shown) is being denied access to.
>
> So, using RegEdit how much of that registry path is apparent to you?
> Make sure that you expand all [+] boxes beneath wherever you
> navigate to. (E.g. press * on the numeric keypad.)
> Then get into the Permissions dialog for the lowest level key on that path
> that you can see. (E.g. use the Edit menu or right-click the key name or
> press the Menu key.)
>
> BTW because this is Vista you probably need to enter RegEdit via
> Run As... Administrator or perhaps it is enough to open a cmd window
> which has that authority and start RegEdit from there? I don't know;
> I don't use Vista and haven't run into this sort of permissions difficulty.
>
> Even more suprising there is nothing on a Google Groups search which
> matches this particular detail, e.g. even not quoting the keyname gives few hits
>
> vista component based servicing permissions group:microsoft.*
>
> so I suspect I'm missing something. I don't want to suggest you change
> permissions until we're sure that you have given us *all* the details about
> the failure. So I would suggest running ProcMon again with *all* column
> details requested. In fact, if you prefer you might find it easier to get the
> results we want using the older registry-specific tool, RegMon.
>
> Also, I'm cross-posting this to a Vista specific newsgroup since I don't
> use Vista and XP doesn't have that Component Based Servicing key
> (at least it isn't apparent to me on my OS.)
>
> Alternatively, you can find examples of other instructions on the Support site
> which I'm sure you could adapt to changing permissions on that branch
> so you could change your symptom if you wanted to try that approach instead.
>
>
> Good luck
>
> Robert
> ---
>
>
> >
> > TIA
> >
> >
>
>
>

Thank you, that was my fault I did not include all the tabs in the
information I posted, apologies, the process name is TrustedInstaller.exe
below is complete report.

############################
############################
Sequence: 16026
Date & Time: 14/01/2008 07:58:08
Event Class: Registry
Operation: RegOpenKey
Result: ACCESS DENIED
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Com ponent Based
Servicing\Packages\Package_1_for_KB905866~31bf3856 ad364e35~amd64~~6.0.13.0
TID: 1616
Duration: 0.0000146
Desired Access: Read/Write
Description: Windows Modules Installer
Company: Microsoft Corporation
Name: TrustedInstaller.exe
Version: 6.00.6000.16386
Path: C:\Windows\servicing\TrustedInstaller.exe
Command Line: C:\Windows\servicing\TrustedInstaller.exe
PID: 3220
Parent PID: 576
Session ID: 0
User: NT AUTHORITY\SYSTEM
Auth ID: 00000000:000003e7
Architecture: 64-bit
Virtualized: False
Integrity: System
Started: 14/01/2008 07:51:37
Ended: (Running)
Modules:
kernel32.dll 0x76DB0000 0x131000 C:\Windows\system32\kernel32.dll
USER32.dll 0x76EF0000 0xCA000 C:\Windows\system32\USER32.dll
ntdll.dll 0x76FC0000 0x17A000 C:\Windows\system32\ntdll.dll
TrustedInstaller.exe 0xFF760000 0xB000 C:\Windows\servicing\TrustedInstaller.exe
wcp.dll 0xF2340000 0x23D000 C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6000.16386_non e_63473ad082bcdac6\wcp.dll
SPP.dll 0xF4BA0000 0x31000 C:\Windows\system32\SPP.dll
wrpint.dll 0xF4BE0000 0x12000 C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6000.16386_non e_63473ad082bcdac6\wrpint.dll
CbsApi.dll 0xF4C10000 0x9000 C:\Windows\servicing\CbsApi.dll
cbscore.dll 0xF4C20000 0x83000 C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6000.16386_non e_63473ad082bcdac6\cbscore.dll
SrClient.dll 0xF5790000 0x10000 C:\Windows\system32\SrClient.dll
DrUpdate.dll 0xF5A70000 0x1F000 C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6000.16386_non e_63473ad082bcdac6\DrUpdate.dll
dpx.dll 0xF5A90000 0x65000 C:\Windows\system32\dpx.dll
SxsStore.dll 0xF6BA0000 0xC000 C:\Windows\system32\SxsStore.dll
wdscore.dll 0xF9C00000 0x4B000 C:\Windows\system32\wdscore.dll
dbghelp.dll 0xF9CC0000 0x118000 C:\Windows\system32\dbghelp.dll
VSSAPI.DLL 0xFA810000 0x157000 C:\Windows\system32\VSSAPI.DLL
vsstrace.dll 0xFA9B0000 0x1F000 C:\Windows\system32\vsstrace.dll
XmlLite.dll 0xFB0F0000 0x30000 C:\Windows\system32\XmlLite.dll
comctl32.dll 0xFC0A0000 0x1F0000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_1559 f1c6f365a7fa\comctl32.dll
ATL.DLL 0xFC2C0000 0x19000 C:\Windows\system32\ATL.DLL
Ktmw32.dll 0xFC340000 0x8000 C:\Windows\system32\Ktmw32.dll
WINTRUST.dll 0xFC580000 0x39000 C:\Windows\system32\WINTRUST.dll
rsaenh.dll 0xFC890000 0x43000 C:\Windows\system32\rsaenh.dll
VERSION.dll 0xFCC80000 0xB000 C:\Windows\system32\VERSION.dll
CRYPT32.dll 0xFCE90000 0x137000 C:\Windows\system32\CRYPT32.dll
MPR.dll 0xFCFD0000 0x18000 C:\Windows\system32\MPR.dll
MSASN1.dll 0xFD040000 0x18000 C:\Windows\system32\MSASN1.dll
NETAPI32.dll 0xFD0F0000 0x99000 C:\Windows\system32\NETAPI32.dll
AUTHZ.dll 0xFD550000 0x26000 C:\Windows\system32\AUTHZ.dll
Secur32.dll 0xFD580000 0x1B000 C:\Windows\system32\Secur32.dll
USERENV.dll 0xFD5A0000 0x26000 C:\Windows\system32\USERENV.dll
PSAPI.DLL 0xFD720000 0x8000 C:\Windows\system32\PSAPI.DLL
SHLWAPI.dll 0xFD730000 0x71000 C:\Windows\system32\SHLWAPI.dll
IMM32.DLL 0xFD810000 0x28000 C:\Windows\system32\IMM32.DLL
USP10.dll 0xFD840000 0x9A000 C:\Windows\system32\USP10.dll
SHELL32.dll 0xFD8E0000 0xC34000 C:\Windows\system32\SHELL32.dll
ADVAPI32.dll 0xFE520000 0xFF000 C:\Windows\system32\ADVAPI32.dll
SETUPAPI.dll 0xFE620000 0x1DE000 C:\Windows\system32\SETUPAPI.dll
msvcrt.dll 0xFE860000 0xA1000 C:\Windows\system32\msvcrt.dll
LPK.DLL 0xFEA10000 0xC000 C:\Windows\system32\LPK.DLL
RPCRT4.dll 0xFEA30000 0x139000 C:\Windows\system32\RPCRT4.dll
CLBCatQ.DLL 0xFED70000 0x9C000 C:\Windows\system32\CLBCatQ.DLL
imagehlp.dll 0xFEE60000 0x17000 C:\Windows\system32\imagehlp.dll
GDI32.dll 0xFF060000 0x61000 C:\Windows\system32\GDI32.dll
OLEAUT32.dll 0xFF0D0000 0xD8000 C:\Windows\system32\OLEAUT32.dll
MSCTF.dll 0xFF1B0000 0x104000 C:\Windows\system32\MSCTF.dll
############################
############################

The registry key exists however the only perms attribute is 'System' with
special allowed.

I also had this Permission Denied in addition to the above when I ran WU
this morning and monitored.

############################
############################
Sequence: 6374
Date & Time: 14/01/2008 07:58:08
Event Class: Registry
Operation: RegOpenKey
Result: ACCESS DENIED
Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Win dowsUpdate\Auto Update
TID: 1160
Duration: 0.0000241
Desired Access: Set Value
Description: Host Process for Windows Services
Company: Microsoft Corporation
Name: svchost.exe
Version: 6.00.6000.16386
Path: C:\Windows\system32\svchost.exe
Command Line: C:\Windows\system32\svchost.exe -k netsvcs
PID: 948
Parent PID: 576
Session ID: 0
User: NT AUTHORITY\SYSTEM
Auth ID: 00000000:000003e7
Architecture: 64-bit
Virtualized: False
Integrity: System
Started: 14/01/2008 07:13:04
Ended: (Running)
Modules:
kernel32.dll 0x76DB0000 0x131000 C:\Windows\system32\kernel32.dll
USER32.dll 0x76EF0000 0xCA000 C:\Windows\system32\USER32.dll
ntdll.dll 0x76FC0000 0x17A000 C:\Windows\system32\ntdll.dll
svchost.exe 0xFF700000 0xA000 C:\Windows\system32\svchost.exe
rastls.dll 0xF3050000 0x45000 C:\Windows\System32\rastls.dll
raschap.dll 0xF3210000 0x4A000 C:\Windows\System32\raschap.dll
WinSCard.dll 0xF3270000 0x33000 C:\Windows\system32\WinSCard.dll
rasppp.dll 0xF3BE0000 0x4E000 C:\Windows\system32\rasppp.dll
rasmans.dll 0xF3C30000 0x4A000 c:\windows\system32\rasmans.dll
RASQEC.DLL 0xF42B0000 0x16000 C:\Windows\system32\RASQEC.DLL
CbsApi.dll 0xF4C10000 0x9000 C:\Windows\servicing\CbsApi.dll
CRYPTUI.dll 0xF4E00000 0x102000 C:\Windows\system32\CRYPTUI.dll
appinfo.dll 0xF4F10000 0xF000 c:\windows\system32\appinfo.dll
MPRAPI.dll 0xF4F40000 0x23000 C:\Windows\system32\MPRAPI.dll
TAPI32.dll 0xF59D0000 0x3F000 C:\Windows\system32\TAPI32.dll
wups2.dll 0xF6400000 0xE000 C:\Windows\System32\wups2.dll
RasApi32.dll 0xF6410000 0x55000 C:\Windows\system32\RasApi32.dll
wuaueng.dll 0xF76E0000 0x213000 c:\windows\system32\wuaueng.dll
upnp.dll 0xF7D40000 0x41000 C:\Windows\system32\upnp.dll
mspatcha.dll 0xF7DA0000 0xF000 c:\windows\system32\mspatcha.dll
qmgr.dll 0xF7DE0000 0x106000 c:\windows\system32\qmgr.dll
bitsigd.dll 0xF80C0000 0xF000 C:\Windows\system32\bitsigd.dll
bitsperf.dll 0xF80D0000 0xA000 c:\windows\system32\bitsperf.dll
SHFOLDER.dll 0xF80E0000 0x7000 c:\windows\system32\SHFOLDER.dll
WINSPOOL.DRV 0xF8460000 0x57000 c:\windows\system32\WINSPOOL.DRV
ncprov.dll 0xF85E0000 0x16000 C:\Windows\system32\wbem\ncprov.dll
tschannel.dll 0xF8600000 0xA000 C:\Windows\system32\tschannel.dll
wbemess.dll 0xF8910000 0x81000 C:\Windows\system32\wbem\wbemess.dll
wmiprvsd.dll 0xF89A0000 0xAB000 C:\Windows\system32\wbem\wmiprvsd.dll
repdrvfs.dll 0xF8B00000 0x61000 C:\Windows\system32\wbem\repdrvfs.dll
pnrpnsp.dll 0xF8BC0000 0x17000 C:\Windows\system32\pnrpnsp.dll
wmiutils.dll 0xF8BE0000 0x24000 C:\Windows\system32\wbem\wmiutils.dll
FastProx.dll 0xF8C10000 0xDD000 C:\Windows\System32\Wbem\FastProx.dll
wbemcore.dll 0xF8CF0000 0x128000 C:\Windows\System32\Wbem\wbemcore.dll
wbemsvc.dll 0xF8EE0000 0x23000 C:\Windows\system32\wbem\wbemsvc.dll
esscli.dll 0xF8F10000 0x6C000 C:\Windows\System32\Wbem\esscli.dll
napinsp.dll 0xF9170000 0x13000 C:\Windows\system32\napinsp.dll
winrnr.dll 0xF91D0000 0xB000 C:\Windows\System32\winrnr.dll
rasadhlp.dll 0xF91E0000 0x7000 C:\Windows\system32\rasadhlp.dll
ESENT.dll 0xF9220000 0x26D000 c:\windows\system32\ESENT.dll
iphlpsvc.dll 0xF9610000 0x38000 c:\windows\system32\iphlpsvc.dll
sqmapi.dll 0xF9820000 0x2D000 c:\windows\system32\sqmapi.dll
wbemcomn.dll 0xF9850000 0x87000 c:\windows\system32\wbem\wbemcomn.dll
wmisvc.dll 0xF9BC0000 0x3A000 c:\windows\system32\wbem\wmisvc.dll
msxml3.dll 0xFA2C0000 0x1C4000 C:\Windows\System32\msxml3.dll
seclogon.dll 0xFA4B0000 0xB000 c:\windows\system32\seclogon.dll
ikeext.dll 0xFA6C0000 0x7C000 c:\windows\system32\ikeext.dll
SSDPAPI.dll 0xFA740000 0x10000 C:\Windows\system32\SSDPAPI.dll
VSSAPI.DLL 0xFA810000 0x157000 C:\Windows\system32\VSSAPI.DLL
vsstrace.dll 0xFA9B0000 0x1F000 C:\Windows\system32\vsstrace.dll
browser.dll 0xFA9D0000 0x1D000 c:\windows\system32\browser.dll
aelupsvc.dll 0xFAC00000 0xB000 c:\windows\system32\aelupsvc.dll
WINMM.dll 0xFAD20000 0x3A000 C:\Windows\system32\WINMM.dll
rasman.dll 0xFAFA0000 0x1A000 C:\Windows\system32\rasman.dll
XmlLite.dll 0xFB0F0000 0x30000 C:\Windows\system32\XmlLite.dll
UxTheme.dll 0xFB1A0000 0x52000 C:\Windows\system32\UxTheme.dll
credui.dll 0xFB4C0000 0x35000 C:\Windows\system32\credui.dll
QUtil.dll 0xFB520000 0x1D000 C:\Windows\system32\QUtil.dll
adsldpc.dll 0xFB540000 0x39000 C:\Windows\system32\adsldpc.dll
MSIMG32.dll 0xFB620000 0x6000 C:\Windows\system32\MSIMG32.dll
ACTIVEDS.dll 0xFB630000 0x45000 C:\Windows\system32\ACTIVEDS.dll
fwpuclnt.dll 0xFB6C0000 0xB3000 c:\windows\system32\fwpuclnt.dll
wiarpc.dll 0xFB800000 0xE000 C:\Windows\system32\wiarpc.dll
WINHTTP.dll 0xFB810000 0x6F000 C:\Windows\system32\WINHTTP.dll
schedsvc.dll 0xFB880000 0xD1000 c:\windows\system32\schedsvc.dll
RESUTILS.DLL 0xFB960000 0x17000 C:\Windows\system32\RESUTILS.DLL
taskcomp.dll 0xFB9D0000 0x67000 C:\Windows\system32\taskcomp.dll
COMCTL32.dll 0xFBA40000 0x9F000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.6000.16386_none_403 39432230aebeb\COMCTL32.dll
srvsvc.dll 0xFBAE0000 0x2E000 c:\windows\system32\srvsvc.dll
CLUSAPI.DLL 0xFBB10000 0x2E000 C:\Windows\system32\CLUSAPI.DLL
PROPSYS.dll 0xFBBA0000 0xE2000 C:\Windows\system32\PROPSYS.dll
gpsvc.dll 0xFBC90000 0xB2000 c:\windows\system32\gpsvc.dll
ES.DLL 0xFBD60000 0x5B000 C:\Windows\system32\ES.DLL
shsvcs.dll 0xFBDC0000 0x4D000 c:\windows\system32\shsvcs.dll
sens.dll 0xFBEE0000 0x12000 c:\windows\system32\sens.dll
profsvc.dll 0xFBF00000 0x2F000 c:\windows\system32\profsvc.dll
comctl32.dll 0xFC0A0000 0x1F0000 C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_1559 f1c6f365a7fa\comctl32.dll
SSCORE.DLL 0xFC2A0000 0x7000 C:\Windows\system32\SSCORE.DLL
ATL.DLL 0xFC2C0000 0x19000 c:\windows\system32\ATL.DLL
nlaapi.dll 0xFC2E0000 0x13000 c:\windows\system32\nlaapi.dll
ktmw32.dll 0xFC340000 0x8000 c:\windows\system32\ktmw32.dll
mmcss.dll 0xFC360000 0x1B000 c:\windows\system32\mmcss.dll
WINSTA.dll 0xFC400000 0x34000 c:\windows\system32\WINSTA.dll
Cabinet.dll 0xFC560000 0x1A000 C:\Windows\system32\Cabinet.dll
WINTRUST.dll 0xFC580000 0x39000 C:\Windows\system32\WINTRUST.dll
WTSAPI32.dll 0xFC680000 0xB000 c:\windows\system32\WTSAPI32.dll
FirewallAPI.DLL 0xFC690000 0xAB000 C:\Windows\system32\FirewallAPI.DLL
wshtcpip.dll 0xFC790000 0x7000 C:\Windows\system32\wshtcpip.dll
AVRT.dll 0xFC7A0000 0x8000 c:\windows\system32\AVRT.dll
NTMARTA.DLL 0xFC7E0000 0x2C000 C:\Windows\system32\NTMARTA.DLL
GPAPI.dll 0xFC850000 0x18000 c:\windows\system32\GPAPI.dll
rsaenh.dll 0xFC890000 0x43000 C:\Windows\system32\rsaenh.dll
schannel.dll 0xFC8E0000 0x56000 C:\Windows\system32\schannel.dll
mswsock.dll 0xFCB20000 0x50000 C:\Windows\system32\mswsock.dll
wship6.dll 0xFCBB0000 0x7000 C:\Windows\System32\wship6.dll
kerberos.dll 0xFCBC0000 0xA5000 C:\Windows\system32\kerberos.dll
credssp.dll 0xFCC70000 0x9000 C:\Windows\system32\credssp.dll
VERSION.dll 0xFCC80000 0xB000 C:\Windows\system32\VERSION.dll
BCRYPT.dll 0xFCC90000 0x4D000 C:\Windows\system32\BCRYPT.dll
ncrypt.dll 0xFCCE0000 0x3E000 C:\Windows\system32\ncrypt.dll
dhcpcsvc6.DLL 0xFCD30000 0x29000 c:\windows\system32\dhcpcsvc6.DLL
WINNSI.DLL 0xFCD60000 0xA000 c:\windows\system32\WINNSI.DLL
dhcpcsvc.DLL 0xFCD70000 0x46000 c:\windows\system32\dhcpcsvc.DLL
IPHLPAPI.DLL 0xFCDC0000 0x23000 c:\windows\system32\IPHLPAPI.DLL
wevtapi.dll 0xFCDF0000 0x64000 c:\windows\system32\wevtapi.dll
slc.dll 0xFCE60000 0x28000 c:\windows\system32\slc.dll
CRYPT32.dll 0xFCE90000 0x137000 C:\Windows\system32\CRYPT32.dll
MPR.dll 0xFCFD0000 0x18000 C:\Windows\system32\MPR.dll
NTDSAPI.dll 0xFD010000 0x26000 c:\windows\system32\NTDSAPI.dll
MSASN1.dll 0xFD040000 0x18000 C:\Windows\system32\MSASN1.dll
WMsgAPI.dll 0xFD060000 0x8000 C:\Windows\system32\WMsgAPI.dll
SAMLIB.dll 0xFD070000 0x1B000 C:\Windows\system32\SAMLIB.dll
NCObjAPI.DLL 0xFD090000 0x15000 C:\Windows\system32\NCObjAPI.DLL
DNSAPI.dll 0xFD0B0000 0x38000 c:\windows\system32\DNSAPI.dll
NETAPI32.dll 0xFD0F0000 0x99000 c:\windows\system32\NETAPI32.dll
cryptdll.dll 0xFD470000 0x14000 c:\windows\system32\cryptdll.dll
apphelp.dll 0xFD500000 0x35000 c:\windows\system32\apphelp.dll
SYSNTFY.dll 0xFD540000 0x9000 c:\windows\system32\SYSNTFY.dll
AUTHZ.dll 0xFD550000 0x26000 c:\windows\system32\AUTHZ.dll
Secur32.dll 0xFD580000 0x1B000 c:\windows\system32\Secur32.dll
USERENV.dll 0xFD5A0000 0x26000 c:\windows\system32\USERENV.dll
PSAPI.DLL 0xFD720000 0x8000 C:\Windows\system32\PSAPI.DLL
SHLWAPI.dll 0xFD730000 0x71000 C:\Windows\system32\SHLWAPI.dll
WLDAP32.dll 0xFD7B0000 0x55000 C:\Windows\system32\WLDAP32.dll
IMM32.DLL 0xFD810000 0x28000 C:\Windows\system32\IMM32.DLL
USP10.dll 0xFD840000 0x9A000 C:\Windows\system32\USP10.dll
SHELL32.dll 0xFD8E0000 0xC34000 C:\Windows\system32\SHELL32.dll
ADVAPI32.dll 0xFE520000 0xFF000 C:\Windows\system32\ADVAPI32.dll
SETUPAPI.dll 0xFE620000 0x1DE000 C:\Windows\system32\SETUPAPI.dll
iertutil.dll 0xFE800000 0x5A000 C:\Windows\system32\iertutil.dll
msvcrt.dll 0xFE860000 0xA1000 C:\Windows\system32\msvcrt.dll
LPK.DLL 0xFEA10000 0xC000 C:\Windows\system32\LPK.DLL
NSI.dll 0xFEA20000 0x7000 C:\Windows\system32\NSI.dll
RPCRT4.dll 0xFEA30000 0x139000 C:\Windows\system32\RPCRT4.dll
urlmon.dll 0xFEC00000 0x169000 C:\Windows\system32\urlmon.dll
CLBCatQ.DLL 0xFED70000 0x9C000 C:\Windows\system32\CLBCatQ.DLL
WS2_32.dll 0xFEE10000 0x44000 C:\Windows\system32\WS2_32.dll
imagehlp.dll 0xFEE60000 0x17000 C:\Windows\system32\imagehlp.dll
GDI32.dll 0xFF060000 0x61000 C:\Windows\system32\GDI32.dll
OLEAUT32.dll 0xFF0D0000 0xD8000 C:\Windows\system32\OLEAUT32.dll
MSCTF.dll 0xFF1B0000 0x104000 C:\Windows\system32\MSCTF.dll
############################
############################

I don't remember seeing this one yesterday.

Just for future reference for anyone else reading this, Filemon and Regmon
are not compatable with Vista, you will need to us Process Monitor
http://technet.microsoft.com/en-gb/s.../bb896645.aspx

TIA

"OlsBean" <OlsBean@discussions.microsoft.com> wrote in message
news:C1F9C43E-189D-49D6-A0AC-8A41DC089EFC@microsoft.com
....
> Thank you, that was my fault I did not include all the tabs in the
> information I posted, apologies, the process name is TrustedInstaller.exe
> below is complete report.

Excellent! I think these are the essential details from that report:

> Operation: RegOpenKey
> Result: ACCESS DENIED
> Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Com ponent Based
> Servicing\Packages\Package_1_for_KB905866~31bf3856 ad364e35~amd64~~6.0.13.0
> Desired Access: Read/Write
> Description: Windows Modules Installer
> Company: Microsoft Corporation
> Name: TrustedInstaller.exe
> Version: 6.00.6000.16386
> Path: C:\Windows\servicing\TrustedInstaller.exe
> Command Line: C:\Windows\servicing\TrustedInstaller.exe

> User: NT AUTHORITY\SYSTEM


> The registry key exists however the only perms attribute is 'System' with
> special allowed.


Which explains the symptom. I wonder how common this is among Vista
users and assuming not, how your system became disabled in this way?

The third-party security packages that PA Bear mentioned would be one way...


>
> I also had this Permission Denied in addition to the above when I ran WU
> this morning and monitored.


> Operation: RegOpenKey
> Result: ACCESS DENIED
> Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Win dowsUpdate\Auto Update

> Desired Access: Set Value
> Description: Host Process for Windows Services
> Company: Microsoft Corporation
> Name: svchost.exe
> Version: 6.00.6000.16386
> Path: C:\Windows\system32\svchost.exe
> Command Line: C:\Windows\system32\svchost.exe -k netsvcs

> User: NT AUTHORITY\SYSTEM


> I don't remember seeing this one yesterday.
>


Did you have verbose logging active? Perhaps the failing Set Value
would be documented there? Notice that with ProcMon (or concurrent
FileMon) that you could find the next WRITE to WindowsUpdate.log
and then correlate that trace entry with a specific log entry either by length
of write (+1) or by exact timestamp.

Also in your reply to PA Bear's suggestion to undo certain optional security
facilities you might be using you mentioned only disabling AVG.
I wonder if disabling it would be sufficient? E.g., would that be enough
to make it undo any permissions changes it might have made?
I think that such changes might be more likely by at least by uninstalling
such programs, assuming that a clean uninstall would enable that type
of undoing of all changes that they would have made. The idea is that
undoing such protections should avoid such atypical access problems
not make them worse.

BTW I didn't bother checking the list of modules loaded with each program
for any possible unusual names though I think that may be possible if any
were present. Again, someone who actually is using your OS and not having
a problem or someone more aware of Vista internals or even malware issues
in general would be in a better position to do that analysis.


> Just for future reference for anyone else reading this, Filemon and Regmon
> are not compatable with Vista, you will need to us Process Monitor
> http://technet.microsoft.com/en-gb/s.../bb896645.aspx


Do you have a reference or experience which proves that it doesn't work?


This document, which is linked from yours, doesn't say anything so explicit.

<title> RegMon for Windows v7.04 </title>
http://technet.microsoft.com/en-gb/s.../bb896652.aspx

In fact, the only implication on it for Vista is the same implication which
is available for XPsp2 users, which I use and on which RegMon works fine.

<quote>
Note: FileMon and RegMon have been replaced by Process Monitor on
versions of Windows starting with Windows 2000 SP4, Windows XP SP2,
Windows Server 2003 SP1, and Windows Vista. FileMon and RegMon
remain for legacy operating system support
</quote>


>
> TIA


HTH

Robert
---

"Robert Aldwinckle" wrote:

> "OlsBean" <OlsBean@discussions.microsoft.com> wrote in message
> news:C1F9C43E-189D-49D6-A0AC-8A41DC089EFC@microsoft.com
> ....
> > Thank you, that was my fault I did not include all the tabs in the
> > information I posted, apologies, the process name is TrustedInstaller.exe
> > below is complete report.
>
> Excellent! I think these are the essential details from that report:
>
> > Operation: RegOpenKey
> > Result: ACCESS DENIED
> > Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Com ponent Based
> > Servicing\Packages\Package_1_for_KB905866~31bf3856 ad364e35~amd64~~6.0.13.0
> > Desired Access: Read/Write
> > Description: Windows Modules Installer
> > Company: Microsoft Corporation
> > Name: TrustedInstaller.exe
> > Version: 6.00.6000.16386
> > Path: C:\Windows\servicing\TrustedInstaller.exe
> > Command Line: C:\Windows\servicing\TrustedInstaller.exe
>
> > User: NT AUTHORITY\SYSTEM
>
>
> > The registry key exists however the only perms attribute is 'System' with
> > special allowed.
>
>
> Which explains the symptom. I wonder how common this is among Vista
> users and assuming not, how your system became disabled in this way?
>
> The third-party security packages that PA Bear mentioned would be one way...
>
>
> >
> > I also had this Permission Denied in addition to the above when I ran WU
> > this morning and monitored.
>
>
> > Operation: RegOpenKey
> > Result: ACCESS DENIED
> > Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Win dowsUpdate\Auto Update
>
> > Desired Access: Set Value
> > Description: Host Process for Windows Services
> > Company: Microsoft Corporation
> > Name: svchost.exe
> > Version: 6.00.6000.16386
> > Path: C:\Windows\system32\svchost.exe
> > Command Line: C:\Windows\system32\svchost.exe -k netsvcs
>
> > User: NT AUTHORITY\SYSTEM
>
>
> > I don't remember seeing this one yesterday.
> >
>
>
> Did you have verbose logging active? Perhaps the failing Set Value
> would be documented there? Notice that with ProcMon (or concurrent
> FileMon) that you could find the next WRITE to WindowsUpdate.log
> and then correlate that trace entry with a specific log entry either by length
> of write (+1) or by exact timestamp.

That has gone a little over my head but I will try to digest and do it later
this evening, thank you.

> Also in your reply to PA Bear's suggestion to undo certain optional security
> facilities you might be using you mentioned only disabling AVG.
> I wonder if disabling it would be sufficient? E.g., would that be enough
> to make it undo any permissions changes it might have made?
> I think that such changes might be more likely by at least by uninstalling
> such programs, assuming that a clean uninstall would enable that type
> of undoing of all changes that they would have made. The idea is that
> undoing such protections should avoid such atypical access problems
> not make them worse.

I know from recent experience where AVG had a false positive on a legitimate
..exe that disabling the 'Resident Shield' allowed access to the file in order
for it to execute.

> BTW I didn't bother checking the list of modules loaded with each program
> for any possible unusual names though I think that may be possible if any
> were present. Again, someone who actually is using your OS and not having
> a problem or someone more aware of Vista internals or even malware issues
> in general would be in a better position to do that analysis.
>
>
> > Just for future reference for anyone else reading this, Filemon and Regmon
> > are not compatable with Vista, you will need to us Process Monitor
> > http://technet.microsoft.com/en-gb/s.../bb896645.aspx
>
>
> Do you have a reference or experience which proves that it doesn't work?
>
>
> This document, which is linked from yours, doesn't say anything so explicit.
>
> <title> RegMon for Windows v7.04 </title>
> http://technet.microsoft.com/en-gb/s.../bb896652.aspx
>
> In fact, the only implication on it for Vista is the same implication which
> is available for XPsp2 users, which I use and on which RegMon works fine.
>
> <quote>
> Note: FileMon and RegMon have been replaced by Process Monitor on
> versions of Windows starting with Windows 2000 SP4, Windows XP SP2,
> Windows Server 2003 SP1, and Windows Vista. FileMon and RegMon
> remain for legacy operating system support
> </quote>

When you run on Vista you get a message;

Filemon has been replaced by Systinternals Process Monitor for file system
monitoring on Windows Vista. Download the Process Monitor at...

and the application exits, similar message with Regmon.
>
>
> >
> > TIA
>
>
> HTH
>
> Robert
> ---
>
>
>

I wonder if manually modifying the permissions attributes on the offending
keys would work?

TIA

"OlsBean" wrote:

>
>
> "Robert Aldwinckle" wrote:
>
> > "OlsBean" <OlsBean@discussions.microsoft.com> wrote in message
> > news:C1F9C43E-189D-49D6-A0AC-8A41DC089EFC@microsoft.com
> > ....
> > > Thank you, that was my fault I did not include all the tabs in the
> > > information I posted, apologies, the process name is TrustedInstaller.exe
> > > below is complete report.
> >
> > Excellent! I think these are the essential details from that report:
> >
> > > Operation: RegOpenKey
> > > Result: ACCESS DENIED
> > > Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Com ponent Based
> > > Servicing\Packages\Package_1_for_KB905866~31bf3856 ad364e35~amd64~~6.0.13.0
> > > Desired Access: Read/Write
> > > Description: Windows Modules Installer
> > > Company: Microsoft Corporation
> > > Name: TrustedInstaller.exe
> > > Version: 6.00.6000.16386
> > > Path: C:\Windows\servicing\TrustedInstaller.exe
> > > Command Line: C:\Windows\servicing\TrustedInstaller.exe
> >
> > > User: NT AUTHORITY\SYSTEM
> >
> >
> > > The registry key exists however the only perms attribute is 'System' with
> > > special allowed.
> >
> >
> > Which explains the symptom. I wonder how common this is among Vista
> > users and assuming not, how your system became disabled in this way?
> >
> > The third-party security packages that PA Bear mentioned would be one way...
> >
> >
> > >
> > > I also had this Permission Denied in addition to the above when I ran WU
> > > this morning and monitored.
> >
> >
> > > Operation: RegOpenKey
> > > Result: ACCESS DENIED
> > > Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Win dowsUpdate\Auto Update
> >
> > > Desired Access: Set Value
> > > Description: Host Process for Windows Services
> > > Company: Microsoft Corporation
> > > Name: svchost.exe
> > > Version: 6.00.6000.16386
> > > Path: C:\Windows\system32\svchost.exe
> > > Command Line: C:\Windows\system32\svchost.exe -k netsvcs
> >
> > > User: NT AUTHORITY\SYSTEM
> >
> >
> > > I don't remember seeing this one yesterday.
> > >
> >
> >
> > Did you have verbose logging active? Perhaps the failing Set Value
> > would be documented there? Notice that with ProcMon (or concurrent
> > FileMon) that you could find the next WRITE to WindowsUpdate.log
> > and then correlate that trace entry with a specific log entry either by length
> > of write (+1) or by exact timestamp.
>
> That has gone a little over my head but I will try to digest and do it later
> this evening, thank you.
>
> > Also in your reply to PA Bear's suggestion to undo certain optional security
> > facilities you might be using you mentioned only disabling AVG.
> > I wonder if disabling it would be sufficient? E.g., would that be enough
> > to make it undo any permissions changes it might have made?
> > I think that such changes might be more likely by at least by uninstalling
> > such programs, assuming that a clean uninstall would enable that type
> > of undoing of all changes that they would have made. The idea is that
> > undoing such protections should avoid such atypical access problems
> > not make them worse.
>
> I know from recent experience where AVG had a false positive on a legitimate
> .exe that disabling the 'Resident Shield' allowed access to the file in order
> for it to execute.
>
> > BTW I didn't bother checking the list of modules loaded with each program
> > for any possible unusual names though I think that may be possible if any
> > were present. Again, someone who actually is using your OS and not having
> > a problem or someone more aware of Vista internals or even malware issues
> > in general would be in a better position to do that analysis.
> >
> >
> > > Just for future reference for anyone else reading this, Filemon and Regmon
> > > are not compatable with Vista, you will need to us Process Monitor
> > > http://technet.microsoft.com/en-gb/s.../bb896645.aspx
> >
> >
> > Do you have a reference or experience which proves that it doesn't work?
> >
> >
> > This document, which is linked from yours, doesn't say anything so explicit.
> >
> > <title> RegMon for Windows v7.04 </title>
> > http://technet.microsoft.com/en-gb/s.../bb896652.aspx
> >
> > In fact, the only implication on it for Vista is the same implication which
> > is available for XPsp2 users, which I use and on which RegMon works fine.
> >
> > <quote>
> > Note: FileMon and RegMon have been replaced by Process Monitor on
> > versions of Windows starting with Windows 2000 SP4, Windows XP SP2,
> > Windows Server 2003 SP1, and Windows Vista. FileMon and RegMon
> > remain for legacy operating system support
> > </quote>
>
> When you run on Vista you get a message;
>
> Filemon has been replaced by Systinternals Process Monitor for file system
> monitoring on Windows Vista. Download the Process Monitor at...
>
> and the application exits, similar message with Regmon.
> >
> >
> > >
> > > TIA
> >
> >
> > HTH
> >
> > Robert
> > ---
> >
> >
> >
>
> I wonder if manually modifying the permissions attributes on the offending
> keys would work?
>
> TIA

OK I took the bull by the horns, manually editing the permissions on the
offending key seems to have worked and I now have a fully working Windows
Update back.

Thank you to everyone that contributed, helping me solve this issue.

Best Wishes.

OlsBean wrote:
<snip>> OK I took the bull by the horns, manually editing the permissions on
the
> offending key seems to have worked and I now have a fully working Windows
> Update back.
>
> Thank you to everyone that contributed, helping me solve this issue.

You should understand that a hijackware infection may have caused the
problem.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/