Setup could not verify the integrity of update.inf

[George M. Garner Jr.]

I am unable to install the following patches to an XP SP1 box:

Patch NOT Installed MS03-007 Q815021
File C:\WINDOWS\system32\ntdll.dll has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1217].


Patch NOT Installed MS03-013 Q811493
File C:\WINDOWS\system32\ntoskrnl.exe has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1151].


Patch NOT Installed MS03-023 Q823559
File C:\Program Files\Common Files\Microsoft
Shared\TextConv\html32.cnv has a file version [2000.11.9.0] that is
less than what is expected [2003.1100.5426.0].


Patch NOT Installed MS03-024 Q817606
File C:\WINDOWS\system32\drivers\srv.sys has a file version
[5.1.2600.0] that is less than what is expected [5.1.2600.1193].


Patch NOT Installed MS03-026 Q823980
File C:\WINDOWS\system32\rpcrt4.dll has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1230].


Patch NOT Installed MS03-027 Q821557
The registry key **SOFTWARE\Microsoft\Updates\Windows
XP\SP2\KB821557** does not exist. It is required for this patch to
be considered installed.


Patch NOT Installed MS03-030 Q819696
File C:\WINDOWS\system32\quartz.dll has a file version
[6.4.2600.1106] that is less than what is expected [6.4.2600.1221].

The error message is:

"Setup could not verify the integrity of update.inf. Make sure that the
cryptographic service is running on this computer."

The cryptographic service is definitely running.

I tried the recommendations of http://support.microsoft.com/?kbid=326815
with no effect. I also tried a repair install of XP + sp1. This also did
not solve the problem.

The contents of %systemroot%\KB823980.txt are as follows:

Service Pack started with following command line:
***

InstallInfCatalogFile: Installing
e:\ca46321a20fa9d775ce076\sp2\update\KB823980.cat as _000000_.cat...
***

VerifySize: Unable to verify size: Source = NULL: c:\windows\_000000_.cat

***

InstallCatalogFile: VerifyCatalogFile failed for c:\windows\_000000_.cat;
error=0x80092026.
***

InstallInfCatalogFile: Installation failed; error=0x00000002.
***

DoInstallation: ValidateSingleFileSignature Failed: STR_FAILED_INF_INTEGRITY
***

KB823980 Setup encountered an error: Setup could not verify the integrity
of the file Update.inf. Make sure the Cryptographic service is running on
this computer.
***

Setup could not verify the integrity of the file Update.inf. Make sure the
Cryptographic service is running on this computer.
***

Message displayed to the user: Setup could not verify the integrity of the
file Update.inf. Make sure the Cryptographic service is running on this
computer.
***

User Input: OK
***

What else can I do to resolve this problem?

Regards,

George.

 

[Jupiter Jones [MVP]]

George;
Reboot, login to an Administrator account.
Double click My Computer.
Double click C drive.
Double click Windows file.
Double click System32 file.
Right click catroot2, click rename, type "catroot2old"
ENTER

Otherwise:
Start/Run
Type "cmd" ENTER
Type "sfc /scannow" ENTER
Have the windows XP CD ready.

--
Jupiter Jones [MVP]
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
http://dts-l.org/index.html

I am unable to install the following patches to an XP SP1 box:

Patch NOT Installed MS03-007 Q815021
File C:\WINDOWS\system32\ntdll.dll has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1217].


Patch NOT Installed MS03-013 Q811493
File C:\WINDOWS\system32\ntoskrnl.exe has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1151].


Patch NOT Installed MS03-023 Q823559
File C:\Program Files\Common Files\Microsoft
Shared\TextConv\html32.cnv has a file version [2000.11.9.0] that is
less than what is expected [2003.1100.5426.0].


Patch NOT Installed MS03-024 Q817606
File C:\WINDOWS\system32\drivers\srv.sys has a file version
[5.1.2600.0] that is less than what is expected [5.1.2600.1193].


Patch NOT Installed MS03-026 Q823980
File C:\WINDOWS\system32\rpcrt4.dll has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1230].


Patch NOT Installed MS03-027 Q821557
The registry key **SOFTWARE\Microsoft\Updates\Windows
XP\SP2\KB821557** does not exist. It is required for this patch to
be considered installed.


Patch NOT Installed MS03-030 Q819696
File C:\WINDOWS\system32\quartz.dll has a file version
[6.4.2600.1106] that is less than what is expected [6.4.2600.1221].

The error message is:

"Setup could not verify the integrity of update.inf. Make sure that the
cryptographic service is running on this computer."

The cryptographic service is definitely running.

I tried the recommendations of http://support.microsoft.com/?kbid=326815
with no effect. I also tried a repair install of XP + sp1. This also did
not solve the problem.

The contents of %systemroot%\KB823980.txt are as follows:

Service Pack started with following command line:
***

InstallInfCatalogFile: Installing
e:\ca46321a20fa9d775ce076\sp2\update\KB823980.cat as _000000_.cat...
***

VerifySize: Unable to verify size: Source = NULL: c:\windows\_000000_.cat

***

InstallCatalogFile: VerifyCatalogFile failed for c:\windows\_000000_.cat;
error=0x80092026.
***

InstallInfCatalogFile: Installation failed; error=0x00000002.
***

DoInstallation: ValidateSingleFileSignature Failed: STR_FAILED_INF_INTEGRITY
***

KB823980 Setup encountered an error: Setup could not verify the integrity
of the file Update.inf. Make sure the Cryptographic service is running on
this computer.
***

Setup could not verify the integrity of the file Update.inf. Make sure the
Cryptographic service is running on this computer.
***

Message displayed to the user: Setup could not verify the integrity of the
file Update.inf. Make sure the Cryptographic service is running on this
computer.
***

User Input: OK
***

What else can I do to resolve this problem?

Regards,

George.

 

[George M. Garner Jr.]

Jupiter,

Reboot, login to an Administrator account.
Double click My Computer.
Double click C drive.
Double click Windows file.
Double click System32 file.
Right click catroot2, click rename, type "catroot2old"
ENTER

This is the recommendation of http://support.microsoft.com/?kbid=326815. As
I stated above, I have already tried that without success.

Otherwise:
Start/Run
Type "cmd" ENTER
Type "sfc /scannow" ENTER
Have the windows XP CD ready.

Well, I can try that. But having just performed a repair install of Windows
XP and a reinstall of sp1, what is it exactly that you expect "sfc /scannow"
to do?

Regards,

George.

 

[Matt Scarborough]

DoInstallation: ValidateSingleFileSignature Failed:
STR_FAILED_INF_INTEGRITY

***

KB823980 Setup encountered an error: Setup could not verify the integrity
of the file Update.inf. Make sure the Cryptographic service is running on
this computer.
***

What else can I do to resolve this problem?

I believe this will fix it George. You might need to download the fix from
another PC (333 KB) to removeable media. Make an educated guess about
whether SP1 needs reinstalled during the process.

Windows Update | Personalize Windows Update | Display the link to the
Windows Update Catalog | Save Settings

Windows Update | See Also |Windows Update Catalog

Find Updates | Windows XP SP 1 | Advanced | Contains these words "Q817287"
(without the quotes) | Search

Add to Basket | Download

http://support.microsoft.com/?kbid=817287
"This update resolves issues associated with the catalog database Windows
uses to ensure the integrity of installed binaries. Q817287 allows the
database to repair itself if corruption occurs."

So,

* ren "%SystemRoot%\System32\Catroot2" "%SystemRoot%\System32\CatrootOLD"
* Reboot
* Reinstall SP1 <- (may not be necessary, so skip this on attempt #1)
* Install Q817287
* Try the updates that previously failed. (If no go, repeat the steps and
reinstall SP1 and then all necessary updates per hfnetchk/mbsacli output.)

Matt Scarborough 2003-08-08

On Thu, 7 Aug 2003 21:40:24 -0400, George M. Garner Jr. wrote

I am unable to install the following patches to an XP SP1 box:

Patch NOT Installed MS03-007 Q815021
File C:\WINDOWS\system32\ntdll.dll has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1217].


Patch NOT Installed MS03-013 Q811493
File C:\WINDOWS\system32\ntoskrnl.exe has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1151].


Patch NOT Installed MS03-023 Q823559
File C:\Program Files\Common Files\Microsoft
Shared\TextConv\html32.cnv has a file version [2000.11.9.0] that is
less than what is expected [2003.1100.5426.0].


Patch NOT Installed MS03-024 Q817606
File C:\WINDOWS\system32\drivers\srv.sys has a file version
[5.1.2600.0] that is less than what is expected [5.1.2600.1193].


Patch NOT Installed MS03-026 Q823980
File C:\WINDOWS\system32\rpcrt4.dll has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1230].


Patch NOT Installed MS03-027 Q821557
The registry key **SOFTWARE\Microsoft\Updates\Windows
XP\SP2\KB821557** does not exist. It is required for this patch to
be considered installed.


Patch NOT Installed MS03-030 Q819696
File C:\WINDOWS\system32\quartz.dll has a file version
[6.4.2600.1106] that is less than what is expected [6.4.2600.1221].

The error message is:

"Setup could not verify the integrity of update.inf. Make sure that the
cryptographic service is running on this computer."

The cryptographic service is definitely running.

I tried the recommendations of http://support.microsoft.com/?kbid=326815
with no effect. I also tried a repair install of XP + sp1. This also did
not solve the problem.

The contents of %systemroot%\KB823980.txt are as follows:

Service Pack started with following command line:
***

InstallInfCatalogFile: Installing
e:\ca46321a20fa9d775ce076\sp2\update\KB823980.cat as _000000_.cat...
***

VerifySize: Unable to verify size: Source = NULL: c:\windows\_000000_.cat

***

InstallCatalogFile: VerifyCatalogFile failed for c:\windows\_000000_.cat;
error=0x80092026.
***

InstallInfCatalogFile: Installation failed; error=0x00000002.
***

 

[George M. Garner Jr.]

Matt,

Unfortunately, that didn't help.

Regards,

George.

 

[George M. Garner Jr.]

Matt,

Unfortunately that didn't help.

Regards,

George.

DoInstallation: ValidateSingleFileSignature Failed: STR_FAILED_INF_INTEGRITY
***

KB823980 Setup encountered an error: Setup could not verify the integrity
of the file Update.inf. Make sure the Cryptographic service is running on
this computer.
***

What else can I do to resolve this problem?

I believe this will fix it George. You might need to download the fix from
another PC (333 KB) to removeable media. Make an educated guess about
whether SP1 needs reinstalled during the process.

Windows Update | Personalize Windows Update | Display the link to the
Windows Update Catalog | Save Settings

Windows Update | See Also |Windows Update Catalog

Find Updates | Windows XP SP 1 | Advanced | Contains these words "Q817287"
(without the quotes) | Search

Add to Basket | Download

http://support.microsoft.com/?kbid=817287
"This update resolves issues associated with the catalog database Windows
uses to ensure the integrity of installed binaries. Q817287 allows the
database to repair itself if corruption occurs."

So,

* ren "%SystemRoot%\System32\Catroot2" "%SystemRoot%\System32\CatrootOLD"
* Reboot
* Reinstall SP1 <- (may not be necessary, so skip this on attempt #1)
* Install Q817287
* Try the updates that previously failed. (If no go, repeat the steps and
reinstall SP1 and then all necessary updates per hfnetchk/mbsacli output.)

Matt Scarborough 2003-08-08

On Thu, 7 Aug 2003 21:40:24 -0400, George M. Garner Jr. wrote

I am unable to install the following patches to an XP SP1 box:

Patch NOT Installed MS03-007 Q815021
File C:\WINDOWS\system32\ntdll.dll has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1217].


Patch NOT Installed MS03-013 Q811493
File C:\WINDOWS\system32\ntoskrnl.exe has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1151].


Patch NOT Installed MS03-023 Q823559
File C:\Program Files\Common Files\Microsoft
Shared\TextConv\html32.cnv has a file version [2000.11.9.0] that is
less than what is expected [2003.1100.5426.0].


Patch NOT Installed MS03-024 Q817606
File C:\WINDOWS\system32\drivers\srv.sys has a file version
[5.1.2600.0] that is less than what is expected [5.1.2600.1193].


Patch NOT Installed MS03-026 Q823980
File C:\WINDOWS\system32\rpcrt4.dll has a file version
[5.1.2600.1106] that is less than what is expected [5.1.2600.1230].


Patch NOT Installed MS03-027 Q821557
The registry key **SOFTWARE\Microsoft\Updates\Windows
XP\SP2\KB821557** does not exist. It is required for this patch to
be considered installed.


Patch NOT Installed MS03-030 Q819696
File C:\WINDOWS\system32\quartz.dll has a file version
[6.4.2600.1106] that is less than what is expected [6.4.2600.1221].

The error message is:

"Setup could not verify the integrity of update.inf. Make sure that the
cryptographic service is running on this computer."

The cryptographic service is definitely running.

I tried the recommendations of http://support.microsoft.com/?kbid=326815
with no effect. I also tried a repair install of XP + sp1. This also did
not solve the problem.

The contents of %systemroot%\KB823980.txt are as follows:

Service Pack started with following command line:
***

InstallInfCatalogFile: Installing
e:\ca46321a20fa9d775ce076\sp2\update\KB823980.cat as _000000_.cat...
***

VerifySize: Unable to verify size: Source = NULL: c:\windows\_000000_.cat

***

InstallCatalogFile: VerifyCatalogFile failed for c:\windows\_000000_.cat;
error=0x80092026.
***

InstallInfCatalogFile: Installation failed; error=0x00000002.
***

Regards,

George.

 

[Matt Scarborough]

On Fri, 8 Aug 2003 15:25:52 -0400, George M. Garner Jr. wrote

Matt,

Unfortunately, that didn't help.

I did run across this post which adds some interesting suggestions regarding
re-registering DLLs. Additional suggestions from MS (URL may wrap)
<http://groups.google.com/[email protected]&oe=UTF-8&output=gplain>

The key here seems to be STR_FAILED_INF_INTEGRITY and the creation (or
rather lack thereof) of the file "_000000_.cat" There are a handful of posts
on the boards with this commonality none of which appear to have reached
resolution.

In your original post the temporary files were unpacked to E:\. Anything
special there (permissions, logical or networked drive, grasping at straws)
that would affect this?

InstallInfCatalogFile: Installing
e:\ca46321a20fa9d775ce076\sp2\update\KB823980.cat as _000000_.cat
...

***

I'm outta ammo,

Matt Scarborough 2003-08-08

 

[George M. Garner Jr.]

Matt,

I did run across this post which adds some interesting suggestions regarding
re-registering DLLs. Additional suggestions from MS (URL may wrap)

<http://groups.google.com/[email protected]
l&oe=UTF-8&output=gplain>

There are indeed some interesting suggestions there. It appears to be
updates since March 28, 2003 that do not install. I was wondering if there
has been a root certificate update that this computer somehow missed.

In your original post the temporary files were unpacked to E:\. Anything
special there (permissions, logical or networked drive, grasping at straws)
that would affect this?

Not if you are running as admin. I assume that the update program runs
within the context of the user that starts it.

Regards,

George.

 

[George M. Garner Jr.]

Matt,

I did run across this post which adds some interesting suggestions regarding
re-registering DLLs. Additional suggestions from MS (URL may wrap)

<http://groups.google.com/[email protected]
l&oe=UTF-8&output=gplain>

There are some interesting suggestions there. It appears to be the patches
since March 28, 2003, inclusive, that do not install. I wonder if there was
a root certificate update that this computer missed?

In your original post the temporary files were unpacked to E:\. Anything
special there (permissions, logical or networked drive, grasping at straws)
that would affect this?

Not if you are an administrator. I assume that the patch runs within the
security context that launched it.

Regards,

George.

 

[Matt Scarborough]

George,

Possible answer at the end. How we got there is useful fodder. Would more
detailed logging coax an answer?
http://msdn.microsoft.com/library/en-us/install/hh/install/troubleshoot_7s6f.asp

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]
"LogLevel"=dword:0000ffff

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\AppLogLevels]
"update.exe"=dword:0000ffff

Look to %SystemRoot%\setupapi.log, and then setupapi.h or winerror.h for hex
to human readable translation. The log will be huge for SP1. Maybe a single
Hotfix has a secret to tell.

An example: Manually editing update.inf yields, "An unsigned or incorrectly
signed file <path>update.inf was installed. Error 0xe000022f: The
third-party INF does not contain digital signature information. a/k/a
0xe000022f ERROR_NO_CATALOG_FOR_OEM_INF setupapi.h
and
"An unsigned or incorrectly signed file <path>update.inf was installed.
Error 0x800b0003: The form specified for the subject is not one supported or
known by the specified trust provider. a/k/a
0x800b0003 TRUST_E_SUBJECT_FORM_UNKNOWN winerror.h

Earlier we saw your %systemroot%\KB823980.txt

a/k/a
0x80092026 CRYPT_E_SECURITY_SETTINGS winerror.h
The cryptographic operation failed due to a local security option setting.

Which begs the wonder what that setting is? SetReg may provide a clue or
allow changing the setting.
http://msdn.microsoft.com/library/en-us/security/security/setreg.asp

Has the default
10) Only trust items found in the Trust DB........ FALSE
been changed to TRUE? Setreg.exe with no parameters will show current
values. If the default has been changed to TRUE,
setreg 10 FALSE
will return it to the default.

Throwing broad sides of barns at broad sides of barns,

Matt Scarborough 2003-08-08

On Fri, 8 Aug 2003 23:04:46 -0400, George M. Garner Jr. wrote

 

[George M. Garner Jr.]

Matt,

Well, I discovered one problem. The computer date was set to 2070 so that
the Microsoft Root Authority was no longer valid. Correctly setting the
date did not solve the problem, however. When I open the property page for
the Microsoft Root Authority (and virtually every other authority) the
following error message is displayed on the property page:

"The cryptographic operation failed due to a local security option setting."

I wonder what option this refers to?

Regards,

George.

 

[Matt Scarborough]

On Sun, 10 Aug 2003 00:54:55 -0400, George M. Garner Jr. wrote

Matt,

Well, I discovered one problem. The computer date was set to 2070 so that
the Microsoft Root Authority was no longer valid. Correctly setting the
date did not solve the problem, however. When I open the property page for
the Microsoft Root Authority (and virtually every other authority) the
following error message is displayed on the property page:

"The cryptographic operation failed due to a local security option setting."

I wonder what option this refers to?

SetReg may provide a clue or allow changing the setting. This URL lists the
defaults.
http://msdn.microsoft.com/library/en-us/security/security/setreg.asp

Has the default
10) Only trust items found in the Trust DB........ FALSE
been changed to TRUE? Setreg.exe with no parameters will show current
values. If the default has been changed to TRUE,
setreg 10 FALSE
will return it to the default.

Setreg is available in the SDK or on Windows 2000 Server. I do not see it in
XP. However, both the problems you mention,
"The cryptographic operation failed due to a local security option setting"
and
"InstallCatalogFile: VerifyCatalogFile failed for c:\windows\_000000_.cat;
error=0x80092026"
occur on XP when we use setreg.exe thussly
SETREG.EXE 10 TRUE

Both symptoms immediately disappear on XP when we use setreg.exe thussly
SETREG 10 FALSE
which yields
<snip>
10) Only trust items found in the Trust DB........ FALSE

More details in
<[email protected]>

Matt Scarborough 2003-08-10

 

[George M. Garner Jr.]

Matt,

SetReg #10 was false. All of the settings are identical to other known-good
XP computers.

I that this is the root problem. The only question now is how to find what
setting is causing this problem.

Thanks,

George.

 

[Matt Scarborough]

On Sun, 10 Aug 2003 13:14:17 -0400, George M. Garner Jr. wrote

SetReg #10 was false. All of the settings are identical to other known-good
XP computers.

I that this is the root problem. The only question now is how to find what
setting is causing this problem.

The error(s) can also be caused by Software restriction policies. In
particular, assuming a stand-alone box,

GPEdit.msc | Computer Configuration | Windows Settings | Security Settings |
Software Restriction Policies | Trusted Publishers

Allow the following users to select trusted publishers

The default is "End users."

When "Local computer administrators" is chosen, KB823559 for example will
throw the "...could not verify the integrity of the file Update.inf" Setup
Error.

PKI issues in Windows always seem to generate cryptic error messages.

Matt Scarborough 2003-08-10

 

[George M. Garner Jr.]

Matt,

That did it. A default software restriction policy was generated on this
computer. As to how the date got set to 2070 or the "Allow the following
users to select trusted publishers" policy got set to "Local computer
administrators," that is a good question. This problem all started when my
client's daughter opened an email which the virus checker identified, in its
dieing gasp, as a virus. I still can't get the specific virus checker to
run. I have scanned the hard drive from a know good operating system and
cann't find any *known* viruses. But I have had to install a virus checker
from a different vendor. It's all very interesting.

Regards,

George.