none
Cannot update DaRT Standalone System Sweeper definitions 0x80070070

    Question

  • I have DaRT 7.0 running off an 8GB flash drive that I created with the Windows 7 USB DVD Download Tool from Microsoft, and have been unable to update the Standalone System Sweeper definitions. I have tried both downloading them from inside SSS and loading the definitions from a second flash drive and browsing to manually update them, but both give me this:

    "The program can't install definition updates. Error found: Code 0x80070070. There is not enough space on the disk."

    When I went to browse for the definitions, I noticed that the 8GB flash drive is not listed, only the internal hard drive, the DVD drive and the X: drive named Boot, which is only 30.5MB in size. The definition file is around 70MB, so this is a problem. Any ideas why it's showing up as only 30MB and why the definitions won't load?

    Thanks. 

    Thursday, December 08, 2011 7:10 PM

Answers

  • From MS:

    Until we can root cause the issue – here is a work around to increase the scratch space in DaRT.

    1. From Windows 7 start menu, run "DaRT Recovery Image". 

    2.

    Continue through the wizard until you get to the "Additional Files" page. Note or copy the scratch image path.

    3.

    Open a command prompt as an administrator.

    4.  Using the path from step #1, type the command:

    dism.exe /Image:[TempPathFromStep2] /Set-ScratchSpace:256

    Example:

    dism.exe /Image:C:\users\user1\AppData\local\Temp\erdc_7428\mount /Set-ScratchSpace:256

     

    5.       Close the command prompt and continue creating the DaRT media.

    Tuesday, December 13, 2011 5:29 PM

All replies

  • I'm having the same problem booting from CD. It won't update. Try manual update and get your error message. Tried booting from USB with same result.
    • Edited by tsandoval Thursday, December 08, 2011 8:09 PM
    Thursday, December 08, 2011 8:02 PM
  • Ditto and I have an infected machine, I need this to work. Hope we get an answer soon
    Thursday, December 08, 2011 9:13 PM
  • Had a co-worker run on his machine.  Same result.  We both are running Windows 7 SP1 64-bit.
    Thursday, December 08, 2011 10:33 PM
  • Same here, I tried the MSDaRT CD for win 7 x64. 
    Latest definition version: 1.117.692.0  
    AM- x64  .exe file
    Same error. : 0x80070070
    Please Fix Soon ! (or provide a link to earlier versions that did still work)
    Friday, December 09, 2011 9:12 AM
  • Same here. Dart 6.5, Dart 7.0 32 Bit and 64 Bit.

    It seems the 30Mb x: drive is not big enough to hold the latest update.

    Please Microsoft, crack on or at least acknowledge you are working on it!

    Thanks

    Mark


    • Edited by Crash2000 Friday, December 09, 2011 10:42 AM
    Friday, December 09, 2011 10:41 AM
  • Looking at the definition updates that have been issued, they haven't really changed much in size. There is one file, mpavbase.vdm which is currently 47,385KB. This is of course, too big for the 30Mb Ramdrive.

    However, looking at an update in August 2011, that file mpavbase.vdm was 47,046KB in size, making it too big then as well. But of course, back then, it worked.

    Looking at the mpavbase.vdm file already in 7.0 image, that is considerably smaller. But of course the update version is very old. This in itself is strange, as when the disk was created, we opted to download the latest version.

    OK. with all this it seems that the updates do not actually go into the Ramdisk (X:) and should in fact go somewhere else. On further investigation, using an old update, we discover that they should go to "c:\windows\standalone system sweeper\definition updates" which if course is the drive we want to scan, which has plenty of room.

    So the problem is not with MSDaRT, it is in fact with the update file and where, when uncompressed, it is placed.

    I can see from the MPSigStub.exe file info that this file was updated on 15/11/2011. Is this the problem?

    Basically, the problem is the unzip location is not correct. So Microsoft, there is the problem, now please fix it.

    OK, I have found a workaround for the 64Bit version

    1. Boot from CD as normal
    2. Run Standalone System Cleaner - This will create the c:\windows\standalone system sweeper file structure with some default stuff
    3. Then close Standalone System Cleaner.
    4. On another machine, Download mpam-fe64.exe from http://www.microsoft.com/security/portal/Definitions/ADL.aspx (SecurityEssentials 64Bit)
    5. Extract the exe using winrar or equivalent
    6. Copy the files mpasbase.vdm, mpasdlta.vdm, mpavbase.vdm, mpavdlta.vdm and mpengine.dll to a memory stick.
    7. Place memory stick into computer being repared and copy these files into c:\Windows\Standalone System Sweeper\Definition Updates\{********-****-****-****-************} (where {********-****-****-****-************} seem to be random numbers, but there should only be one visible)
    8. Run Standalone System Cleaner and it should now be up to date.

    I hope this is helpfull if so please click on http://www.crash-2000.com to help boost my site.

     

     

    • Proposed as answer by Crash2000 Friday, December 09, 2011 1:04 PM
    Friday, December 09, 2011 1:02 PM
  • The solution works, the sweeper needed to be closed during copy indeed because otherwise it'll just overwrite the files again. 

    I would prefer a solution from MS though :)

    Friday, December 09, 2011 2:27 PM
  • Thank you!  Worked great for the 32Bit version too.

    :)

    Saturday, December 10, 2011 4:56 PM
  • Worked Great - Thanks Crash!
    Sunday, December 11, 2011 3:45 PM
  • Thanks Crash.  We are seeing this issue as well.  Any word from MS on this one?
    • Edited by Clay Taylor Monday, December 12, 2011 6:31 PM
    Monday, December 12, 2011 6:31 PM
  • I got this from the person that updates Standalone System Sweeper: "this probably has something to do with the way he created the MSDaRT disk and not Standalone System Sweeper. When you boot from USB there is a lot of room for error (not using the right version of Win7 or different architecture, etc.)Either that or the system drive is Bitlockered".

    None of this is the case, and even iso's that we used susccessfully 3 weeks ago are no longer working correctly.  Anyone else hear anything from Microsoft on this?

    Monday, December 12, 2011 8:40 PM
  • Exactly, I've been using the same DaRT image and it suddenly stopped working. I have a feeling this has to do with System Sweeper being renamed to Windows Defender Offline. Maybe the team that makes the definitions forgot DaRT uses the name system sweeper?
    Monday, December 12, 2011 8:58 PM
  • I just opened up a case about this.  Anyone that has any info that they may think is helpful, please post here.  Please include your OS version (XP32, XP64, Win 7 32, etc.) when you post.

    Thanks!

     

    Monday, December 12, 2011 10:05 PM
  • I tried DaRT 7.0 x86 and x64 created on and used for Windows 7, in both cases the flash drives were using the same DaRT images made a couple months that had been working until recently. I even tried making new images and told it to download the latest defs when I made them.
    • Edited by Dan_Vega Monday, December 12, 2011 10:23 PM
    Monday, December 12, 2011 10:22 PM
  • Thanks Dan,

    Hopefully we'll get a resolution tomorrow.  I'll post progress notes from the case as I get updated tomorrow.

    Clay

     


    • Edited by Clay Taylor Tuesday, December 13, 2011 12:55 AM
    Tuesday, December 13, 2011 12:55 AM
  • Here's an update from MS:

    Apparently the signatures files are getting bigger and bigger and no longer fit within the scratch space.

     

    The problem is that Standalone System Sweeper (and WDO) copies the signature package to the local disk (the ramdisk - i.e. the X:\ drive) so that it can extract it.  For this to succeed, when creating the WIM containing the System Sweeper bits, you need to add some scratch space otherwise the ramdisk will be too small and the copy will fail.

     

    We are currently waiting to hear back from the MSDART Team.

    Tuesday, December 13, 2011 1:25 PM
  • From MS:

    Until we can root cause the issue – here is a work around to increase the scratch space in DaRT.

    1. From Windows 7 start menu, run "DaRT Recovery Image". 

    2.

    Continue through the wizard until you get to the "Additional Files" page. Note or copy the scratch image path.

    3.

    Open a command prompt as an administrator.

    4.  Using the path from step #1, type the command:

    dism.exe /Image:[TempPathFromStep2] /Set-ScratchSpace:256

    Example:

    dism.exe /Image:C:\users\user1\AppData\local\Temp\erdc_7428\mount /Set-ScratchSpace:256

     

    5.       Close the command prompt and continue creating the DaRT media.

    Tuesday, December 13, 2011 5:29 PM
  • Thanks Clay. I was just returning to post this as a workaround and you beat me to it! Well done.

    At least there is another solutiuon now that will sort it out.

    Thanks Again

    Mark

    http://www.crash-2000.com

     

    Thursday, December 15, 2011 11:47 AM
  • This issue should now be resolved.  Please test and post back to confirm.

     

    Thanks,

    Shain Wray (MSFT)

    Monday, December 19, 2011 8:14 PM