Problem with MS12-034 / KB 2676562 patch @ AskWoody.com

Problem with MS12-034 / KB 2676562 patch

Posted on May 9th, 2012 at 11:06 woody 25 comments

Another interesting Black Tuesday.

I’m getting word (thanks again, SB!) that a lot of Windows XP users are having problems installing the MS12-034 / KB 2676562 patch. That’s the “Critical” combined patch for (got your scorecard out?) Office, Windows, .NET and Silverlight.

There are zillions (well, two dozen) additional KB articles that address specific parts of the patch described in KB 2681578.

Ready to start drowning in MS security alphabet soup? In fact, this is a double update, involving not only the KB 2676562 patch but also the KB 2686509 patch. More than a hundred files are involved. It ends up that both patches have to be applied in order to shore up a problem with loading keyboard layout files in Windows XP and Server 2003. That problem’s identified as CVE-2012-0181.

When you try to run the patch through Microsoft Update, you may hit an Error 0x8007F0F4 – Installation Failure on the KB 2686509 patch. The error message tells you to try to install the update again. When you do, it fails again.

You may also see the message, “Setup cannot continue because one or more prerequisites required to install KB2686509 failed (0x8007F0F4)”

Here’s Microsoft’s official response to the problem:

The detection logic for the security update package identified as KB2686509 performs an eligibility check of the system in order to verify whether the system meets the requirements to activate the fix applied by KB2676562, which addresses CVE-2012-0181. If the system meets the requirements, both KB2686509 and KB2676562 will be successfully installed on the system and the vulnerability described in CVE-2012-0181 will be addressed. Otherwise, KB2686509 will be re-offered until the system does meet the requirements. Successful installation of both the KB2686509 and KB2676562 update packages are necessary to be protected against CVE-2012-0181 on Windows XP and Windows Server 2003 systems. If your system does not meet the requirements to install the update, please follow the guidance documented in Microsoft Knowledge Base Article 2686509

If you look at KB 2686509, here’s Microsoft’s workaround:

This update enumerates all the keyboard layout files that are registered on your computer, and then it verifies that they are all in the %Windir%\System32 folder.

Why is this update re-offered multiple times?

Windows updates are reoffered until the update is installed on your computer. If this update is reoffered, maybe an installation failure has occurred. Check the KB installation log files for error codes. For example, the KB installation log file for this security update would probably be “C:\Windows\ KB2686509.log”

What should I do if the installation of this security update fails with the “0x8007F0F4″ error?

If you receive the “0x8007F0F4″ error when you try to install this security update, follow these steps:
1. Open the Faultykeyboard.log file that is in the %windir% folder. This log file contains information about registered keyboard layout files that are not in the %Windir%\System32 folder. The log file will resemble the following:
3. ```
Keyboard1.dll
```
4. ```
.\Layoutfiles\keyboard2.dll
```
5. ```
C:\Windows\System\Kbda1.dll
```
  Note In this example, the first entry is just a file name. The second entry includes a relative path with the file name. The third entry includes a full path of the file.
6. Copy the files that are listed in the Faultykeyboard.log log file into the System32 folder.
Note Contact Microsoft support if you cannot find the Faultykeyboard.log file.

So there you have it. Aren’t you glad you followed the MS-DEFCON system, and didn’t let Windows Automatically Update your system?

Windows Patches/Security 0x8007F0F4, KB 2676562, KB 2686509, MS12-034
25 responses to “Problem with MS12-034 / KB 2676562 patch”
1. Jeff May 14th, 2012 at 21:21
  
  This update installed successfully for me, but results in a blue screen upon computer reboot. The machine will not boot normally until I rollback the update. 2686509 has been installed without issue.
2. woody May 14th, 2012 at 23:01
  
  @Jeff -
  
  Hoo boy. Another mess-up. Thanks for the notification.
3. Jeff T May 14th, 2012 at 23:15
  
  KB 2676562 says it has finished installation, but it still is not installed. I’ve tried installing it from the system tray prompt and from the microsoft windows update website.
4. Alex May 15th, 2012 at 01:50
  
  We are experiencing blue screens after a reboot on Server 2003 x64 systems. Has anyone come up with a fix for this server specific side effect?
5. Purple nDeface May 15th, 2012 at 19:51
  
  On some w2k3 boxes the faulty keboard copy trick worked. On this chi-rho box it has no effect.
  gateswear….!
6. Ryan May 15th, 2012 at 21:48
  
  KB2676562 installed fine on Win XP 64bit for me but resulted in blue screen upon reboot. I removed only KB2676562 (extremely lucky that it was the first one I rolled back) and I’m up and running again.
7. Michael May 16th, 2012 at 07:20
  
  Thanks for the tips on how to solve the KB2686509 (the patch that never stops patching) problem. This thing was driving me nuts and MS support problem description and instructions way too complex to be effective. I just went to dlldump.com, downloaded the missing kbxxxx.dll files and copied them into the system32 directory and the silly patch finally completed.
  
  I love the KISS (keep it simple, stupid) principle. Works every time.
8. Bruce Roberts May 17th, 2012 at 05:06
  
  Only positive comments get published? How surprising.
9. woody May 17th, 2012 at 11:24
  
  @Bruce -
  
  I moderate all comments, and sometimes it takes me a couple of days to get to them.
  
  I have to moderate because of all the %$#@! spam…
  
  Negative comments always most welcome.
10. woody May 17th, 2012 at 11:29
  
  @Alex -
  
  Can you isolate it to just KB 2676562?
11. GGatty May 18th, 2012 at 02:51
  
  @Woody
  @Alex
  
  I ran into this problem on May 15, also with Server 2003 x64.
  
  The updates that were being applied at that time were:
  KB2636927
  KB2686509
  KB2659262
  KB2676562
  
  After rebooting in safe mode and uninstalling all four, a patch-by-patch update narrowed it to KB2676562.
12. Lana May 18th, 2012 at 05:58
  
  I have tried different things like running MS FixIt, MS Safety Scanner, and clean booting. But I have the same problem as Ryan. I install KB2676562, reboot, and get a blue screen. Does anyone know if Microsoft is working to fix this?
13. woody May 18th, 2012 at 22:12
  
  @Lana -
  
  They’re working on it, but no notice of a result as yet.
14. Bruce Roberts May 19th, 2012 at 23:24
  
  > @Bruce -
  > I moderate all comments, and sometimes it takes me a couple of days to get to them.
  > I have to moderate because of all the %$#@! spam…
  > Negative comments always most welcome.
  
  Well, my comment which never made it through moderation was an answer to your question:
  
  Aren’t you glad you followed the MS-DEFCON system, and didn’t let Windows Automatically Update your system?
  
  No, because 21 important automatic updates on 5/9 didn’t cause me a single problem and so I’m protected from a whole bunch of security vulnerabilities marked “exploit likely”, which followers of your MS-DEFCON system are not.
  
  Bruce
15. woody May 21st, 2012 at 19:55
  
  @Bruce -
  
  AHA! I didn’t see that comment.
  
  If you want to install Windows updates automatically, you’re most welcome to! Just be aware of the fact that *every* experienced Windows user I know – every single one – waits and decides if installing updates is safe or not.
  
  Consider.
  
  How many of the 21 important updates on May 9 actually prevented you from getting an infection?
  
  How many of the people who follow my blog installed one of the important updates, and had it mess up their machines?
  
  My guess is that the answers are about zero, and about ten.
16. Christian May 22nd, 2012 at 00:34
  
  The crash is caused in three (or more) possible problems.
  1. Any entry (not a subkey) in HKLM\SYSTEM\CCS\Ctrl\Keyboard Layout crashes the update
  2. Subkeys in HKLM\SYSTEM\CCS\Ctrl\Keyboard Layouts without an existing kbd????.dll in %Systemroot%\System32 crashes the update
  3. Subkeys in HKLM\SYSTEM\CCS\Ctrl\Keyboard Layouts with an existing kbd????.dll without a valid version number crashes the update (found rarely).
  
  My VB-script is out ther, run it, reboot, run the hotfix, reregister the exported registry entries.
  
  End of story.
  
  Regards
  Chris
17. John Valentine May 22nd, 2012 at 22:42
  
  If it was only a couple of machines I would not mind, but all of our cash registers and all of our manager’s PC have special keyboard layouts so KB 2686509 has managed to fail on over 2500 machines. I am sure that every single cash register in the world built on XP has special key sequences, so a lot of retailers ae peeved right now.
18. woody May 23rd, 2012 at 07:05
  
  @John -
  
  OUCH.
19. Mark6 May 24th, 2012 at 03:37
  
  Here’s a link to the script Christian mentions. http://msmvps.com/blogs/bradley/archive/2012/05/14/i-wrote-a-vb-script-to-fix-two-problems-while-running-microsoft-security-update-kb2686509.aspx
  
  Is this script supposed to fix the BSOD issue – or just the install failure problem?
  
  We’ve had a couple instances where the patch installs and BSOD the machine. Both so far are 2003R2 SP2 64bit.
20. Mark6 May 25th, 2012 at 04:17
  
  OK— for us where where the patch KB2676562 installs correctly – but BSOD after reboot, it appears Symantec Antivirus was the culprit.
  We needed to uninstall it completely – reboot – install the patch – reboot. Luckily for us we’re not using SAV anymore.
21. Lana May 26th, 2012 at 00:37
  
  @Mark6 Thank you. You are a genius! Sadly, Symantec Antivirus is required at my work but we are moving to Symantec Endpoint Protection. Now I am running KB2676562 and SEP on WinXP x64 without problems.
22. Byron May 28th, 2012 at 00:48
  
  I had BSOD blue screen after that update to KB2659262.
  
  Also the “Operating System Not Found” error is a real pain as I assumed the drive was failing and did a SMART test as well as a full chkdsk /f /r on the drive.
  
  Didn’t have Symantec Antivirus (Microsoft Security Essentials) on this Windows 7 Home Premium x64 machine. After trying many things including uninstalling .Net, Silverlight, Java, and a few old programs, still with no luck (created a restore point after each and then did the install of KB2659262 to be sure). Finally just decided to hide the update in hopes that Microsoft will come out with another down the line that supersedes this and doesn’t cause the return of this nasty loop the customer was experience of auto-upgrade, shutdown, restart-FAIL, auto-repair to restore to previous, then back again when the machine once again did the auto-update on KB2659262 (and it was about 14 updates that had to be rolled back so it wasn’t quick!)
  
  Literally hours of poking around looking for disk failure, malware, rootkits (gmer found nothing but changme.exe did mention NTDLL.DLL modification but couldn’t really find anything maybe because it’s x64?), only to track it down to just the one FckedUpdate (FUBAR!)
  
  Hope this helps anyone who finds this!
23. David May 28th, 2012 at 08:16
  
  Check out the following http://www.vivus.net/dl/ he has a patch that worked.
24. Colin June 2nd, 2012 at 17:14
  
  I have a similar problem, update KB2676562 fails to install, it’s been trying now for weeks!
25. Olin June 12th, 2012 at 04:25
  
  I found this discussion with Google and seems that I have a related issue with XP x86. That is, 2012-05-21 I put in the following:
  
  - KB2695962
  - KB2676562
  - KB2596880
  - KB2596672
  - KB2597162
  - KB2636927
  - KB2659262
  - KB2686509
  - KB890830
  
  After that, ever-so-stable XP installation started giving me BSOD several times per day.
  
  I saw ill behaviour reported with SAV, but the thing is that I’m running Avast. So perhaps there’s more than one security software KB2676562 isn’t happy with.
  
  After uninstalling both KB2676562 and Avast, running all kinds of rootkit/malware detectors and hardware tests, and even disassembling the whole box and putting it back again – all this to no avail – I’m now forced to face that my OS is irrevocably broken and mourning the date of my last full backup.
  
  I do wish I would have realized to google this prior to all the disassembling etc. Thank you very much for testing this stuff, Microsoft.
Leave a reply

Name (required)

Mail (will not be published) (required)

Website