none
16 bit MS-DOS Subsystem C:\Windows\system32\wuauclt.exe

    Frage

  • Hi

    I've seen several questions in this forum of the same fault, but none appear to match the problem we've been having.

    Our clients are running Windows XP SP3, connected to a downstream WIndows Server 2003 SP2 with WSUS 3.0 SP2 installed. All Windows clients and servers are standalone (not part of any domain)

    The downstream WSUS server is not connected to the internet. We have a separate upstream WSUS server which we use to download metadata and the requested security fixes on, then we transfer the metadata and incremental downloaded content to the downstream server to be imported.

    We've downloaded and installed the following KB manually rather than approve via WSUS because the server is only configured for security updates

     Update for Windows Server Update Services 3.0 Service Pack 2 (KB2734608)

    This installs without any issue.

    On the Windows XP client, an event is logged

    Source: Windows Update Agent

     Category: Installation

     Type: Information

     Event ID: 19

     Installation Successful: Windows successfully installed the following: Automatic Updates

     After a few days of continuous usage, we get the following popup:

    "16 bit MS-DOS Subsystem" message: "C:\Windows\system32\wuauclt.exe The NTVDM CPU has encountered an illegal instruction. CS:0000 IP:0113 OP:f0 2f 32 00 f0 Choose 'Close' to terminate the application. "

    This is also captured in System Event log ID 28.

    On further inspection, the file "C:\Windows\system32\wuauclt.exe" looks corrupt. On viewing File Properties, Date/time stamp/last modified date/size remain the same, but the Version tab is missing. The file stamp is 02/06/2012.

    If we replace the file with one from a working machine (i.e. File stamp 02/06/2012 version 7.6.7600.256) via stopping Automatic Updates service beforehand and restarting the service, this fixes the problem.

      We have McAfee VirusScan Enterprise 8.7i but I do not believe this would have caused the file corruption.

      Any clues?

     Jung Wan

    Freitag, 1. Februar 2013 13:30

Antworten

  • We've downloaded and installed the following KB manually rather than approve via WSUS because the server is only configured for security updates

    Update for Windows Server Update Services 3.0 Service Pack 2 (KB2734608)

    Actually this update isn't available via WSUS

    On further inspection, the file "C:\Windows\system32\wuauclt.exe" looks corrupt. On viewing File Properties, Date/time stamp/last modified date/size remain the same, but the Version tab is missing. The file stamp is 02/06/2012.

    If we replace the file with one from a working machine (i.e. File stamp 02/06/2012 version 7.6.7600.256) via stopping Automatic Updates service beforehand and restarting the service, this fixes the problem.

    Any clues?

    I have one critical question, and a couple of other related ones: You've installed KB2734608 on the disconnected (downstream) server. Did you also install KB2734608 on the connected (upstream) server?

    Does this behavior occur on multiple Windows XP systems? How many have you 'remediated' by copying the wuauclt.exe from the good system? Did the good system also update its WUAgent from the disconnected WSUS server (after KB2734608 was installed)?

    Are there any concurrent or related entries in the WindowsUpdate.log?


    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    SolarWinds Head Geek
    Microsoft MVP - Software Distribution (2005-2013)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

    Sonntag, 3. Februar 2013 01:42