KB956841 security update

[Ron Morin]

I just installed the October security updates at a client site and on three
of the four computers it continues to tell me that security update KB 956841
needs to be installed even though it is appearing on the list of installed
security updates. I have rebooted the PC several times but each time the
security update appears on the list to be installed. Each time I select for
re-install it appears on the list of installed security items. Would it be
safe to un-install it, reboot and then re-install it. I went through a mock
un-instal and there is a warning that there are other KB dependent on this
security update. Is it safe to go ahead and proceed to the un-install and
then re-install it.

[MowGreen [MVP]]

Ron,

Which version of Windows is this occurring on ?
Since this is a kernel update the installed security software may be
preventing the files replacement.
A list of the files and Version numbers can be found here:
http://support.microsoft.com/kb/956841

Suggest uninstalling KB956841 from Add/Remove Programs [ignore the "
World is ending " message ;) ], rebooting the systems, and then temp
disabling security software [especially the AV or, any anti-malware
program that actively monitors file changes] on the problematic systems.
Then try reinstalling it or, download a fresh copy from the MS Download
Center, move it to a thumb drive, and then attempt installing it to the
problematic workstations:
http://www.microsoft.com/downloads/r...DisplayLang=en

Be sure to obtain the *specific* update package for the installed
version of Windows.
If that doesn't resolve the reoffering, check the KB956841.logs located
in %windir% on the problematic systems.

[Ron Morin]

Running XP SP3. I will have remote access to PCs in about 10 hours and I will
attempt the un-install and re-install at that time. Will advise outcome then.

If it is listed, uninstall it and then reboot.
Manually download the update from here and *save* it:

Security Update for Windows XP
http://www.microsoft.com/downloads/d...DisplayLang=en

NOTE: If the OS installed is not XP, then obtain the update from the
list here:
http://www.microsoft.com/downloads/r...DisplayLang=en

Click the Change Language dropdown window if you need to change the
language to match the language of the installed version of XP.
Once the download completes close all open programs and browsers.
Temporarily disable the installed security software and *Enable* the
native Windows firewall *if* you've disabled a 3rd party firewall:
http://www.bleepingcomputer.com/forums/topic114351.html

Now install WindowsXP-KB956841-x86-ENU.exe [ENU is the English version
of the update. Your's will be different if another language was chosen
on the MS Download Center. If Vista, *right* click
Windows6.0-KB956841-x86.msu, choose 'Run as administrator'. Follow the
prompts to allow it to run]

Restart the system.
*** REENABLE the installed security software ***

Did that get it installed ?

My laptop keeps trying to download the update, it starts the download at 31%
and then becomes unresponsive at 39%.

after downloading and installing this update, it keeps showing back up as a
new update even though it shows as a installed update in the add remove
program window

Did you download WindowsXP-KB956841-x86-ENU.exe in a folder named
"Downloads" which you've created on your drive C:? If not, where
did you save WindowsXP-KB956841-x86-ENU.exe, what's the exact path?
The quotes around the path "may" be while the blank after the last
quote and before the parameter definitly *is* neccessary.

[PA Bear [MS MVP]]

Please state the full Windows version (e.g., WinXP SP3; Vista SP1) of the
machines in question, Ron.

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/de...spx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates. When you call, clearly state that your problem is related
to a Security Update and cite the update's KB number (e.g., KB956841).

For more information about how to contact your local Microsoft subsidiary
for security update support issues, visit the International Support Web
site: http://support.microsoft.com/common/international.aspx

For enterprise customers, support for security updates is available through
your usual support contacts.

[Ottmar Freudenberger]

Since you're running Windows XP (SP3) and since KB956841 is one of
these famous kernel updates, you may want to try the following:

Try downloading the update manually via DownloadCenter:
http://www.microsoft.com/downloads/d...e-768a18bbe22c

*Save* the file to a folder your harddisk (let me call it "C:\Downloads"),
do *not* execute it from within your browser.

Afterwards type the following under "Run" in the Start menu:
"C:\Downloads\WindowsXP-KB956841-x86-ENU.exe" /o

The parameter "/o" (o like overwriteOEM) should do the trick for you.
Note the blank between the last quote sign and the parameter /o!

[alex74]

Hi! I am experiencing the same problem, the auto updates keeps saying to install te security update. Here is the log file, thanks for help!

7.890: ================================================================================
7.890: 2008/10/17 13:00:40.609 (local)
7.890: C:\WINDOWS\SoftwareDistribution\Download\860fd2882d5382dfdbd9b8629634dfa0\update\update.exe (version 6.3.13.0)
7.890: Failed To Enable SE_SHUTDOWN_PRIVILEGE
7.922: Hotfix started with following command line: -q -z -er /ParentInfo:a93d37cda6c4604ca75ee652e0e91e81
8.000: In Function GetReleaseSet, line 1240, RegQueryValueEx failed with error 0x2
11.250: In Function TestVolatileFlag, line 11825, RegOpenKeyEx failed with error 0x2
11.250: In Function TestVolatileFlag, line 11857, RegOpenKeyEx failed with error 0x2
11.250: DoInstallation: CleanPFR failed: 0x2
11.265: In Function GetReleaseSet, line 1240, RegQueryValueEx failed with error 0x2
11.265: SetProductTypes: InfProductBuildType=BuildType.IP
11.265: SetAltOsLoaderPath: No section uses DirId 65701; done.
11.359: DoInstallation: FetchSourceURL for c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\update\update_SP3GDR.inf failed
11.359: CreateUninstall = 0,Directory = C:\WINDOWS\$NtUninstallKB956841$
11.375: LoadFileQueues: UpdSpGetSourceFileLocation for halaacpi.dll failed: 0xe0000102
11.390: BuildCabinetManifest: update.url absent
11.390: Starting AnalyzeComponents
11.390: AnalyzePhaseZero used 0 ticks
11.390: No c:\windows\INF\updtblk.inf file.
11.390: SetupFindFirstLine in LoadExclusionList Failed with error: 0xe0000102
11.390: SetupFindFirstLine in LoadExclusionList Failed with error: 0xe0000102
11.390: Enumerating Devices of computer, GUID {4d36e966-e325-11ce-bfc1-08002be10318}
12.062: SetupVerifyInfFile failed with error 0x490 for hal.inf of device ROOT\ACPI_HAL\0000
12.672: OEM file scan used 1282 ticks
13.344: c:\windows\system32\ntoskrnl.exe is in the list of oem drivers...skipping copy!
14.328: c:\windows\system32\ntkrnlpa.exe is in the list of oem drivers...skipping copy!
15.250: AnalyzePhaseOne: used 3860 ticks
15.250: AnalyzeComponents: Hotpatch analysis disabled; skipping.
15.250: AnalyzeComponents: Hotpatching is disabled.
15.250: FindFirstFile c:\windows\$hf_mig$\*.*
17.609: Errore rilevato dall'installazione del KB956841: Versione del file update.ver non corretta.
19.359: Errore rilevato dall'installazione del KB956841: Versione del file update.ver non corretta.
20.765: AnalyzeForBranching used 0 ticks.
20.765: AnalyzePhaseTwo used 0 ticks
20.765: AnalyzePhaseThree used 0 ticks
20.765: AnalyzePhaseFive used 0 ticks
20.781: AnalyzePhaseSix used 16 ticks
20.781: AnalyzeComponents used 9391 ticks
20.781: Downloading 0 files
20.781: bPatchMode = FALSE
20.781: Inventory complete: ReturnStatus=0, 9422 ticks
20.781: Num Ticks for invent : 9422
20.812: VerifyTargetFileSize: Unable to verify size as Source = NULL for file c:\windows\inf\HFX1C.tmp
20.828: File copiato: c:\windows\inf\branches.inf
56.125: Allocation size of drive C: is 4096 bytes, free space = 30653853696 bytes
56.469: Drive C: free 29233MB req: 5MB w/uninstall 0MB
56.469: CabinetBuild complete
56.469: Num Ticks for Cabinet build : 35688
56.469: DynamicStrings section not defined or empty.
56.484: FileInUse:: Detection disabled.
57.484: LoadFileQueues: UpdSpGetSourceFileLocation for halaacpi.dll failed: 0xe0000102
57.594: System Restore Point set.
57.734: File copiato: C:\WINDOWS\system32\spmsg.dll
58.109: PFE2: Not avoiding Per File Exceptions.
58.437: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\update\update_SP3QFE.inf -> c:\windows\$hf_mig$\KB956841\update\update_SP3QFE.inf.
58.828: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\spuninst.exe -> c:\windows\$hf_mig$\KB956841\spuninst.exe.
58.859: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\spmsg.dll -> c:\windows\$hf_mig$\KB956841\spmsg.dll.
58.937: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\update\spcustom.dll -> c:\windows\$hf_mig$\KB956841\update\spcustom.dll.
58.969: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\update\KB956841.CAT -> c:\windows\$hf_mig$\KB956841\update\KB956841.CAT.
59.203: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\update\update.exe -> c:\windows\$hf_mig$\KB956841\update\update.exe.
59.265: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\update\updspapi.dll -> c:\windows\$hf_mig$\KB956841\update\updspapi.dll.
59.312: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\update\update.ver -> c:\windows\$hf_mig$\KB956841\update\update.ver.
59.562: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\update\updatebr.inf -> c:\windows\$hf_mig$\KB956841\update\updatebr.inf.
59.594: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\update\eula.txt -> c:\windows\$hf_mig$\KB956841\update\eula.txt.
59.640: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\update\branches.inf -> c:\windows\$hf_mig$\KB956841\update\branches.inf.
59.703: DoInstallation: Installing assemblies with source root path: c:\windows\softwaredistribution\download\860fd2882d5382dfdbd9b8629634dfa0\
59.703: Num Ticks for Copying files : 3234
59.703: Num Ticks for Reg update and deleting 0 size files : 0
59.719: UpdateSpUpdSvcInf: Source [ProcessesToRunAfterReboot] section is empty; nothing to do.
59.750: RebootNecessary = 0,WizardInput = 1 , DontReboot = 1, ForceRestart = 0

[Ottmar Freudenberger]

Just in case you're running Windows XP:

<selfquote>
Try downloading the update manually via DownloadCenter:
http://www.microsoft.com/downloads/d...e-768a18bbe22c

*Save* the file to a folder your harddisk (let me call it "C:\Downloads"),
do *not* execute it from within your browser.

Afterwards type the following under "Run" in the Start menu:
"C:\Downloads\WindowsXP-KB956841-x86-ENU.exe" /o

The parameter "/o" (o like overwriteOEM) should do the trick for you.
Note the blank between the last quote sign and the parameter /o!
</selfquote>

In case you're running any other Windows version than Windows XP,
please *disregard* the advice above!

Bye,
Freudi

[Aqueous]

Same problem here. MS Update history has the green icon next to this, but
continues to offer it to me every time i boot up. i followed your
instructions exactly and RUN says it "refers to a location that is
unavailable." Yet the file is there. I also tried installing in safe mode.
also followed MS troubleshooting advice in KB906602, (malicious software
tool, check, antivirus and malware scan, check, to no avail. I was curious if
the quotation marks were part of your command line so I tried it both ways.
no luck. Any other suggestions? I am running XP SP2. Thank you for any
ideas.

[PA Bear [MS MVP]]

Always state your full Windows version (e.g., WinXP SP3; Vista SP1) when
posting to this newsgroup, please.

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/de...spx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates. When you call, clearly state that your problem is related
to a Security Update and cite the update's KB number (e.g., KB956841).

For more information about how to contact your local Microsoft subsidiary
for security update support issues, visit the International Support Web
site: http://support.microsoft.com/common/international.aspx

For enterprise customers, support for security updates is available through
your usual support contacts.

[Aqueous]

About that...actually I put it on the desktop like an idiot. My apologies.
BUT even after i moved it to the c: drive, followed your instructions,
watched the installation run, and then reboot-- then the Windows Update
offer returns. I see the other thread on this topic and have a similar log to
the one posted--apparently it is really not installing. I see PA Bear's
suggestion to call MS phone support. Unless other helpful suggestions
appear, I guess that is what i need to do as soon as i have time. I Thank
you for sharing your expertise and being patient. Still open to more advice.
Running XP SP2 (on HP computer with AMD processor)
Norton is up to date
Ad Aware is up to date
malicious software tool is up to date
safe mode install makes no difference

[Ottmar Freudenberger]

Please have a look into KB956841.log once again. You should find a
line stating "User specified '-o'; ignoring any OEM driver files."
in there. In case you cannot find that line, the installation with
parameter /o failed.

Please also check the file version of the following files:

ntkrnlpa.exe and ntoskrnl.exe both located in \Windows\System32
ntoskrnl.exe, ntkrpamp.exe, ntkrnlpa.exe and ntknrlmp.exe located
in \Windows\Driver Cache\i386
ntoskrnl.exe, ntkrpamp.exe, ntkrnlpa.exe and ntknrlmp.exe located
in \Windows\System32\DllCache

*All* of these files should show version "5.1.2600.3427" on systems
running Windows XP SP2 (and "5.1.2600.5657" on those systems running
Windows XP SP3).

If you cand find the "User specified '-o'; ignoring any OEM driver
files." line in the KB956841.log file *and* the file versions of the
kernel files mentioned above match the file version on your system,
you may want to run Windows Update and the "User defined search" on
there once again. In case KB956841 is still beeing reoffered after
that procedure, please indeed open a call with MS support.

[Relieved!!!!]

I'm running Windows XP Professional, SP3.
This probelm has been ongoing for many, many weeks now.
Had to shut down Auto Update and the warning ballon just to save my sanity.
I must have over 20 Succeeded updates for KB956841 in my Update History,
going back as far as October 15th, and it still kept saying I needed it!
I think I may have found a fix, by combining the suggestions I'd found here
that were posted by the MVPs.

The information to fix this did turn out to be helpful, but was also very
confusing and incomplete.
Here's how I finally got my computer to stop trying to reinstall this update:

First, go to Add/Remove and remove the KB956841 update. No restart is nedded
at this point.

If you haven't done so already, go to
http://www.microsoft.com/downloads/d...e-768a18bbe22c and manually download this file.
Do NOT just download to Desktop, creat a folder after clicking on My
Computer>(C:), name it Downloads and make sure that the file
WindowsXP-KB956841-x86-ENU is placed inside the folder.
If is was downloaded to Desktop, depending on your Browser settings, just
move it to the file you make named Downloads on the C: drive area.

Now you can go to RUN and type in
C:\Downloads\WindowsXP-KB956841-x86-ENU.exe /o, making absolutely sure to put
a space before the forward slash / .
Click OK.

You should now be presented with a small window named Open File - Security
Warning.
Click RUN.
You should now see Extracting Files and a progress bar.

Next you'll see a small window or Software Update Installation Wizard.

Follow any directions to close programs, ect and click NEXT.
You should see the License Agreement.
Check the radio button I Agree and Click NEXT.

Once it's done its' thing, REBOOT your computer.

Now try going to Windows or in my case Microsoft Update AGAIN and do the
Express hunt for Updates, seeing the Checking for the latest updates for your
computer... and the green progress bar running.
Once it stops you should now see, if done correctly and with a bit of luck,
the following:
High-priority updates
No high-priority updates for your computer are available. To check for
optional updates, return to our home page and click Custom.


In my case it FINALLY, after dealing with this nightmare for nearly two
months now, shows NO UPDATES AVAILABLE.
YAYYYYYY!!!!!!!

I had to turn off my Automatic Updates and also turn off the security
warning that brings up the yellow shield each time I started or rebooted my
computer.
Getting those balloons all the time, telling me Update are ready for your
Computer was driving me crazy!
I'm going to reset Auto Update back to Notify again and see if this fix holds.
If it doesn't, I'll be back to let others know.

Hey Microsoft, if you people are reading this isn't it about time to patch
this problem, if that's even possible???
I know of at least a dozen or more people complaing about the same thing, at
least half seeing this issue on their business computers and slowing down
productivity.
It needs to be fixed from your end, not manually patched by those out there
that don't understand something as basic as a RUN command and execution codes.

I hope this helps. Would have certainly helped me if it were expalined this
way.
If I don't come back it's because the problem didn't return and all this did
the trick.
Looks good so far.

[slipperman61]

Ron,

I'm running Windows XP SP3 also and was experiencing the same problem. I'm also running Bitdefender Internet Security. Once I disabled the Firewall, the Security update was applied successfully. Hope this helps...