No updates possible 80072EFE

Since a few days now, it is completely impossible for me to receive updates
for Windows 7 Ultimate.

I keep getting an 80072EFE error.
When I try to go to the microsoft update website itself, something seems to
stop me, saying "The page can not be displayed", and I have had browser
issues for a few days too, ie. when I follow a link I searched on Google, I
get sent to advertising websites, and, as mentioned before, something seems
to block the sites which could help me sort out my problem.

I have already done Malware checks with Spybot Search and Destroy, Lavasoft
Ad-Aware and Malwarebytes Anti-Malware, all to no avail at all.
I have also tried the Microsoft FixIt tool, which did not help in the
slightest neither.

Does anyone recognise my problem?
If anyone can help me sort this out, the advice will be very gratefully
accepted.

Did you upgrade to Win7 or is it a brand-new computer?

Are you running Win7 64-bit?

What anti-virus application or security suite is /installed/ and is your
subscription current? What anti-spyware applications (other than Defender)?
What third-party firewall (if any)?

Has a(another) Norton or McAfee application ever been installed on the
computer (e.g., a free-trial version that came preinstalled when you bought
it)?

First off, unlike XP, Windows 7 does *NOT* update from either the
Windows or Microsoft Update site via Internet Explorer, it updates
*directly* from the update servers via the Windows Update icon in
Control Panel.

You mention you've already done malware checks with Spybot, Adaware, and
MBAM. How did you get to those sites if, as you state above, "something"
is blocking "the sites which could help me sort out my problem " ?

What happens when you open the Windows Update icon in Control Panel and
then click the Check for updates link in the left frame ?

If the system still can not search for updates, please post the *last*
50 or so lines of the WindowsUpdate.log into your reply:

How to read the Windowsupdate.log file
http://support.microsoft.com/kb/902093

Ran Win 7 from the beginning.
Not brand new, about 7 months old, but the problem only occurred now

AVG Free, Spybot Search and Destroy, yesterday and to day I also installed
Lavasoft Ad-Aware and Malwarebytes Anti-Malware.
No.

How did I get to those sites?
Well I didn't.
And what happens when I use the Win7 Updates Utility is that get the Shield
in red and the message "Windows could not check for new updates. An error
occurred while checking for new updates for your computer. Errors found:
Code 80072EFE Windows Update encountered an unknown error".
And then finally, as you requested (thanks for posting the link):
"2010-05-08 17:15:35:470 1524 edc Misc WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x80072efe
2010-05-08 17:15:35:470 1524 edc Misc WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x80072efe

The 2 most notable entries indicate that the Windows Update Agent(WUA)
is a Version behind the current one and that a proxy server is
interfering with the communication between the update servers and your
system. I suspect this is related to AVG and/or one of Spybot's protections.

If AVG is set to scan incoming email, then a proxy server has been set
up. You can remove proxy settings but AVG may reset them again unless
you configure it to *not* scan incoming email. There is really no need
to scan incoming email as any reliable AV will detect malicious content
if/when you attempt to view/open it and alert you or, even more likely,
quarantine/delete said malicious content.

One of Spybot's components may be causing an issue with the installation
of the latest Version of the WUA. TeaTimer and SDHelper are 2 of those
components.
The article below shows how to access the options to enable or disable
TeaTimer and SD Helper:

How to enable/disable Spybot Tea timer
http://www.malwarehelp.org/how-to-en...-teatimer.html
Suggest you configure the system to Clean boot:

How to troubleshoot a problem by performing a clean boot in Windows
Vista or in Windows 7
http://support.microsoft.com/kb/929135

After the Clean boot, download and *save* the latest Version of the WUA:
http://download.windowsupdate.com/wi...gent30-x86.exe

You can also obtain it from link on this MS KB:
http://support.microsoft.com/kb/949104

It's under " Windows Vista, Windows Server 2008, Windows XP, Windows
Server 2003, and Windows 2000 Service Pack 4 " but, as you see, Windows
7 is not listed as one of the OS' that it works on:

Once the download completes, close *any* open programs and browsers.

Click the Start orb > in the 'Search programs and files' field type in
services
Under Programs, *right* click Services and choose 'Run as
administrator'. Agree to the UAC prompt to allow the Services console to
run Elevated.
Scroll down the list of Service and Stop these 2 for now:
Background Intelligent Transfer Service (BITS)
Windows Update
Click on each Service to highlight it and then click the Stop link to
the left.

Run windowsupdateagent30-x86.exe now. If you are prompted to restart the
system, decline to do so. You can close the Services console now as when
the system is restarted, both services should start *unless* their
Startup type has been changed from their Default setting.

Both services should be set to Automatic (Delayed start) but BITS can be
set to Manual if you so desire.

Click the Start orb once more and in the Search field type in
cmd
Under Programs, *right* click cmd.exe and choose 'Run as admin' again;
agree to the UAC prompt.
At the prompt type in the below commands pressing Enter after *each* command

netsh winhttp reset proxy
exit

Restart the system now and, while *still* in the Clean boot state, open
Windows Update in Control Panel and see if the system can search for
updates.
If it can, decline to install the updates and configure the system to
start in normal Windows mode by UNdoing the Clean boot steps.

Once the system is booted to normal Windows mode, see if it can search
for and install updates.

If it can, then you're done.
If it can not, post the last 50 or so lines of the WindowsUpdate.log
into your reply.

What happens now when you open Windows Update
in the Control Panel ?

Again, Windows 7 does *NOT* update via Internet Explorer accessing the
Windows Update site and I do not understand why you are clicking links
to WU on the KB article.
In Windows 7, when one clicks a link to the WU site then the Windows
Update Control Panel window is supposed to open. If it's not, then
either the system is being redirected by a DNS exploit or the OS has
been exploited by malware.

1) Did you do the steps to reset the proxy configuration to no proxy
server ?
2)Is the system on a wireless or wired network ?
3)a. Have you checked for the presence of malware while in *Safe Mode*
with MBAM's most *recent* definitions installed ?
b. Where did you download MBAM from and, can you access this page ?
http://www.malwarebytes.org/
4) Open the Windows Update icon in Control Panel.
Click the Check for updates link in the left frame. What happens ?
If the system still can not update, then please post at least the last
50 or so lines of the WindowsUpdate.log into your reply along with the
**above requested information**.

Thanks for that great explanation,
however,
when I go to http://support.microsoft.com/kb/949104 and then click the link
to the Windows Update site, I am greeted with "Internet Explorer cannot
display the webpage", which is what I mentioned in the previous post about
it looks like the websites that can help have been blocked.

By the way, this still happens after the "Clean Boot".

That is why I think the problem of being sent to advertising sites when
clicking on a link in Google search has something to do with it.
I think something is holding my PC hostage and preventing it from going to
Microsoft download sites in the process.

I really don't know where to go from here.
I also completed the steps you mentioned about Spybot and AVG.

So, if you know any further solutions apart from re-formatting the whole
system (which I am very reluctant to do) I would be very grateful for any
further help.

And here is the excerpt from the log file:
2010-05-10 21:39:14:178 1516 2de0 AU # WARNING: Failed to find updates
with error code 80072EFE
2010-05-10 21:39:14:178 1516 2de0 AU #########
2010-05-10 21:39:14:178 1516 2de0 AU ## END ## AU: Search for updates
[CallId = {72E4CC59-0141-4FD7-8F9C-AC3EC5EBF329}]
2010-05-10 21:39:14:178 1516 2de0 AU #############
2010-05-10 21:39:14:319 1516 2de0 AU Successfully wrote event for AU health
state:0
2010-05-10 21:39:14:319 1516 2de0 AU AU setting next detection timeout to
2010-05-11 01:39:14
2010-05-10 21:39:14:360 1516 2de0 AU Setting AU scheduled install time to
2010-05-11 02:00:00

I am having the same issue, same error, same hijacked search engines, with
Winows XP version and IE8. This has to be some sort of bug. I notified
Microsoft, but no answer yet. I even tried to download another browser
(Google Chrome) and it does not allow that either. Windows Onecare and Iobit
ASC can't stop it either. I am using another pc to write this message
because the bug will not allow me to access this forum from the affected
computer.

I have this same problem - I DID have Norton installed before I too installed
AVG and Spybot. I have had no update since March. I have tried other
suggested solutions.
Any advice gratefully received.

I suspect the above is the most likely place where the system is being
surreptitiously redirected IF there's no malware present on the system.

The Version of the Windows Update Agent (WUA) is still one Version
behind and the WindowsUpdate.log shows the system is still attempting to
try to connect via a proxy server to the update servers,

Can you bypass the wireless router and connect the system up with a
direct, wired connection to the broadband modem for now ?

*If* you can and, if you have not done so yet, download and save the WUA:
http://download.windowsupdate.com/wi...gent30-x86.exe
( If you've already downloaded and saved it, there's no need to download
it again )

Once the download completes DISCONNECT the system from the modem.

Click the Start orb > in the 'Search programs and files' field type in
services
Under Programs, *right* click Services and choose 'Run as
administrator'. Agree to the UAC prompt to allow the Services console to
run Elevated.
Scroll down the list of Service and Stop these 2 for now:

Background Intelligent Transfer Service (BITS)
Windows Update

Click on each Service to highlight it and then click the Stop link to
the left. Close the Services console and run
windowsupdateagent30-x86.exe, then restart the system.

Reconnect the system to the *broadband modem*, **NOT** the wireless
router, open Windows Update and and see if the system can check for updates.
If it can, have the system download and install all detected updates.
Restart if requested to.

If the system was able to check for, download, and install updates, then
suggest you disconnect the direct, wired connection to the modem and
connect to the internet via the wireless router.
Once that's done, do another Check for updates via the Windows Update
icon in the Control Panel.

What happens(ed)

1) Did the Windows Update Agent install successfully this time ?
The WindowsUpdate.log will have an entry like this if it did. Start from
the bottom of the log and work your way up to locate it:
2010-05-11 12:59:31:629 952 e50 Agent * WU client version 7.4.7600.226

2) Was the system able to check for, download, and install updates when
it was connected by direct, wired connection to the modem ?

3) Can the system check for updates via the wireless connection?

1) The WU.log does show that the most recent Version of the WUA is now
installed:
2010-05-12 09:01:51:653 1668 17a4 Report WER Report sent:
7.4.7600.226

2) I'm not clear on your response to this question -
Was the system connected *to the modem and **NOT** to the wireless
router* when the 80072EFE error occurred ?
*** Can the laptop or any other system on the network update when they
are connected to the *wireless router* ? ***

If the desktop has not been directly hooked up to the broadband modem
via an ethernet cable as yet or even if it has, then suggest you first
run the below from an Elevated Command Prompt to see if there is a proxy
server still interfering with communication with the update servers -

Click the Start orb, in the Search field type in
cmd
Under Programs, *right* click cmd.exe and choose 'Run as admin'; agree
to the UAC prompt.
At the prompt type in the below command, pressing Enter after doing so

netsh winhttp show proxy

The result will be - " Current WinHTTP proxy settings: "
If there is no proxy interfering, then it will state
"Direct acess <no proxy server>. "
If a proxy is listed, then type in the following, pressing Enter after
*each* command

netsh winhttp reset proxy
exit

Restart the system. Once it's booted up, open Windows Update in Control
Panel and click the Check for updates link in the left frame.

Can the system access the update servers now ?
Was a proxy showing when you ran the command ?

Since all of the
other systems can update via the wireless router then the communication
issue with the desktop is NOT being caused by a redirect exploit in the
router.
Suggest you flush the DNS cache of the problematic system.
Once again, open an Elevated Command Prompt.
At the prompt type in the below commands pressing Enter after *each* one.
After you enter the first command you should get a message stating
"Windows IP Configuration. Successfully flushed the DNS Resolver Cache."

ipconfig /flushdns
exit

Open Windows Update in Control Panel; click the Check for updates link.
Does the error still occur ?

The 'troubleshooters' are *supposed* to resolve issues. In an ideal
world I suppose they would. In reality, sometimes they work , other
times, they can't.

I suspect that either an ActiveX updating component or malware is at
causing this issue if all that we've done so far has not resolved this
issue.

Do you have the Windows 7 installation DVD on hand so that we can try
an 'in-place upgrade' AKA, repair installation ?
That may be the only way to determine whether this is a malware or an OS
issue.

I downloaded it on my laptop and then copied it to the PC via the network.
I checked, but it does not look as this line appears in the log.
Then again, there is a lot there and it is probably easily missed.

After installing the new WUA, during the reboot, I got the message
"Configuring Updates, do not turn off your computer"
However, when running WU after reboot, same result, same error (80072EFE).

Unfortunately, answer as above (Error 80072EFE).

Here is some more stuff from the log file:

2010-05-12 09:01:51:548 1668 a00 AU Successfully wrote event for AU health
state:0
2010-05-12 09:01:51:548 1668 a00 AU AU setting next detection timeout to
2010-05-12 13:01:51
2010-05-12 09:01:51:549 1668 a00 AU Setting AU scheduled install time to
2010-05-13 02:00:00
2010-05-12 09:01:51:549 1668 a00 AU Successfully wrote event for AU health
state:0
2010-05-12 09:01:51:550 1668 a00 AU Successfully wrote event for AU health
state:0

Unfortunately, I could not connect via an ethernet cable.
No long enough cable available to get to the router.

Yes, all the other laptops on the system can receive updates.

It showed "Direct access <no proxy server>".
The problem still remains.
The troubleshooter for the updates says:
"Temporary network problems are preventing your computer from scanning the
Windows Update server and downloading updates".
(Although I sometimes wonder why Microsoft bother to give us
troubleshooters).

thank you once again for all your assistance and patience while providing
it.
However, after doing what you said, the error still occurs.

By the way, I don't know whether that is relevant, but when I right-click on
'cmd' and do "Run as administrator", I get no prompts at all, immediately
the command prompt screen opens.

And yes, I have an installation DVD handy.

The one in my name, which is an Administrator account.

Don't think so, as I am not sure what an UAC prompt is, only mine
(Administrator) and a Guest account, which is indeed off.

Again, nothing that looked like a prompt, the slider is set to "Never
Notify".

I have now set the slider to the position you recommended.
http://technet.microsoft.com/en-us/l.../cc512587.aspx
Rebuild your system from scratch.

Once again, you're mowst welcome. Please open User Accounts in the
Control Panel.

1) The User Accounts window should open to your User Account page
regardless of the Account type. How many accounts are listed and what
are the account types (EX: Administrator; Standard user) ?

2) Click the 'Manage another account' link. Was there a UAC prompt ?
Again, how many accounts besides the Guest account, which should be OFF,
are listed ? What are the account types ?

3) Click the back *arrow* at the top left of the window or click the
'Go to the main User Accounts page' link at the bottom of the window.
Click the 'Change User Account Control settings' link.
Was there a UAC prompt ? What is the UAC slider set to ?

If your User Account has Admin privileges then it should be set to
the *second from the top*, which is it's Default setting. If it is set
lower then that or it has been turned off, move the slider to the second
from the top and click the OK button.
Malware can disable or lower the UAC setting.

Will await your findings before recommending further steps.

There's no cause for embarrassment unless you set the UAC slider to
Never Notify and forgot that you did. If you did not, then I strongly
suspect that malware is in play here and if that's the case, then it's
pretty well hidden.

So, what happens when you try to open an Elevated Command Prompt now
( Start orb > Search programs and files > type in cmd
Under Programs, right click cmd.exe and choose 'Run as admin ')
does UAC prompt you to allow it to run Elevated ?

If yes, then flush the DNS cache. Type in the below commands, press
Enter after each
( After you enter the first command you should get a message stating
"Windows IP Configuration. Successfully flushed the DNS Resolver Cache." )

ipconfig /flushdns
Leave the Elevated Command Prompt open. Type in
netsh winhttp show proxy

Is any proxy listed ? If there is then type in the below, pressing Enter
after *each* command

netsh winhttp reset proxy
netsh winsock reset
exit

Restart the system and then open Windows Update in Control Panel.
Click the Check for updates link.
Can the system contact the update servers now ?

Now that's the way UAC is supposed to function.

Dang it. Please download and *save* the Windows Malicious Software
Removal Tool ( MRT )

Once the download completes, boot the system to Safe Mode:

" The Advanced Boot Options screen lets you start Windows in advanced
troubleshooting modes. You can access the menu by turning on your
computer and pressing the F8 key *before* Windows starts "

Repeatedly press the F8 to access the Advanced Boot Options menu. If the
F8 key is not pressed prior to Windows loading you'll have to shutdown
and do it all over again.
Once in Safe Mode (NOT Safe Mode with Networking; *just* Safe Mode)
run windows-kb890830-v3.7.exe by *right* clicking it and choose 'Run as
administrator'; agree to the UAC prompts to allow it to run Elevated.
Once the MRT has finished running it should open a window showing you a
list of malware and if any of them were detected.

If you want, you can view the mrt.log located in
Windows\debug <--- this subfolder

Restart the system to normal Windows mode and please let us know if
anything was detected and if it was removed.
If nothing was detected, suggest you open Internet Explorer by clicking
the Start orb > click All Program > *right* click Internet Explorer and
choose 'Run as administrator'; do the UAC prompt again.
Then go here: http://www.eset.com/online-scanner

Click the Eset Online Scanner button and have the system scanned by it.
Please post back with what was detected/removed, if anything.

That's not the reason for being embarrassed.
I must be pushing your patience to the limits.
And, indeed, I never touched the slider, so I suspect Malware too, I have
now used all sorts of malware killers (Spybot, MBAN, Lavasoft Ad-Aware,
Webroot), but although they cleaned up things, the problem remains.
Or maybe I could make a lot of money with a new wonder treatment: how to go
from blond to grey overnight. :

Well, what happens now is a popup saying "Do you want this program to make
changes to your system?"
Is that the prompt you mean?
And when I looked at my slider, I got the same prompt, but asking me if I
wanted Lavasoft to make changes to my system.

I did get that "successfully flushed" message.

That is obviously a no.

Yet another update:
this time it is the Windows application to control the settings which asks
for permission when I go to my slider.

I don't know how to thank you.
I REALLY owe you BIG TIME!!!!!

The scan with the Malicious Software Remover took almost 7 hours, and it
turned out 2 files on my hard drive were infected with the Alureon.H virus,
which apparentlyy looks at your drivers, and, as I experienced, sends users
to sites of the hacker's choice (hence the redirection from Google to advert
sites).

Also, after the reboot, I saw that orange shield with an exclamation mark on
my "Shut Down" button, which indicated to me that the updates were up and
running again, and yes, when I opened Windows Update, there it came, telling
me there were updates waiting for me.

Like I said before, I really don't know how to thank you, all the patience
you have shown, and all the detailed explanations.
If there is ever anything I can do for you, I'll be only too glad to do so.

but at least the main problems have gone, ie. the updates refusing to do
anything, and the redirecting and blocking of sites during surfing.

I have even strengthened my security now.

Not really until you've rebuilded your compormised system from scratch.

will give that a go too
Don't really want to go through all that misery again.

Then don't let your anti-virus application subscription expire again.

At least you still have hair. The only hair on me that is grey is my
" Stanley Cup Playoff beard ". And I'm not even playing in the Stanley Cup !

You're mowst welcome but please *heed the advice* from Ottmar and
PABear. There's no way this system should ever engender Trust until it's
flattened and rebuilt. At least now you have some control over it and
can back up, and SCAN, the personal data that you want preserved.

The * only * way that you can clean the infected drive is by booting
from an antivirus rescue CD and cleaning it while it is not active.
One must usually create the rescue CD and it's usually Linux based.
Some AVs include this rescue CD capability if one purchases the AV and a
CD is included instead of just downloading and installing it via the
internet. Here's a review on some of the AV rescue CDs:

Analyst's View: Antivirus Rescue CDs

I've heard good things about the BitDefender and F-Secure CDs and,
they're *free*. <w>

Whether you attempt to clean the system from an AV rescue CD or you
simply flatten and rebuild is your choice. I'd recommend flattening and
rebuilding. When you get Win 7 reinstalled I *** strongly suggest ***
that you do day to computing from within a *Standard User* account as
opposed to a User Account that has Admin privileges.
When you need to install software/hardware or do some configuring of the
OS you can log off and log on with the User Account that has the Admin
privileges:

Configuring Windows 7 for a Limited User Account

You can install updates without issue from within a Standard User
account in Vista and Win 7 by enabling that option in Control Panel >
Windows Update > click the Change settings link in the left frame >
Under " Who can install updates " put a check mark next to " Allow all
users to install updates on this computer ". Click OK.

You can send me a virtual bottle of Jack Daniels and we can consider
this thread done.
Take care and 'Safe Standard User Surfing' to you !

Report: 64% of all Microsoft vulnerabilities for 2009 mitigated by Least
Privilege accounts

" According to a newly released report, 64% of all the reported
Microsoft vulnerabilities for 2009 could have been mitigated by using
the principle of the least privileged accounts.

By collecting data from Microsoft’s Security Bulletins published
throughout the year, and identifying the vulnerabilities who would have
been mitigated by users whose accounts are configured to have fewer user
rights on the system, BeyondTrust’s quantitative report message is
simple - get back to the basics.

Key summary points on the percentage of flaws mitigated:

---> **** 90% of Critical Windows 7 operating system vulnerabilities are
mitigated by having users log in as standard users ******<----

* 100% of Microsoft Office vulnerabilities reported in 2009
* 94% of Internet Explorer and 100% of IE 8 vulnerabilities reported in 2009
* 64% of all Microsoft vulnerabilities reported in 2009
* 87% of vulnerabilities categorized as Remote Code Execution
vulnerabilities are mitigated by removing administrator rights "

I am suffering from the same problem. Vista home premium x86

I am sure it is some malware or trojan, In Firefox it redirect hyperlinks that I click to ad sites about 5 times before I can get to a site. With IE it is worse.

Windows update doesn't work same error code. Also very difficult to access microsoft pages.

I have scanned with McaFee, Spybot, Adaware, Malwarebytes, Kaspersky. None of which detect it or fix it.

NOD32 did detect it but failed to remove it!

I think this is a very malicious malware or trojan and should be reported to anti-virus software developers immediately!

Sometimes my system fails to boot properly into my user account. I get an error message stating something about the system.ini and something about Adobe acobat is unable to create a folder. Windows sidebar does not load and the GUI is in basic mode. I have to restart multiple times in order to get my desktop back. Also sometimes I get a windows message about unable to access group policy?!?

For now the only way to get rid of it is probably to do a clean reinstall.