Windows Update Problem

[charel]

Hi All,

We have 3 new HP d530SFF PCs. We intend on building one up and ghosting the others, and having an image for later use.

I go to Windows Update and am made to download & install the 'updated' version of windows update.

When i go to scan for updates, i get the message:
Generic Host for Win32 Services has encountered a problem and needs to close.

The error data report contains the error signature:
szAppName: szAppVer: 0.0.0.0 szModName: unknown
szModVer: 0.0.0.0 offset: 00000000

I pulled the second PC out of the box hoping it might have been a one off issue, and ghosting would fix it. The same happened after updating windows update software. I then ran the restore CD and reinstalled WinXP. Now i don't get an error message when i scan for updates, but the PC hangs. Nothing shows up in event viewer in relation to this.

Has anyone seen this before??

 

[bcastner]

Your image is Sasser infected.

You need to re-image with a slipstream of Service Pack 2.

 

[charel]

thanks for the tip bcastner.. i just downloaded and ran the microsoft sasser detection tool and it came back clean.. We don't want to go to SP2 yet - is there another workaround that you know of??

 

[bcastner]

If at the end of the error message display, what does it say?

For example:

http://support.microsoft.com/default.aspx?scid=kb;en-us;821690&Product=winxp

 

[charel]

The error data report contains the error signature:
szAppName: szAppVer: 0.0.0.0 szModName: unknown
szModVer: 0.0.0.0 offset: 00000000

i've rebooted as the pc hung while scanning for updates this time, and have checked the event viewer for any info. There are a few app entries referring to ESENT with event ids 100, 101, 102, & 103.

 

[bcastner]

See:

http://www.winxptutor.com/sp2/esent.htm

When the site search returns I will post a link to a little script by Jim Eshelmen, MS-MVP to repair/rebuild the needed catroot databases.

Bill

 

[charel]

that link sounds exactly like what's happening. But i haven't downloaded SP2 yet. I haven't loaded any updates. Is there a workaround for SP2 users?

 

[bcastner]

Start with the early post on the problem:

From: "David Kays [MSFT]" <dkays@online.microsoft.com>
Subject: Re: ESENT Messages
Date: Fri, 13 Aug 2004 15:01:45 -0700

Message-ID: <OqXSgEYgEHA.3964@TK2MSFTNGP12.phx.gbl>
Newsgroups: microsoft.public.windowsupdate

This is a known issue with the WU v5 client. It has to do with how the client agent interacts with the Jet database engine. This is something we'll consider fixing in a future version of the WU client. I'm not aware of work arounds for this issue, sorry.

. for pre-sp2 clients, use the original update site instead of the v5 site.

. Prior to doing so, do a reset of the catroot folder:

http://support.microsoft.com/Default.aspx?kbid=822798

I would appreciate anyone with a better institutional memory than I answering exactly this question for both pre and SP2 installations, involving a little utility to reset the catroot databases. I just cannot turn it up very quickly, but it will work as the earier thread attests.