CIS prevents installing KB2289161 [NBZ]

I recently got a message when shutting down the computer about a new Window’s update available.
After installing it and restarting the computer the message appears again and again.
It was a security update for Office 2010 named KB2289161 and my computer is a XP SP3 with no other security suites.
The only way I managed to install it was disabling CIS before shutting down the laptop.

We would very much appreciate it if you would edit your first post to create an issue report in line with the bug forum guidelines and format here. You can copy and paste the format from this topic.

To understand the reasons why we ask you to follow these guidelines please see below.

WHY WE ASK YOU TO FOLLOW THESE GUIDELINES
Bugs/issues can be impossible or very time consuming to fix if developers don’t have enough information to reproduce them. Since CIS is free, development time is limited. So if you want your issue fixed, please use the format below to describe it.

To avoid clutter, issues not described in the format below your post will not be moved to the ‘moderator verified’ issues topic. This means that the developers may not look at it.

Best wishes and many thanks in anticipation

Dennis

I’m sorry. I missed the bug report format post. My bad.
This is the report:

The bug/issue

  1. What you did: Shutting down the computer with a pending Windows update. It was related to KB2289161 -Office 2010 security update-
  2. What actually happened or you actually saw: Windows performed the update without apparent issues but after starting up again, the shutdown dialog still indicates the need to install the update.
  3. What you expected to happen or see: No update available after installing it.
  4. How you tried to fix it & what happened: Unisntalling CIS [Edit: This fixed it!]. I guess I could also solve it dissabling CIS.
  5. If its an application compatibility problem have you tried the application fixes?: N/A
  6. Details (exact version) of any application involved with download link: It’s an automatic security update but you can download it from http://www.microsoft.com/downloads/details.aspx?FamilyID=0b308508-0e1e-4e90-b2b8-7e32bfc5dbf4&displayLang=es -Spanish-
  7. Whether you can make the problem happen again, and if so exact steps to make it happen: N/A
  8. Any other information (eg your guess regarding the cause, with reasons):

Files appended. (Please zip unless screenshots).

  1. Screenshots illustrating the bug:
  2. Screenshots of related CIS event logs and the Defense+ Active Processes List:
  3. A CIS config report or file.
  4. Crash or freeze dump file:

Your set-up

  1. CIS version, AV database version & configuration used: CIS 5.0.163652.1142
  2. a) Have you updated (without uninstall) from CIS 3 or 4: No
    b) if so, have you tried reinstalling (if not please do)?: N/A
  3. a) Have you imported a config from a previous version of CIS: No
    b) if so, have U tried a preset config (if not please do)?: N/A
  4. Other major changes to the default config (eg ticked ‘block all unknown requests’, other egs here. ) No
  5. Defense+ and Sandbox OR Firewall security level: Defense & Firewall= Safe, Sandbox=disabled
  6. OS version, service pack, no of bits, UAC setting, & account type: XP SP3 32 bit, Admin
  7. Other security and utility software installed: MAM & SUPERAntiSpyware on demand
  8. Virtual machine used (Please do NOT use Virtual box): None

Does any one of the solutions in App. is not working correctly, but does not seem to be s/boxed. What to do? solve the problem?

I don’t think it’s a Sandbox issue. It was disabled.
I’ll unistall this Windows update and tray to reproduce the issue again but this time I’ll disable only D+

THans Mahg for your bug report in standard format.

Could I ask what makes you think that CIS is involved? Issues with the OS, application installations, or other security software would seem equally likely.

If the problem is still persisting, probably the best way to check if CIS is involved would be to uninstall. If you do this, test installation of KB, the reinstall using this process here, you’ll also be able to establish whether it is a CIS installation problem. You can back up your settings using this process here meanwhile.

Best wishes

Mouse

Well, as I stated, unistalling CIS the issue dissapeared. I read about this error and find some other people with other security suites that had the same problem. They had to uninstall their suites to let complete the KB2289161 installation.
This installation is done by Windows when you shut down the computer so I can’t see how Comodo interacts.
SandBox was disabled in my computer so I guess Defense+ could be the problem.
Within this week I’ll uninstall this Windows security patch and I’ll try to reproduce again the problem. This time I’ll disable Defense to see what happens.

Regards

OK sorry mahg, what you said under The Bug/issue 4. was a bit ambiguous, and I misunderstood it as meaning you were considering uninstalling CIS.

I’m assuming that by “The message appears when next shutting down” you mean that the shutdown dialog indicates that the update is still to be installed

If not and you reproduce please do indictae outcome, plus a screenshot of the message. You may need to tick disable’ permanently to get it to install. Also links to other web reports will be appreciated by the devs.

Forwarding to format verified, as there is already enough information, thanks.

Best wishes

Mouse

That’s right.
I’ll unistall this patch this weekend so Windows will try to install it again -or maybe I could install myself from their web site- and see with more details what happens in Comodo’s log.

I’ll keep you informed

Thanks

Thank, that will be helpful.

Just to check, when you shutdown for the second time, how do you know Winodws Update wasn’t trying to install another (different) update? Windows sometimes insists on installing updates in sequence - first this one, then reboot then the next one. To be sure about this you might have checked say Windows updates between the boots and noted that the update installation log on the Windows update site had a cross against it to indicate it had failed. I think the failure would still be indicated in the Windows Update log on the web site now if it did fail - so you can check.

Best wishes

Mouse

Yes, I checked in the Windows Update Log. There were only this update pending.
That was the way that I noticed it was the KB2289161

Regards

What happens when you delete the content of :\Windows\SoftwareDistribution\Download folder and then try installing again?

I’m a little bit confused.

Today I’ve uninstalled KB2289161, downloaded this security patch and installed manually with the same CIS’s settings as when I got the error and … nothing happens. I don’t see any alerts nor messages from CIS and the installation were successfull.
Well, this is not the same scenario because I don’t let Windows to install this patch by itself. I’ll uninstall it again and let install it automatically.
Anyway, I attach the Windows Update log. On November 15th, I unistalled CIS and that was the way the patch installed ok.

[attachment deleted by admin]

That seems to suggest that something caused the problem yet it very much looked like it was CIS.

Yes puzzling. I myself have experienced difficulties installing security updates on a couple of occasions. On both occasions if I installed when logged in, the update went through successfully. If I installed when turning the computer off and on again, the install hung. Unfortunately I did not think of CIS at the time so cannot race this back to CIS for certain.

Best wishes

Mouse

Well, I tried out many things without success.
As I stated, if I download the patch and installed it manually there is no problem and the installation works fine.
If I perform the Windows update utility, it alerts me that there is an important security update of Office 2010 -see image0-. Then, if I allow this update, allways I get the error message -see image1-
In one of the many attempts, I got an alert from CIS about a virus detection -see image2-. I ignored the first alert but selected delete the second time. This only occured once and now i get no alerts but still can’t install the patch.
Another action I tried is to kill cmdagent and close cfp. Even with cmdagent disabled I’m unable to install the patch.
Now I’ll unistall CIS completely to see what happens…

[attachment deleted by admin]

Finally I’ve unistalled again CIS and tried to install the Windows patch through Windows update and … fails!!!
Now I’m very confused because the first time I experienced the issue, I ‘simply’ uninstalled CIS and everything went fine.
I’ve installed this patch manually and installed CIS again.

If there is a Poltergeist thread you can move this entire post there

I’ll mark this NBZ at the moment and see if we get other reports.

Best wishes

Mouse