The 5735 update failures: analysis

[Robin Walker [MVP]]

Some preliminary investigations here on the 5735 update failures (which I
can reproduce) show that the failures here are all associated with error
messages in the errors.log file in folder C:\Program Files\Microsoft
AntiSpyware\ connected with "gcTCPObjLib".

For instance:

0::Library Files - Unsynced; Loading Full
Update::Updates:UserVersionID::0::14/07/2005 22:14:42

-2146885629::Method '~' of object '~' failed::C:\Program Files\Microsoft
AntiSpyware\temp.zip::C:\Program Files\Microsoft
AntiSpyware\temp.cat::gcTCPObjLib:modMain:VerifyCatalog::14/07/2005
22:14:43:XP:1.0.614

-2146885629::Method '~' of object '~' failed::C:\Program Files\Microsoft
AntiSpyware\temp.zip::C:\Program Files\Microsoft
AntiSpyware\temp.cat::gcTCPObjLib:modMain:VerifyCatalog::14/07/2005
22:14:43:XP:1.0.614

For each of these messages, there is one definitions file that is not
updated.

This is a different mode of failure than the fixes previously posted for:

1. incorrect version of gcUnCompress.dll - see "Definition update
recycling - Permanent Fix" of July 9th.
2. need to empty Temporary Internet Files before attempting MSAS definitions
update - see "Why definition updates fail: possible reason" of June 28th.

These two fixes still both need to be made, but then this new gcTCPObjLib
failure steps in. I don't yet have a workaround for this new problem, which
appears to be a bit non-deterministic and variable.

It's midnight here, and I'm going to bed. See you tomorrow.

 

[Q]

Could it be a problem with the definition download itself.
I have also seen the log show failed even before this last
update. I think its tell Microsoft and wait and see.

 

[Jbob]

Robin, seeing the same error code here too. Also getting:
0::Library Files - Unsynced; Loading Full
Update::Updates:UserVersionID::0::7/14/2005 18:44:28

Here is my error log from an initial install of the 614 version(no previous
versions had been installed) from June 29:
91::Object variable or With block variable not
set::Updates:LatestRulesetVersionID::30::6/29/2005 00:06:33
0:ownloadFileAPI
Error -2146697210::http://download.spynet.com/ASDefinitions/gcThreatAuditThreatData.gcz::C:\Program
Files\Microsoft
AntiSpyware\temp.zip::gcTCPObjLib:HTTPownloadFileAPI::6/29/2005
00:08:22:XP:1.0.614
0::Library Files - Unsynced; Loading Full
Update::Updates:UserVersionID::0::6/29/2005 00:08:51
0:ownloadFileAPI
Error -2146697210::http://download.spynet.com/ASDefinitions/gcDeterminationData.gcz::C:\Program
Files\Microsoft
AntiSpyware\temp.zip::gcTCPObjLib:HTTPownloadFileAPI::6/29/2005
00:08:53:XP:1.0.614

What I saw today on my main system(WinXP Pro, fresh load with only 614 ever
installed) was I got into the loop after updating to the 5735 defs. I
noticed that the three .gcd files did not show as updated though. I shut
down and restarted MSAS with no effect. I restarted my computer and
attempted another update, which it did again, but this time the three files
showed as updated and the loop had disappeared.

I tested three other OS loads of WinXp, using swappable trays, and each one
updated correctly the first time with no looping. No errors were logged
in the error.log and the three files showed updated dates on inital update.
Two of these loads had been updated from the 509 to the 614 version with
appropriate fixes in place. One was nothing but a fresh install of XP Pro
fully patched and only MSAS installed for testing.

No rhyme or reason.

 

[\old\ devildog]

Robin

I did the upgrade this evening after doing the fix you posted the other day.
I didn't know that there was a new problem, so I had not dumped my IE6 temp
files. I then shut down MSAS, started it back up and went back for an
update. No problem! Showed I had the most recent updates.
You spoke of the IE6 temp files. I guess that is not a problem with me as I
only use Netscape 8 ( yes it does Windows update and the new Microsoft
update without any problems) and I have it set to dump the temp file when
closed. I checked my IE6 temp files folder. It is empty, as it has been for
months.

I either receved the updates this evening after MS fixed them or, MSAS needs
to be able to overwrite the files in the IE6 temp folder. I checked my error
log, still shows the only errors in the last day two days has been my daily
checks for an update when the cable modem is in standby and it is unable to
check for an update at 06:00 ( I slept in the last 3 days til 07:00).

Here are the last 3 lines in my error log.

**> 7::ln 10:Out of memory::gcasDtServ:ScheduleScans:Update::7/12/2005
6:00:14 AM:XP:1.0.614
**> 7::ln 10:Out of memory::gcasDtServ:ScheduleScans:Update::7/13/2005
6:00:45 AM:XP:1.0.614
**> 7::ln 10:Out of memory::gcasDtServ:ScheduleScans:Update::7/14/2005
6:00:20 AM:XP:1.0.614

Maybe the use of Netscape 8 is the answer, or the regular dumping of the IE6
temp files. Anyway it is a MS problem, and I expect it was either fixed
before I downloaded at 19:30 CST (Iowa) time, or the use of Netscape as my
default is the fix for this new "bug" in the beta.

But we must all remember this is only a beta. If you can't take all the
"bugs" then remove MSAS. Beta test is more times than not, a very long and
fun process that can make a person learn to swear like the retired Marine I
am. I will check my update tomorrow morning, I will let you know the
results tomorrow morning.
Got a "date" with my wife tonight. By the way, she was born in London. 20
yearts in the states and she hasn't lost the "Queens" english yet. Bloody
good woman

"old" devildog




: Some preliminary investigations here on the 5735 update failures (which I
: can reproduce) show that the failures here are all associated with error
: messages in the errors.log file in folder C:\Program Files\Microsoft
: AntiSpyware\ connected with "gcTCPObjLib".
:
: For instance:
:
: 0::Library Files - Unsynced; Loading Full
: Update::Updates:UserVersionID::0::14/07/2005 22:14:42
:
: -2146885629::Method '~' of object '~' failed::C:\Program Files\Microsoft
: AntiSpyware\temp.zip::C:\Program Files\Microsoft
: AntiSpyware\temp.cat::gcTCPObjLib:modMain:VerifyCatalog::14/07/2005
: 22:14:43:XP:1.0.614
:
: -2146885629::Method '~' of object '~' failed::C:\Program Files\Microsoft
: AntiSpyware\temp.zip::C:\Program Files\Microsoft
: AntiSpyware\temp.cat::gcTCPObjLib:modMain:VerifyCatalog::14/07/2005
: 22:14:43:XP:1.0.614
:
: For each of these messages, there is one definitions file that is not
: updated.
:
: This is a different mode of failure than the fixes previously posted for:
:
: 1. incorrect version of gcUnCompress.dll - see "Definition update
: recycling - Permanent Fix" of July 9th.
: 2. need to empty Temporary Internet Files before attempting MSAS
definitions
: update - see "Why definition updates fail: possible reason" of June 28th.
:
: These two fixes still both need to be made, but then this new gcTCPObjLib
: failure steps in. I don't yet have a workaround for this new problem,
which
: appears to be a bit non-deterministic and variable.
:
: It's midnight here, and I'm going to bed. See you tomorrow.
:
: --
: Robin Walker [MVP Networking]
: (e-mail address removed)
:
:

 

[\old\ devildog]

At 07:30 this morning I once again did a manual update of MSAS, I showed
5735 on the spyware definitions popup. I did a manual update and the update
interface showed:
" Most recent spyware definitions installed", "Most recent software
installed".

Either the problem was fixed yesterday evening by a new set of files from MS
( I don't think that is possible, but it just might be), or the use of IE6
is the problem. I use only Netscape and I don't have the problem. As I have
been doing computer repair for over 30 years now, the only logical
explanation is a problem in compatibility between IE6 and MSAS.

Suggestion, someone else download and setup the latest Netscape 8, empty
your IE6 temp files, set Netscape as your default ( remember to set it to
empty the temp files when closing Netscape), and remove MSAS and delete all
files and download MSAS with Netscape. If you are able to update without a
problem, then IE6 is the cause. Funny how MS has more problems with their
own software "playing nice" with each other than anyother software. Maybe
the use of Netscape is also the reason I don't have a problem of conflict
with Counterspy and MSAS.

These are all things MS needs to know to allow MSAS to work on every system
out there.

"old" devildog
********************************


""old" devildog" <teyoungATmchsiDOTcom> wrote in message
: Robin
:
: I did the upgrade this evening after doing the fix you posted the other
day.
: I didn't know that there was a new problem, so I had not dumped my IE6
temp
: files. I then shut down MSAS, started it back up and went back for an
: update. No problem! Showed I had the most recent updates.
: You spoke of the IE6 temp files. I guess that is not a problem with me as
I
: only use Netscape 8 ( yes it does Windows update and the new Microsoft
: update without any problems) and I have it set to dump the temp file when
: closed. I checked my IE6 temp files folder. It is empty, as it has been
for
: months.
:
: I either receved the updates this evening after MS fixed them or, MSAS
needs
: to be able to overwrite the files in the IE6 temp folder. I checked my
error
: log, still shows the only errors in the last day two days has been my
daily
: checks for an update when the cable modem is in standby and it is unable
to
: check for an update at 06:00 ( I slept in the last 3 days til 07:00).
:
: Here are the last 3 lines in my error log.
:
: **> 7::ln 10:Out of memory::gcasDtServ:ScheduleScans:Update::7/12/2005
: 6:00:14 AM:XP:1.0.614
: **> 7::ln 10:Out of memory::gcasDtServ:ScheduleScans:Update::7/13/2005
: 6:00:45 AM:XP:1.0.614
: **> 7::ln 10:Out of memory::gcasDtServ:ScheduleScans:Update::7/14/2005
: 6:00:20 AM:XP:1.0.614
:
: Maybe the use of Netscape 8 is the answer, or the regular dumping of the
IE6
: temp files. Anyway it is a MS problem, and I expect it was either fixed
: before I downloaded at 19:30 CST (Iowa) time, or the use of Netscape as
my
: default is the fix for this new "bug" in the beta.
:
: But we must all remember this is only a beta. If you can't take all the
: "bugs" then remove MSAS. Beta test is more times than not, a very long and
: fun process that can make a person learn to swear like the retired Marine
I
: am. I will check my update tomorrow morning, I will let you know the
: results tomorrow morning.
: Got a "date" with my wife tonight. By the way, she was born in London. 20
: yearts in the states and she hasn't lost the "Queens" english yet. Bloody
: good woman
:
: "old" devildog
:
:
:
:
: :: Some preliminary investigations here on the 5735 update failures (which I
:: can reproduce) show that the failures here are all associated with error
:: messages in the errors.log file in folder C:\Program Files\Microsoft
:: AntiSpyware\ connected with "gcTCPObjLib".
::
:: For instance:
::
:: 0::Library Files - Unsynced; Loading Full
:: Update::Updates:UserVersionID::0::14/07/2005 22:14:42
::
:: -2146885629::Method '~' of object '~' failed::C:\Program Files\Microsoft
:: AntiSpyware\temp.zip::C:\Program Files\Microsoft
:: AntiSpyware\temp.cat::gcTCPObjLib:modMain:VerifyCatalog::14/07/2005
:: 22:14:43:XP:1.0.614
::
:: -2146885629::Method '~' of object '~' failed::C:\Program Files\Microsoft
:: AntiSpyware\temp.zip::C:\Program Files\Microsoft
:: AntiSpyware\temp.cat::gcTCPObjLib:modMain:VerifyCatalog::14/07/2005
:: 22:14:43:XP:1.0.614
::
:: For each of these messages, there is one definitions file that is not
:: updated.
::
:: This is a different mode of failure than the fixes previously posted for:
::
:: 1. incorrect version of gcUnCompress.dll - see "Definition update
:: recycling - Permanent Fix" of July 9th.
:: 2. need to empty Temporary Internet Files before attempting MSAS
: definitions
:: update - see "Why definition updates fail: possible reason" of June 28th.
::
:: These two fixes still both need to be made, but then this new gcTCPObjLib
:: failure steps in. I don't yet have a workaround for this new problem,
: which
:: appears to be a bit non-deterministic and variable.
::
:: It's midnight here, and I'm going to bed. See you tomorrow.
::
:: --
:: Robin Walker [MVP Networking]
:: (e-mail address removed)
::
::
:
:

 

[Robin Walker [MVP]]

These two fixes still both need to be made, but then this new
gcTCPObjLib failure steps in. I don't yet have a workaround for this
new problem, which appears to be a bit non-deterministic and variable.

It does indeed to appear to be variable and random: I tried again this
morning (no reboots or anything) and the whole update to 5735 went
correctly, with no more looping. So the lesson seems to be: keep trying,
and eventually it will come right.

 

[Pen]

I upgraded 4 machines and had no trouble with the XP pair, but
the
win2k looped until I cleared the off line stuff.
Incidentally, the gcUncompress.dll seems to have gone away
as part of this. Is that correct?

 

[Robin Walker [MVP]]

I upgraded 4 machines and had no trouble with the XP pair, but
the win2k looped until I cleared the off line stuff.

Good, that worked.

Incidentally, the gcUncompress.dll seems to have gone away
as part of this. Is that correct?

The failures being experienced with 5735 updates are of a different nature
to the problem that was solved with the gcUnCompress.dll fix. The
gcUnCompress.dll still has to be of the same version number as the main
exceutables (if it were out-of-date, you would still be experiencing
permanent update looping). The gcUnCompress.dll problem, once fixed, has
now allowed this different problem to show through.

 

[Pen]

No, what I meant to say was that the file is gone. Something in
the
update process is deleting it.

 

[Robin Walker [MVP]]

No, what I meant to say was that the file is gone. Something in
the update process is deleting it.

Are you sure you are checking the correct folder? It should be in
C:\WINDOWS\system32

 

[Bill Sanderson]

I've not tested in a detailed way, but when that file is gone, it isn't at
all evident from the update messages that anything is awry. However, I
think it quite likely that updates don't work at all--and I believe Robin
Walker knows for sure!

--

No, what I meant to say was that the file is gone. Something in the
update process is deleting it.

 

[Pen]

Having a senior moment I guess. You're right it's there.