Windows Updates - HELP - KB2393802

[mattpant]

Hi...

 

Hope somebody can help me.... today are systems received a load of new updates from our WUS server, a good number of our machines (about 100 of them) which were all Dells decided that they didn't like KB2393802

 

The machines do an automatic install of updates at 10:00AM, once these machines had installed this update, and restarted, that's all they kept doing, get to the logon screen and keep restarting.

 

I jumped onto the WUS server and Declined any updates from today (which included the KB2393802, went around every machine with the problem and uninstalled the Security Patch from them, this fixed the problem!

 

However, I'm a little concered, looking at the event logs on some of these machines that they show that KB2393802 has been downloaded to the machines and is scheduled to install at 10AM tomorrow.... WHY?!?!?

 

I don't want another repeat of today!!!! Help!!!!!

 

What can I do?!?!?

 

Thanks

 

Matt

[TechSupp]

Glad I'm not alone!!! Posed earlier about BSOD's from updates. Did the same as you and declined all updates from 8/2/11. As I didnt have chance to identify the culrit from about 8 updates etc I just did a system restore from an earlier point. These were Fujitsu PC's and did the same/similar, booted up got almost to logging on screen then blue screened and rebooted. Came to the school at lunch and was faced with three down in the suite and a couple of more by the end of the afternoon. Bet I'm faced with a couple tomorrow as I noticed some were saying they would update at shut down (took option to not install and just shut down).

Googling around shows 'we are not alone!"

Edited February 9, 2011 by TechSupp

[mattpant]

Hi,

 

I did see your earlier post... We are not seeing any sign of a blue screen on our machines, it just sits on the logon screen (or you can start to login) then it will just restart, within about 20-30 seconds and go around in a circle. I manually went around each machine today and uninstalled all the updates that were installed today (since found out that it's KB2393802 which is causing our problem)

 

What's worrying me is that I have declined the updates on the WUS server (all updates with todays date, which included KB2393802), but when I looked in Event Viewer after I'd uninstalled them from the machines, it's now showing that they are sitting there waiting to be installed again tomorrow!

 

So I fear I'm going to hit the same problem tomorrow after 10AM (When it's due to install)

 

Is this because the patches are still sitting in a folder on the computer... if so where? And can I remove these files before they get installed, so it will never pick them upagain?!?!?

 

This is only on our Dell machines, we have Fujitsus, Acers, HP's and unbranded which don't seem to be affected.

 

We are using Windows XP on all the machines, KB2393802 has many variations, Vista/Server 2003/XP, but I've declined the ot for now.

 

Thanks

 

Matt

[mattpant]

I've checked the C:\WINDOWS\SoftwareDistribution\Download\ folder on the local machines, and deleted all the contents in the hope it was picking it up from the local folder to install... but thats made no difference, the machines still pop up saying it's got Windows Updates ready to install!!

 

Where is it getting this file from?!?!

[denon101]

Have you tried declining the update and then manually syncing the machine with WSUS by running wuauclt /detectnow? That should get WSUS to tell the machine that there is no new updates. I have done this in the past and it worked fine for me.

[elsiegee40]

A quick trip round google suggests that update (KB2393802) is causing all sorts of problems

[Michael]

This update KB2393802 updates the Windows kernel, so it could be many things causing the computer to BSOD.

 

Does the computer start in Safe Mode OK?

 

And if you are suffering from this problem, state the machine name and model number if possible.

[mattx]

Can someone let me know if this mainly on XP builds ? I'm about to logon to our WSUS server......

[timzim]

In WSUS:

- choose Security Updates and change the filter to "Approved"

- right click on the offending update (KB2393802) and select "Approve"

- right-click the group for which you've already approved/installed the update - you can choose an extra option "Approved for removal" if the update has been downloaded or installed by one or more members of the group

- Now run wuauclt /detectnow on the affected machine it will mark the update to be uninstalled & uninstall it (either automatically or manually, depending on how you do your Windows Updates)

[mattpant]

Thanks Guys for the replys,

 

The machines are Dell Optiplex 755 USFF, and 760 USFF, they are Windows XP SP3 (And all Patches)

The machines are not showing any sign of a BSOD, they boot up, sit on the logon screen for about 10 seconds max, then just restart.

 

I don't think doing what you suggested "timzin" is going to work in this case, as the machines are not staying on log enought for this setting to reach the clients as they just restart again....

 

I've just been around the rooms and some of the machines have started doing it again, the GPO hadn't kicked in where I changed the scheduled install time from 10AM... I also setup a script to delete all the contents from C:\WINDOWS\SoftwareDistribution\Download\ folder.

 

The machines that I have restarted and gone back into down appear to be showing KB2393802 as an update at the moment, but it didn't yesterday until later on in the day.

 

Flaming updates!!!

[mattx]

As a precaution I've not approved this one - got too much to be getting on with anyhoo.

[Michael]

This reminds me of the reported Windows Update which caused BSODs not long ago and it was malware related.

 

Other possibilities are driver conflicts or anti-virus conflicts too as most people seem successful uninstalling this update in Safe Mode.

[MYK-IT]

Interesting... I'd approved this yesterday.

 

Just waiting to see what happens!

 

Deployed to Dell Optiplex 620/745/755/760/780's with XP Pro / SP3.

[mattpant]

Interesting... I'd approved this yesterday.

 

Just waiting to see what happens!

 

Deployed to Dell Optiplex 620/745/755/760/780's with XP Pro / SP3.

 

Would be intrested to know how you got on with the 755's 760's....

[MYK-IT]

Just checked for you, all the Optiplex 755 have installed the update(s) fine.

[mattpant]

Ahhh OK... Weird... must be conflicting with some other setup/software/driver on these machines of ours then

[TechSupp]

I may have the BSOD butvdefinately the same update problem as on a machine with the problem, started in safe mode, uninstalled it, rebooted and right as rain. Fujitsu esprimo e3550 xp sp3. Not all have either downloaded it or have been affected. Only had half a dozen so far.

[SSFC]

We had the same issue, we ended up removing the patch on each pc. we had to:

 

• Boot XP from CD

• Press R to enter recovery console

• Wait for keyboard prompt to timeout

• Press 1

• Use local password

• Once in enter the following to remove each patch

$NTUninstallKB2393802$\spuninst

BATCH spuninst.txt

type exit

[Mel]

From Symantec web site:

 

Results of the investigation

 

Thanks for posting the information above. After reviewing a number of memory dump files, our engineering team has determined the following:

 

* Windows XP leaves approximately 12,000 bytes of shared stack space for kernel modules to share.

* Windows provides no way to identify available stack space; it just BSODs when the stack overruns.

* PGP WDE 10.0.2 and below use approximately 600 bytes of stack space.

* In the PGP WDE 10.1, we proactively reduced this to approximately 100 bytes of stack space.

* KB 2393802 leaves less stack space available in the Windows kernel for other kernel modules to use.

* PGP WDE (pgpwded.sys) is generally the last driver loaded. As a result, when we try to grab our modest stack space, the blue screen will display our driver name as the responsible driver.

* In our testing, almost every system suffering from this problem used the Intel graphics driver. This uses about 7,000 bytes(!) of stack space. Without this single driver using over half of this available shared resource, there would be plenty of room for the WDE driver.

 

The above explains a number of items:

 

* Why the problem occurs on some systems but not others

* Why it occurs without PGP WDE installed

* Why it occurs most often on Win XP

* Why we did not see this in our testing

 

Our current recommendation is to upgrade to PGP WDE 10.1.1; the lower stack utilization allows it to fit in the reduced area. Thus far, we have not seen a case where this did not fix the problem; the reduction in available stack space from the MS patch must be less than 500 bytes.

 

As said in a message above, there is no need to decrypt your disk before upgrading to 10.1, though we do recommend a backup as a basic best practice.

 

Also, we have not been able to duplicate this on Windows 7. If you have seen this issue on Win7, please post here and let us know if we can reach out to you to see what's happening.

 

Unfortunately, this is a difficult situation for a software vendor like us. We're doing the right thing in minimizing our use of the stack - in fact, we proactively reduced it further before this issue even occurred. However, a combination of other programs' behavior and our position in the driver loading process (probably because we were installed last) makes Windows crash with the finger pointing at us.

 

Please leave a note here if you use the Intel graphics driver and have seen this issue. I'll be reaching out to Intel to see if they can update their video driver to minimize stack usage.

 

My apologies to anyone affected by this issue.

 

Bryan Gillson