Definition update recycling - Permanent Fix

[Anonymous Bob]

I checked the "gcUnCompress.dll" on my unit. File length was 130,272 bytes.
I then followed all instructions as shown. I still had a "gcUnCompress.dll"
file length of 130,272 bytes. I uninstalled MSAS and revisited the install
page from MS. Downloaded the 614 build ( what I already had running )
reinstalled the 614 build and still have "gcUnCompress.dll" file length of
130,272 bytes. I am using XP SP2 with all updates and hotfixes from MS. I
ran a manual update from the dropdown on MSAS and received an upgrade of
def. files to 5733.

Old devildog,
Welcome to dllhell.
Try this:
1. Uninstall MSAS using the installer, not add/remove.
2. Delete the dll.
3. Empty the recycle bin.
4. Turn off the restore function.
5. Download a fresh copy of MSAS.
6. Install as normal.
7. Turn on restore.
8. Check your version of the dll.

Bob Vanderveen

 

[JohnBurns]

Thanks for taking time to find the solution and posting
it. I really appreciate it.

-----Original Message-----
After much debugging, I have found that the problem with definition update
failures and repetition is because of an incorrect version of the file
gcUnCompress.dll in C:\WINDOWS\SYSTEM32\ (for XP) or C:\WINNT\SYSTEM32\ (for
2000 or systems upgraded from 2000).

The incorrect version is of length 130,272 bytes.
The correct version is of length 95,448 bytes.

To update your system to install the correct version of the file, do the
following:

1. In the System Notification Area, right-click on the MSAS icon and select
"Shutdown Microsoft AntiSpyware".
2. In Explorer, navigate to C:\WINDOWS\SYSTEM32\, locate the file
"gcUnCompress.dll", right-click on it, and select "Delete".
3. In Control Panel "Add or Remove Programs", select "Microsoft AntiSpyware"
and click button "Change".
4. Click "Next".
5. Select "Update Microsoft AntiSpyware", click "Next".
6. Click "Install".
7. When the re-installation finishes, click "Finish".
8. In Explorer, in folder C:\WINDOWS\SYSTEM32\, check that
"gcUnCompress.dll" is now 95,448 bytes long, by right- clicking it and
selecting "Properties".
9. Launch MSAS, pull down the File menu and select "Check for updates" -
this time it really will update your definition files to the latest version.
10. In Explorer, open the folder C:\Program

Files\Microsoft AntiSpyware, and

satisfy yourself that the modification dates of the three definition files
have changed:
gcDeterminationData.gcd
gcThreatAuditThreatData.gcd
gcThreatAuditScanData.gcd

Done!

You won't ever have to manually install the definition files again, nor will
the update keep repeating every time you try.

--
Robin Walker [MVP Networking]
(e-mail address removed)


.

 

[Robin Walker [MVP]]

If you have a
file length of 95,448, it must be from a previous install of MSAS.
The file included with the current install form MS is 130,272 bytes.

The version of gcUnCompress.dll that ships with MSAS build 614 is 95,448
bytes long, with a version number of 1.0.614.10, and a modification date
which matches the modification dates of the build 614 executables in the
"\Program Files\Microsoft AntiSpyware" directory: this will be around 24
June, with the exact apparent time depending on your timezone settings
(14:24 GMT).

If you have a gcUnCompress.dll that differs from that, then you do not have
MSAS build 614, or you are suffering from some misinstallation. The
procedure posted at the beginning of this thread applies only if you are
running build 614. Re-installing other versions will give older versions of
gcUnCompress.dll, such as the one which is 130,272 bytes long.

Check which version you are currently running by pulling down the Help menu
in MSAS and selecting "About".

Ensure that you empty your "Temporary Internet Files" before you download
the latest version of the MSAS installer. Also, if your ISP operates a
transparent web proxy cache, then you might (though this is increasingly
unlikely) be still downloading a stale version of the Installer.

The versions of the MSAS Installer may be distinguished by their lengths and
Digital Signature times as follows:
v501: 6.23MB = 6,385KB = 6,537,888 bytes signed on 2005 Jan 07 at 00:16:55
GMT
v509: 6.22MB = 6,374KB = 6,526,608 bytes signed on 2005 Feb 11 at 04:20:19
GMT
v613: 6.50MB = 6,659KB = 6,818,440 bytes signed on 2005 Jun 16 at 18:38:06
GMT
v614: 6.50MB = 6,658KB = 6,816,904 bytes signed on 2005 Jun 24 at 22:57:15
GMT

All these data can be checked in the Properties panel for the Installer file
MicrosoftAntiSpywareInstall.exe.

 

[\old\ devildog]

**Reply below your response**

<<<<<<<SNIP>>>>>>>>>

:::::::::::::::::::::::::::::::::::::::::::::::::::::;:
: Old devildog,
: Welcome to dllhell.
: Try this:
: 1. Uninstall MSAS using the installer, not add/remove.
: 2. Delete the dll.
: 3. Empty the recycle bin.
: 4. Turn off the restore function.
: 5. Download a fresh copy of MSAS.
: 6. Install as normal.
: 7. Turn on restore.
: 8. Check your version of the dll.
:
: Bob Vanderveen


Followed your directions to the letter, except I used the same install of
MSAS I downloaded earlier this morning ( wanted to test something myself ).
Also instead of loosing all of my restore points, I backed them up to my d:
drive ( I don't want to be needing them and be without them. ). The dll is
now "93.2 KB (95,448 bytes)". What is strange is I deleted the dll before
and emptied the bin before reinstalling early this morning. I used the same
install software and got a different result. If the "system restore" is
causing the problem, then the definition of a restore point is lost to MS.
It should of only have restored the "bad" dll if asked to revert to a
pervious restore point, not when doing a new install or upgrading an
install.

By the way, I restored the "restore points folder" back to c: drive , after
turning it back on. Rebooted ( first time in 3 weeks) and none of the
restore points seem to be lost. Also the dll has remained the same ( 93.2 KB
(95,448 bytes) ).

If this problem is not fixed before long the "unskilled" user (more than 95%
of MS's users) will not be using MSAS. Tech "glitches" like this will drive
them away, as well as the very long time between report of "bug" on a fix
from them. There has not even been a report from MS to say there is a
problem with the MSAS "beta". Poor communication seems to be a problem that
MS has had a long time and is not close to changing. MS must remember that
this "public beta" is using a large group of "inexperienced", normal
computer users. All the post's since this forum started, shows a growing
"non-technical" group downloading this "beta" and having problems. I know
that MS's reason for going to a public "beta", was to see what problems
popped up from all the different systems running an extreme range of
software. Right now most of the major problems reported in these forums have
been caused by the interactions of MSAS with MS's own software. Second
biggest problems are caused by a certain "anti-virus" ( no name given as you
all know who it is) software vendor. I don't expect their software to ever
work correctly with any OS ever released by anyone, so I don't even consider
these to be anything more that minor "glitches"caused by incompatible (with
anything known to mankind) piece of software.

I will say this is the first "glitch" I have had with MSAS, as I use an
"anti-virus", firewall, and other "maintenance and security" software that
conforms well with XPSP2. Even though MSAS has a long way to go to reach the
top of the heap of this software group, if the developers listen and monitor
these forums closer, they just may end up with a the best out there. But the
general slow way this problem as well as others have been handled, I don't
expect the "beta" stage to end at the end of the year, nor for MS to even
have a "beta 2" ready in the next month or so. As I have said before I do
not rely on MSAS only. I also use Counterspy, AdAwareSE (paid version) and
Spybot S&D. Each of the four catch things that the others miss. MS take
notice, to win this software "race", you must be able to catch everything
that others are, plus what they miss. "Cookies" and other "data miners" are
a must. Include this soon.

If you have the best and you can catch 99.9% of all the "malware" that is
out there, and you address all "bugs" in a fast and open way, you could
charge for your software, recoup your purchase and development cost, and
have a very happy group of followers. Keep up the "crap" the same way you
are and you will have just that, a piece of freeware "crap" that no one
uses, because there is better freeware out there now. The only way MS will
make anything off of it then will be to include their "new spyware" and sell
the information they "recover"

MS needs monitor these forums and respond for once.

"old" devildog

 

[\old\ devildog]

Robin

I was running 614. Read my answer just posted above to Bob. The error lies
in XP's System Restore software. Another problem with MSAS caused by
Microsoft's own software.

"old" devildog
::::::::::::::::::::::::::::::::::::::::::::::::

: "old" devildog <teyoungATmchsiDOTcom> wrote:
:
: > If you have a
: > file length of 95,448, it must be from a previous install of MSAS.
: > The file included with the current install form MS is 130,272 bytes.
:
: The version of gcUnCompress.dll that ships with MSAS build 614 is 95,448
: bytes long, with a version number of 1.0.614.10, and a modification date
: which matches the modification dates of the build 614 executables in the
: "\Program Files\Microsoft AntiSpyware" directory: this will be around 24
: June, with the exact apparent time depending on your timezone settings
: (14:24 GMT).
:
: If you have a gcUnCompress.dll that differs from that, then you do not
have
: MSAS build 614, or you are suffering from some misinstallation. The
: procedure posted at the beginning of this thread applies only if you are
: running build 614. Re-installing other versions will give older versions
of
: gcUnCompress.dll, such as the one which is 130,272 bytes long.
:
: Check which version you are currently running by pulling down the Help
menu
: in MSAS and selecting "About".
:
: Ensure that you empty your "Temporary Internet Files" before you download
: the latest version of the MSAS installer. Also, if your ISP operates a
: transparent web proxy cache, then you might (though this is increasingly
: unlikely) be still downloading a stale version of the Installer.
:
: The versions of the MSAS Installer may be distinguished by their lengths
and
: Digital Signature times as follows:
: v501: 6.23MB = 6,385KB = 6,537,888 bytes signed on 2005 Jan 07 at
00:16:55
: GMT
: v509: 6.22MB = 6,374KB = 6,526,608 bytes signed on 2005 Feb 11 at
04:20:19
: GMT
: v613: 6.50MB = 6,659KB = 6,818,440 bytes signed on 2005 Jun 16 at
18:38:06
: GMT
: v614: 6.50MB = 6,658KB = 6,816,904 bytes signed on 2005 Jun 24 at
22:57:15
: GMT
:
: All these data can be checked in the Properties panel for the Installer
file
: MicrosoftAntiSpywareInstall.exe.
:
: --
: Robin Walker [MVP Networking]
: (e-mail address removed)
:
:

 

[Anonymous Bob]

Followed your directions to the letter, except I used the same install of
MSAS I downloaded earlier this morning ( wanted to test something myself ).
Also instead of loosing all of my restore points, I backed them up to my d:
drive ( I don't want to be needing them and be without them. ). The dll is
now "93.2 KB (95,448 bytes)". What is strange is I deleted the dll before
and emptied the bin before reinstalling early this morning. I used the same
install software and got a different result. If the "system restore" is
causing the problem, then the definition of a restore point is

lost to MS.

<snipped well worded rant> ;-)

Happy to hear of your success. Here's a link to a dllhell article
that's a bit old and applies to NT and Win2000, but gives good
background on the problem:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsetup/html/dlldanger1.asp

I turned off restore and recommended the same action to you based
purely on completeness and suspicion rather than an known facts.

There is, however, a possibility of different versions of this dll
from Giant, Counterspy, and more than one from Microsoft. For that
reason alone it would seem reasonable for Microsoft to make this a
private dll and keep it in their MSAS folder.

All readers should be aware that I have only a vague understanding
of the issues. <bEg>

Bob Vanderveen

 

[Neville Davis]

It worked fine, but after updating, gcUnCompress.dll disappeared - can't be
found by a search, hidden files shown - but the program still works Ok.
What's going on ?

 

[Keith]

Robin,
VMT for your detailed solution. It worked fine - and
it's nice to know someone's out there providing sound and
constructive MSAS help. Again, Thanks.
Keith

-----Original Message-----
After much debugging, I have found that the problem with

definition update

 

[Ron]

Although I had the correct sized dll, thank you very much
for all your work and expertise. I posted this to
CastleCops security forums with correct attribution and a
link back to this newsgroup.

-----Original Message-----
After much debugging, I have found that the problem with definition update
failures and repetition is because of an incorrect version of the file
gcUnCompress.dll in C:\WINDOWS\SYSTEM32\ (for XP) or C:\WINNT\SYSTEM32\ (for
2000 or systems upgraded from 2000).

The incorrect version is of length 130,272 bytes.
The correct version is of length 95,448 bytes.

To update your system to install the correct version of the file, do the
following:

1. In the System Notification Area, right-click on the MSAS icon and select
"Shutdown Microsoft AntiSpyware".
2. In Explorer, navigate to C:\WINDOWS\SYSTEM32\, locate the file
"gcUnCompress.dll", right-click on it, and select "Delete".
3. In Control Panel "Add or Remove Programs", select "Microsoft AntiSpyware"
and click button "Change".
4. Click "Next".
5. Select "Update Microsoft AntiSpyware", click "Next".
6. Click "Install".
7. When the re-installation finishes, click "Finish".
8. In Explorer, in folder C:\WINDOWS\SYSTEM32\, check that
"gcUnCompress.dll" is now 95,448 bytes long, by right- clicking it and
selecting "Properties".
9. Launch MSAS, pull down the File menu and select "Check for updates" -
this time it really will update your definition files to the latest version.
10. In Explorer, open the folder C:\Program

Files\Microsoft AntiSpyware, and

satisfy yourself that the modification dates of the three definition files
have changed:
gcDeterminationData.gcd
gcThreatAuditThreatData.gcd
gcThreatAuditScanData.gcd

Done!

You won't ever have to manually install the definition files again, nor will
the update keep repeating every time you try.

--
Robin Walker [MVP Networking]
(e-mail address removed)


.

 

[Tom Emmelot]

Hello Robin,

so I was in the C:\windows\system32\ directory and saw there actually 3
files belonging to MSAS:
GCCollection.dll
gcUnCompress.dll
gcmd5query.dll
So I store this 3 files.
Then I uninstall MSAS
Empty all the folders also internet folders and also those 3 files!
After the clean new downloaded install, I find out that 1 of the 3 files
was missing: gcmd5query.dll
The date was 2 march 2005 and this "GAINT MD5 Query Library" is what it is.
Can you tell me more about this?

Regards >*< TOM >*<

 

[Robin Walker [MVP]]

After the clean new downloaded install, I find out that 1 of the 3
files was missing: gcmd5query.dll
The date was 2 march 2005 and this "GAINT MD5 Query Library" is what
it is. Can you tell me more about this?

gcmd5query.dll was part of builds 5xx. It is not used by the 6xx versions.
It can safely be deleted now.

 

[Tom Emmelot]

Hello Robin,

Thanks for the info!!

With regards >*< TOM >*<


Robin Walker [MVP] schreef:

 

[John]

Robin,

Thank you, Thank you, Thank you. Your 'fix' works a
treat, and finally put an end to a week or so of
frustration.

Cheers,

John

-----Original Message-----
After much debugging, I have found that the problem with definition update
failures and repetition is because of an incorrect version of the file
gcUnCompress.dll in C:\WINDOWS\SYSTEM32\ (for XP) or C:\WINNT\SYSTEM32\ (for
2000 or systems upgraded from 2000).

The incorrect version is of length 130,272 bytes.
The correct version is of length 95,448 bytes.

To update your system to install the correct version of the file, do the
following:

1. In the System Notification Area, right-click on the MSAS icon and select
"Shutdown Microsoft AntiSpyware".
2. In Explorer, navigate to C:\WINDOWS\SYSTEM32\, locate the file
"gcUnCompress.dll", right-click on it, and select "Delete".
3. In Control Panel "Add or Remove Programs", select "Microsoft AntiSpyware"
and click button "Change".
4. Click "Next".
5. Select "Update Microsoft AntiSpyware", click "Next".
6. Click "Install".
7. When the re-installation finishes, click "Finish".
8. In Explorer, in folder C:\WINDOWS\SYSTEM32\, check that
"gcUnCompress.dll" is now 95,448 bytes long, by right- clicking it and
selecting "Properties".
9. Launch MSAS, pull down the File menu and select "Check for updates" -
this time it really will update your definition files to the latest version.
10. In Explorer, open the folder C:\Program

Files\Microsoft AntiSpyware, and

satisfy yourself that the modification dates of the three definition files
have changed:
gcDeterminationData.gcd
gcThreatAuditThreatData.gcd
gcThreatAuditScanData.gcd

Done!

You won't ever have to manually install the definition files again, nor will
the update keep repeating every time you try.

--
Robin Walker [MVP Networking]
(e-mail address removed)


.

 

[Mikolaj]

After much debugging, I have found that the problem with definition update

failures and repetition is because of an incorrect version of the file
gcUnCompress.dll in C:\WINDOWS\SYSTEM32\ (for XP) or C:\WINNT\SYSTEM32\
(for 2000 or systems upgraded from 2000). (...)

You have done a GREAT job!! Really GREAT!! Many thanks from MSAS users!

 

[Guest]

Thanks for a great fix!

-----Original Message-----
After much debugging, I have found that the problem with definition update
failures and repetition is because of an incorrect version of the file
gcUnCompress.dll in C:\WINDOWS\SYSTEM32\ (for XP) or C:\WINNT\SYSTEM32\ (for
2000 or systems upgraded from 2000).

The incorrect version is of length 130,272 bytes.
The correct version is of length 95,448 bytes.

To update your system to install the correct version of the file, do the
following:

1. In the System Notification Area, right-click on the MSAS icon and select
"Shutdown Microsoft AntiSpyware".
2. In Explorer, navigate to C:\WINDOWS\SYSTEM32\, locate the file
"gcUnCompress.dll", right-click on it, and select "Delete".
3. In Control Panel "Add or Remove Programs", select "Microsoft AntiSpyware"
and click button "Change".
4. Click "Next".
5. Select "Update Microsoft AntiSpyware", click "Next".
6. Click "Install".
7. When the re-installation finishes, click "Finish".
8. In Explorer, in folder C:\WINDOWS\SYSTEM32\, check that
"gcUnCompress.dll" is now 95,448 bytes long, by right- clicking it and
selecting "Properties".
9. Launch MSAS, pull down the File menu and select "Check for updates" -
this time it really will update your definition files to the latest version.
10. In Explorer, open the folder C:\Program

Files\Microsoft AntiSpyware, and

satisfy yourself that the modification dates of the three definition files
have changed:
gcDeterminationData.gcd
gcThreatAuditThreatData.gcd
gcThreatAuditScanData.gcd

Done!

You won't ever have to manually install the definition files again, nor will
the update keep repeating every time you try.

--
Robin Walker [MVP Networking]
(e-mail address removed)


.

 

[Robin Walker [MVP]]

the problem with definition
update failures and repetition is because of an incorrect version of
the file gcUnCompress.dll in C:\WINDOWS\SYSTEM32\ (for XP) or
C:\WINNT\SYSTEM32\ (for 2000 or systems upgraded from 2000).

The incorrect version is of length 130,272 bytes.
The correct version is of length 95,448 bytes.

This is by way of a follow-up with some answers to common questions I have
been receiving.

The posted procedure was intended only for build 614 of MSAS. If you have
earlier versions installed, do not use the posted procedure. Just delete
gcUnCompress.dll, then download the latest MSAS installer by following the
links from http://www.microsoft.com/spyware and install the downloaded
version.

Build 614 should properly have a gcUnCompress.dll with the following
properties:

1. A length of 95,448 bytes;
2. A Digital Signature signed by Microsoft on 2005 June 24 at 22:24:18 GMT
(adjust the displayed time for your time-zone);
3. If it was installed by the MSAS installer as normal, it should have a
Modification Date matching the modification dates of the executable binaries
of MSAS in \Program Files\Microsoft AntiSpyware\

The problem which causes the repeating downloads is not in MSAS itself, it
is in the MSAS installer. The MSAS installer for builds 6xx does not update
\SYSTEM32\gcUnCompress.dll if a previous version exists there. Users who
had previously used builds 5xx of MSAS, or Giant Computer AntiSpyware, or
CounterSpy, will have a previous version of gcUnCompress.dll, which the MSAS
6xx installer fails to update. The consequence of the installer's failure
to update gcUnCompress.dll is that definition updates in MSAS silently fail,
but are reported to the user as succeeding, when they have not. This is why
the update will repeat again: because the previous update did not succeed.

Some users have reported that the procedure "did not work" for them, but did
not say how it failed. Please report any failures in some detail: what for
instance does "did not work" mean?

For your convenience, I attach a copy of the true gcUnCompress.dll for build
614 to this message. You should of course regard all attachments with
suspicion: you may authenticate the veracity of the attached file by
checking its Length and its Digital Signature as matching the details posted
above. The Modification Date will of course be quite different by the time
you have extracted the attachment. If you are running build 614 of MSAS,
you may try copying the attached DLL to your SYSTEM32 directory to overwrite
any incorrect version of gcUnCompress.dll

 

[Bill Sanderson]

After much debugging, I have found that the problem with definition update
failures and repetition is because of an incorrect version of the file
gcUnCompress.dll in C:\WINDOWS\SYSTEM32\ (for XP) or C:\WINNT\SYSTEM32\
(for 2000 or systems upgraded from 2000).

The incorrect version is of length 130,272 bytes.
The correct version is of length 95,448 bytes.

To update your system to install the correct version of the file, do the
following:

1. In the System Notification Area, right-click on the MSAS icon and
select "Shutdown Microsoft AntiSpyware".
2. In Explorer, navigate to C:\WINDOWS\SYSTEM32\, locate the file
"gcUnCompress.dll", right-click on it, and select "Delete".
3. In Control Panel "Add or Remove Programs", select "Microsoft
AntiSpyware" and click button "Change".
4. Click "Next".
5. Select "Update Microsoft AntiSpyware", click "Next".
6. Click "Install".
7. When the re-installation finishes, click "Finish".
8. In Explorer, in folder C:\WINDOWS\SYSTEM32\, check that
"gcUnCompress.dll" is now 95,448 bytes long, by right-clicking it and
selecting "Properties".
9. Launch MSAS, pull down the File menu and select "Check for updates" -
this time it really will update your definition files to the latest
version.
10. In Explorer, open the folder C:\Program Files\Microsoft AntiSpyware,
and satisfy yourself that the modification dates of the three definition
files have changed:
gcDeterminationData.gcd
gcThreatAuditThreatData.gcd
gcThreatAuditScanData.gcd

Thanks very much for this work, and the solution. I've only had machines I
was able to see the problem with first-hand in the last 36 hours or so, and
your solution has matched what I found and solved the problem in every case.

 

[demonsurfer]

awesome thanks Robin

 

[Robin Walker [MVP]]

the problem with definition
update failures and repetition is because of an incorrect version of
the file gcUnCompress.dll in C:\WINDOWS\SYSTEM32\ (for XP) or
C:\WINNT\SYSTEM32\ (for 2000 or systems upgraded from 2000).

The incorrect version is of length 130,272 bytes.
The correct version is of length 95,448 bytes.

This is by way of a follow-up with some answers to common questions I have
been receiving.

The posted procedure was intended only for build 614 of MSAS. If you have
earlier versions installed, do not use the posted procedure. Just delete
gcUnCompress.dll, then download the latest MSAS installer by following the
links from http://www.microsoft.com/spyware and install the downloaded
version.

Build 614 should properly have a gcUnCompress.dll with the following
properties:

1. A length of 95,448 bytes;
2. A Digital Signature signed by Microsoft on 2005 June 24 at 22:24:18 GMT
(adjust the displayed time for your time-zone);
3. If it was installed by the MSAS installer, it should have a
Modification Date matching the modification dates of the executable binaries
of MSAS in \Program Files\Microsoft AntiSpyware\

The problem which causes the repeating downloads is not in MSAS itself, it
is in the MSAS installer. The MSAS installer for builds 6xx does not update
\SYSTEM32\gcUnCompress.dll if a previous version exists there. Users who
had previously used builds 5xx of MSAS, or Giant Computer AntiSpyware, or
CounterSpy, will have a previous version of gcUnCompress.dll, which the MSAS
6xx installer fails to update. The consequence of the installer's failure
to update gcUnCompress.dll is that definition updates in MSAS silently fail,
but are reported to the user as succeeding, when they have not. This is why
the update will repeat again: because the previous update did not succeed.

Some users have reported that the procedure "did not work" for them, but did
not say how it failed. Please report any failures in some detail: what for
instance does "did not work" mean?

 

[Guest]

It worked!

Thank you.