[Teppotastic]

I'll try and keep it brief: Lately when trying to install the latest from Windows Update, it DLs, Installs then when I reboot it gets caught on the step involving "partmgr.sys" for a few seconds then finishes the boot and tells me that the update failed.

I've tried troubleshooting Windows Update, clearing .NET 4 and .NET 3.5 off and reinstalling but to no avail. I'm not sure which update it is that's causing it, but I believe it to be one of the two .NET ones. I'll list them now for reference:

MS12-035: Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: May 8, 2012 (http://support.micro....com/kb/2604115)

MS12-034: Description of the security update for the .NET Framework 3.5.1 on Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1: May 8, 2012 (http://support.micro....com/kb/2656411)

MS12-025: Description of the security update for the .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: April 10, 2012 (http://support.micro....com/kb/2656368)

Microsoft Security Bulletin MS12-034 - Critical (http://technet.micro...lletin/ms12-034) KB2658846 , KB2659262 , KB2676562

Microsoft Security Bulletin MS12-032 - Important (http://technet.micro...lletin/ms12-032) KB2688338

Microsoft Security Bulletin MS12-033 - Important (http://technet.micro...lletin/ms12-033) KB2690533

Microsoft Security Advisory (2695962) (http://technet.micro...dvisory/2695962)

Any advice would be appreciated. Don't hold back

[Advertisements]

Before I start, would you please list ALL you have tried.

[Macboatmaster]

Before I start, would you please list ALL you have tried.

[Teppotastic]

As I said, I've tried uninstalling and reinstalling the .NET frameworks; "troubleshooting" the Windows Update function; using msconfig for a selective boot with only MS services; running Malwarebytes, Spybot and Microsoft Security Essentials to see if I'd missed anything troublesome; Downloading the updates manually; ran sfc /scannow in an elevated cmd prompt.

I think that's about it. I haven't tried grabbing a Win7+SP1 bootdisk (only got my original W7 disc to-hand) and using it's repair function. Come to think of it, I haven't tried a chkdsk of any kind either. I should've thought of that one earlier.


I am ready to receive your wisdom!

I'm an IT Tech IRL, so don't be afraid to shower me in arcane workings - I promise to keep up

[Macboatmaster]

Run whichever is applicable please

To save me checking each you have listed on the updates in your post

eg the x86 or 64 bit

• System Update Readiness Tool for Windows 7 (KB947821) [download]
• System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [download]

It appears does it not that it is this update
- Important (http://technet.micro...lletin/ms12-033) KB2690533

that is now causing the partmgr.sys hang as that update was concerned with a vulnerability in windows partition manager.

[Teppotastic]

I tried the system readiness tool (x64) and then just that single update but I still get the same problem.

Have set a boot-time chkdsk running while I'm at work to see if that makes any difference.

What's next to try?

[Macboatmaster]

If that gets you no further try a total reset of the window updates components
http://support.microsoft.com/kb/971058

YOU may use either automated fix or the manual procedure


Have you tried with your Firewall - if not the Windows firewall disabled.
If it was ONLY the Net Framework, albeit that most of them are I would recommend this, the standard solution for Net Framework update issues

http://blogs.msdn.co...28/8904493.aspx

You may be familiar with it but before you use the cleanup tool you should check the troubleshooting procedures including the standard uninstall of all net frameworks from programs and features.

[Teppotastic]

I tried the automated tool to reset the windows updated components and though it detects a fault and repairs it, it didn't make a difference to the original problem.

I don't think it's the .NET ones specifically, since talking to you, the small update that is supposed to fix a vulnerability in partmgr.sys seems to be producing the problem all on it's own.

Going to try installing all the updates expect that one and then I'll update back here.

EDIT:: As I suspected - all the other Updates have installed now I didn't have the one containing the partmgr.sys fix in it. That just leaves (http://technet.micro...lletin/ms12-033) KB2690533

Edited by Teppotastic, 17 May 2012 - 08:50 AM.

[Macboatmaster]

though it detects a fault and repairs it, it didn't make a difference to the original problem.

I am a little confused. Am I being slow - surely it has made a difference as now all have installed except this one, whereas before none installed.

I know you mention you have tried manually - I am not sure if you mean separately from windows update site - using custom install or of you mean from here
http://www.microsoft...s.aspx?id=29824

Try this 64 bit with sp1 - a number of people have reported success on the direct download link

ALTHOUGH research produces this

http://www.community...ft-updates-r167

now you have the rest perhaps a wait and see what problems are indeed reported may be the better idea

[Teppotastic]

though it detects a fault and repairs it, it didn't make a difference to the original problem.

Apologies, I wasn't very clear.

Originally (before starting this thread) I hadn't actually tried each update individually and a little research on the internet suggested it was an issue with the .NET updates. This wasn't the case.

So though Mr Fix did repair something in Windows Update - the updates other than the one associated with partmgr.sys probably would've installed anyway. Though there's no way to be sure now and it's largely academic.

What remains is just the one that updates partmgr.sys. Which the Mr Fix tool didn't affect at all.

RE: your other suggestions - I have been using the manual DL version of KB2690533 as I at first thought it might've been a corrupt DL through the Windows Update system. But it produces the same problem.

I think I might take your advice and wait a couple of days now. It's not causing any other problems with using the PC at the moment.

I've also put a post in with Microsoft Answers and I'll be sure to update this thread should they come up with a solution.

Lastly, I just want to thank you again for your assistance and patience. You've been a great help working through possibilities

[Macboatmaster]

Just one final matter before I leave you, although of course I will receive notification if you post

What is the error shown on event viewer and secondly on the manual download I sent the 64bit SP1
May I presume that is the ONE you tried.

You will know of course that the updates written for SP1 are different to those written for 7 without SP1 - in respect of this update.
Now please do not think I am teaching the already taught, but it is so easy to miss the selection for the 64 bit SP1

[Teppotastic]

No worries, I have been sure to get the right versions of everything I've DLed. That is to say Windows 7 SP1 x64

in the Event logs I'll get such things as this:

Log Name:      Application
Source:        Windows Error Reporting
Date:          17/05/2012 15:40:29
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Quora
Description:
Fault bucket 2963608948, type 5
Event Name: WindowsUpdateFailure
Response: Not available
Cab Id: 0

Problem signature:
P1: 7.5.7601.17514
P2: 80071a2d
P3: 1EE0304A-549A-4A2A-9505-9B58E1AC6625
P4: Install
P5: 101
P6: Unmanaged
P7: 
P8: 
P9: 
P10: 

Attached files:

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_7.5.7601.17514_f342d938dcf330b969421a2bd7b63f5aee56d2a_0eda82a6

Analysis symbol: 
Rechecking for solution: 0
Report Id: 3c64fa80-a02e-11e1-ba7b-00221588e24e
Report Status: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-17T14:40:29.000000000Z" />
    <EventRecordID>32819</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Quora</Computer>
    <Security />
  </System>
  <EventData>
    <Data>2963608948</Data>
    <Data>5</Data>
    <Data>WindowsUpdateFailure</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>7.5.7601.17514</Data>
    <Data>80071a2d</Data>
    <Data>1EE0304A-549A-4A2A-9505-9B58E1AC6625</Data>
    <Data>Install</Data>
    <Data>101</Data>
    <Data>Unmanaged</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_7.5.7601.17514_f342d938dcf330b969421a2bd7b63f5aee56d2a_0eda82a6</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>3c64fa80-a02e-11e1-ba7b-00221588e24e</Data>
    <Data>0</Data>
  </EventData>
</Event>

this:

Log Name:      Application
Source:        Windows Error Reporting
Date:          17/05/2012 15:40:25
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Quora
Description:
Fault bucket , type 0
Event Name: WindowsUpdateFailure
Response: Not available
Cab Id: 0

Problem signature:
P1: 7.5.7601.17514
P2: 80071a2d
P3: 1EE0304A-549A-4A2A-9505-9B58E1AC6625
P4: Install
P5: 101
P6: Unmanaged
P7: 
P8: 
P9: 
P10: 

Attached files:

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.5.7601.17514_f342d938dcf330b969421a2bd7b63f5aee56d2a_cab_0ece72ed

Analysis symbol: 
Rechecking for solution: 0
Report Id: 3c64fa80-a02e-11e1-ba7b-00221588e24e
Report Status: 4
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-17T14:40:25.000000000Z" />
    <EventRecordID>32818</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Quora</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>WindowsUpdateFailure</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>7.5.7601.17514</Data>
    <Data>80071a2d</Data>
    <Data>1EE0304A-549A-4A2A-9505-9B58E1AC6625</Data>
    <Data>Install</Data>
    <Data>101</Data>
    <Data>Unmanaged</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.5.7601.17514_f342d938dcf330b969421a2bd7b63f5aee56d2a_cab_0ece72ed</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>3c64fa80-a02e-11e1-ba7b-00221588e24e</Data>
    <Data>4</Data>
  </EventData>
</Event>

this:

Log Name:      Application
Source:        Windows Error Reporting
Date:          17/05/2012 15:39:34
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Quora
Description:
Fault bucket 2963767281, type 5
Event Name: CbsPackageServicingFailure2
Response: Not available
Cab Id: 0

Problem signature:
P1: 6.1.7601.17592
P2: Package_for_KB2690533
P3: 6.1.1.0
P4: amd64
P5: unknown
P6: 80071a2d
P7: POQ
P8: Staged
P9: Installed
P10: WindowsUpdateAgent

Attached files:
C:\Windows\Logs\CBS\CbsPersist_20120516062601.cab
C:\Windows\Logs\CBS\CbsPersist_20120516162046.cab
C:\Windows\Logs\CBS\CbsPersist_20120516171040.cab
C:\Windows\Logs\CBS\CbsPersist_20120517070125.cab
C:\Windows\Logs\CBS\CbsPersist_20120517141033.cab
C:\Windows\Logs\CBS\CBS.log
C:\Windows\servicing\Sessions\Sessions.xml
C:\Windows\winsxs\poqexec.log
C:\Windows\inf\setupapi.dev.log

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Critical_6.1.7601.17592_3e2202dc11b55d2b19e9e2cbf5c4c1add4e2e0_0d35ad00

Analysis symbol: 
Rechecking for solution: 0
Report Id: 152c92c1-a02e-11e1-ba7b-00221588e24e
Report Status: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-17T14:39:34.000000000Z" />
    <EventRecordID>32816</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Quora</Computer>
    <Security />
  </System>
  <EventData>
    <Data>2963767281</Data>
    <Data>5</Data>
    <Data>CbsPackageServicingFailure2</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>6.1.7601.17592</Data>
    <Data>Package_for_KB2690533</Data>
    <Data>6.1.1.0</Data>
    <Data>amd64</Data>
    <Data>unknown</Data>
    <Data>80071a2d</Data>
    <Data>POQ</Data>
    <Data>Staged</Data>
    <Data>Installed</Data>
    <Data>WindowsUpdateAgent</Data>
    <Data>
C:\Windows\Logs\CBS\CbsPersist_20120516062601.cab
C:\Windows\Logs\CBS\CbsPersist_20120516162046.cab
C:\Windows\Logs\CBS\CbsPersist_20120516171040.cab
C:\Windows\Logs\CBS\CbsPersist_20120517070125.cab
C:\Windows\Logs\CBS\CbsPersist_20120517141033.cab
C:\Windows\Logs\CBS\CBS.log
C:\Windows\servicing\Sessions\Sessions.xml
C:\Windows\winsxs\poqexec.log
C:\Windows\inf\setupapi.dev.log</Data>
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Critical_6.1.7601.17592_3e2202dc11b55d2b19e9e2cbf5c4c1add4e2e0_0d35ad00</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>152c92c1-a02e-11e1-ba7b-00221588e24e</Data>
    <Data>0</Data>
  </EventData>
</Event>

and finally this:

Log Name:      Application
Source:        Windows Error Reporting
Date:          17/05/2012 15:39:32
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Quora
Description:
Fault bucket 1303633107, type 5
Event Name: WINDOWS_WCP_POQEXEC_FAILURE2
Response: Not available
Cab Id: 0

Problem signature:
P1: 6.1.7601
P2: c0190003
P3: HardLinkFile
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
C:\Windows\Logs\CBS\CbsPersist_20120516062601.cab
C:\Windows\Logs\CBS\CbsPersist_20120516162046.cab
C:\Windows\Logs\CBS\CbsPersist_20120516171040.cab
C:\Windows\Logs\CBS\CbsPersist_20120517070125.cab
C:\Windows\Logs\CBS\CbsPersist_20120517141033.cab
C:\Windows\Logs\CBS\CBS.log
C:\Windows\servicing\Sessions\Sessions.xml
C:\Windows\winsxs\pending.xml
C:\Windows\winsxs\poqexec.log
C:\Windows\System32\LogFiles\Scm\SCM.EVM
C:\Windows\Logs\CBS\FilterList.log
C:\Windows\winsxs\Temp\LogFiles\NtfsLog.etl
C:\Windows\Temp\WER74C1.tmp.hdmp
C:\Windows\Temp\WER75FA.tmp.mdmp

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Critical_6.1.7601_e695c97b3bfee3a6a3aeb3731758fe8225474cb_0ccda488

Analysis symbol: 
Rechecking for solution: 0
Report Id: 152c92c0-a02e-11e1-ba7b-00221588e24e
Report Status: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-17T14:39:32.000000000Z" />
    <EventRecordID>32815</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Quora</Computer>
    <Security />
  </System>
  <EventData>
    <Data>1303633107</Data>
    <Data>5</Data>
    <Data>WINDOWS_WCP_POQEXEC_FAILURE2</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>6.1.7601</Data>
    <Data>c0190003</Data>
    <Data>HardLinkFile</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Windows\Logs\CBS\CbsPersist_20120516062601.cab
C:\Windows\Logs\CBS\CbsPersist_20120516162046.cab
C:\Windows\Logs\CBS\CbsPersist_20120516171040.cab
C:\Windows\Logs\CBS\CbsPersist_20120517070125.cab
C:\Windows\Logs\CBS\CbsPersist_20120517141033.cab
C:\Windows\Logs\CBS\CBS.log
C:\Windows\servicing\Sessions\Sessions.xml
C:\Windows\winsxs\pending.xml
C:\Windows\winsxs\poqexec.log
C:\Windows\System32\LogFiles\Scm\SCM.EVM
C:\Windows\Logs\CBS\FilterList.log
C:\Windows\winsxs\Temp\LogFiles\NtfsLog.etl
C:\Windows\Temp\WER74C1.tmp.hdmp
C:\Windows\Temp\WER75FA.tmp.mdmp</Data>
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Critical_6.1.7601_e695c97b3bfee3a6a3aeb3731758fe8225474cb_0ccda488</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>152c92c0-a02e-11e1-ba7b-00221588e24e</Data>
    <Data>0</Data>
  </EventData>
</Event>

Apologies for the long post. Couldn't think of a better way to display this information :/

[Macboatmaster]

Well as far as I can see there is no really useful information there, although I have to say that analysing these logs is approaching the limit of my knowledge.

What I have found after researching the issue on Microsoft Tech Net is this
What does the update do?
The update addresses the vulnerability by correcting the way that Windows Partition Manager allocates objects in memory.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through coordinated vulnerability disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.


What I have also found is numerous reports of it failing.

I think, as the others have installed OK now - for whatever the reason they did, and it is apparently just this ONE, that I opine that you wait to see if a meaningful response is received from Microsoft.
Installing from the system admin account may produce results, it tneds to eliminate any issue of permissions on a user account with admin rights.

The previously mentioned firewall and AV - if you have not already tried.

Other than that and especially in view of the above I think it is a case of watchful waiting at this time.

Thanks for being great to work with.