# Windows Update Error 0x80072EFF



## rjwolfgang (Oct 6, 2010)

Hello,
I receive an error message with Error number 0x80072EFF in the upper right corner of the web page when trying to use the update.microsoft.com website.

I've tried resetting Windows Updates using MSKB article 971058, but that didn't seem to help. I also added the update websites 
suggested in other MSKB articles to the trusted websites in Internet Explorer, but that didn't help either.

Also, when I attempt to shut down my PC, it seems to freeze while shutting down at the screen that says "Windows is shutting down".

Here are some other details:
Microprocessor: ASUS P4S8X
Operating System: Windows XP Service Pack 3

Thanks,
Bob Wolfgang


----------



## BlackHatJack (Sep 18, 2010)

Lots of possible causes.

If you read far enough, one possible cause is malware.

http://forums.techarena.in/windows-update/407737.htm


----------



## rjwolfgang (Oct 6, 2010)

Hi BlackJack,

I also am routinely receiving the "Generic Host Process for Win32" error and my audio card also quits working, which is unusual since it normally would always work just fine before. I think I agree with you in that it's possible that I may have gotten some kind of malware inadvertently installed on my computer that slipped through somehow.

What next should I do? Should I somehow move this thread or start a new one in the "Virus/Trojan/Spyware Help" section of the Security Center forum area?

Thanks for your help!
Bob Wolfgang


----------



## BlackHatJack (Sep 18, 2010)

I think you should hold off until you find some evidence to support infection.


I have a list of general "fixes" or "things to do" when something is wrong and I don't know what it is.

1) Run chkdsk /r
2) Check Device Manager, click "show hidden devices" and report any flagged devices.
3) Check Event Viewer for significant and/or chronic errors that may give hints as to what the problem is.
4) Start>Run>(type)"MSCONFIG" and turn off all non-MS Services and all Startups. Reboot in Selective Startup and see if the problem goes away.
5) Remove all extraneous hardware and see if the problem goes away.
6) Report temps and voltages as displayed in BIOS, and
7) Install SpeedFan and report temps at idle and at high load (run an AV scan, a video or both).
8) Install "Dial-a-Fix" and see if there are any restrictive policies set (an indication of malware) and remove them if they are.

Uhh, there's prolly more but do those while I think of some more.


----------



## BlackHatJack (Sep 18, 2010)

Also, how long has this been a problem. Maybe the first thing to try is run a System Restore to a time prior to when these problems started happening.

What AV software do you have installed ?


----------



## rjwolfgang (Oct 6, 2010)

I have Norton Securtiy Suite ver. 3.8 installed that was provided by Comcast. This problem has persisted for about approximately one month. I've tried to do a system restore to previous statepoints, but they all failed, which has led me to believe there might be some malware shenanigans going on.

Also, per your directions, I'm not sure I understand how to do #3, which is to check event viewer. I'm also not sure how to do #7 and #8. In the meantime, I'll try to do the other things that you mentioned.

Thanks,
Bob


----------



## BlackHatJack (Sep 18, 2010)

Google the relevant text and it will become self-evident.


----------



## BlackHatJack (Sep 18, 2010)

BlackHatJack said:


> Google the relevant text and it will become self-evident.


Also, Dial-a-Fix has a tool to repair System Restore.


----------



## rjwolfgang (Oct 6, 2010)

Hi BlackHatJack,

I ran "dial-a-fix" software and received the initial error: "Dial-a-fix was unable to determine your version of Internet Explorer. Certain DLL registrations will be skipped. Please email [email protected]"

Then, during the scanning process, I also received some additional errors that seem to be related to Internet Explorer:
Error 127: C:\Windows\system32\iesetup.dll is not registerable or the file is corrupted. Your version iesetup.dll is 8.00.6001.18702. Please contact [email protected] so that an exception can be made for your version of this file.
Similar "127" errors were also reported for the following files as well: imgutil.dll, inseng.dll, mshtml.dll, msrating.dll, occache.dll, pngfilt.dll, webcheck.dll

Nevertheless, I still receive the 0x80072EFF error number when attempting to access the update.microsoft.com website.

I installed SpeedFan 4.41, and here are the recorded parameters:
ASUS ASB100 max. temp. of the four monitored was 47C
LM75 temps. were 43C
HD0 temp was 57C
COREA: 1.60V
VINR0: 1.57V
+3.3V: 3.18V
+5V: 4.87V
+12V: 11.13V
-12V: -12.38V
-5V: -4.45V

Fan1 speed is set to about 3000 rpm, Fan2 and Fan3 are 0 rpm (probably don't exist). Speed01 is set to 100% and Speed02 is set to 75%, which I'm not sure Speed02 even makes a difference with Fan1 speed, since it didn't seem to vary fan speed when the values were changed.

As far as Device Manager goes, I have a yellow exlcamation mark beside "ATI T200 Unified AVStream Driver". Even when I tried to uninstall and re-scan for new hardware using the wizard, it automatically found the device again and re-loaded the current driver (ATI Technologies, 6/13/2007, ver. 6.14.10.1082), but it stated that there was an error and that the device may not work properly. I can't even roll back the driver to an earlier state. I suspect that I may have to physically remove the present driver file from under the C:\Windows directory somewhere and try to reinstall one that I've downloaded that is a slightly earlier version that I was able to find (6.14.10.1059).

As far as system restore points go, I didn't see any earlier restore points that I could use. i suspect that they must have been cleared out somehow when I tried to fix the System Restore wizard using "dial-a-fix" software.

Anyway, thanks for your help, I do appreciate it; I didn't even know that these tools existed!

Bob


----------



## BlackHatJack (Sep 18, 2010)

The errors from dial-a-fix are normal and are because the software's author has not updated the software for Internet Explorer 8. All those errors result from not being re-register the .dll files for IE8, but everything else for XP works just fine.

Did it find any ""Restricted Policies" ? That tool is not part of the normal scan; you have to look around for it.

Also, I do not think it deleted your Restore Points. They may have been damaged/corrupted before you started.

Here's a wiki to read on Dial-a-Fix:
http://wiki.lunarsoft.net/wiki/Dial-a-fix

Your HD temperature as reported by SpeedFan is so high I don't believe it. Do you have a case fan ? Does it spin ? Is the interior of your case completely clogged with dust ?

All your voltages are off, and some are simply bad. I think your culprit is your Power Supply. A bad PSU can cause all manner of symptoms by corrupting the data.

Post the manufacturer, model # and Power Output of your CPU, so we can get some idea of it's quality. Also, post the voltages as reported in BIOS (they are more reliable than Speedfan). But I think at the end of the day your PSU is going to be bad, so get ready for that. We need to make certain before condemning it.

Uninstall the flagged device, and reboot & let it reinstall. Report if it reinstalls normally. Bad power may have corrupted it's driver and caused the problem. We're looking for a common denominator to explain as many symptoms as possible, preferably all.

Did you run chkdsk /r and if so what were the results?

Are the Virus Definition files current or and is the license current or expired on your Norton AV ?

Also the MSCONFIG sugggestion is a good one to try. Report results.


----------



## rjwolfgang (Oct 6, 2010)

Hi BlackHatJack,

Here are the responses to your questions in sequential order:

1. No restricted policies were found.

2. Case fan? ... What case fan? I think that could be the problem, especially since it seems like I've been solely relying on natural convection for the past three years. I do see a place where I can mount one and install a connection on the motherboard--I'll try and get one as soon as possible. The PC was pretty much put together with separate components and custom built by myself. The dust in the case is not that bad.

3. I have an Intel Pentium 4 478/Northwood Processor, 2.53 GHz, but not sure what the power output is.

4. No difference with the flagged device when I deinstall it and let it reinstall on startup--still the yellow exclamation mark beside "ATI T200 Unified AVStream Driver".

5. I ran chkdsk /r and let it go overnight since it took such a long time to run. The PC still freezes when shutting down or restarting and I also received the generic win32 host process error again after starting up, which I suspect may be related to the Automatic Windows Update service being unable to access the Windows Update website (I still get the 0x80072EFFerror when I attempt to go to that website manually). Is there supposed to be a log file somewhere that records the results from running "chkdsk /r"? I couldn't find one. 

6. Yes, my Symantec virus definition files are current and my subscription license is still active.

7. I tried MSCONFIG with only MS applications on startup, but still was unable to successfully access the Windows Update website.

Hope that helps with your questions. I'll definitely be looking for a case fan right away!

Thanks,
Bob


----------



## BlackHatJack (Sep 18, 2010)

chkdsk /r:

http://vlaurie.com/computers2/Articles/chkdsk.htm

chkdsk outputs a report to Control Panel>Administrative Tools>Event Viewer>Applications. It should say whether or not it found and fixed any errors. If it did, re-run the test until it finds no errors. If it finds errors on 3 consecutive scans, that means there is a 90% chance your hard drive is on the way to permanent failure and begin data recover operations immediately.

The most important suspect right now is the Power Supply. Please report the voltages as reported in BIOS.

A case fan is a good idea, particularly with a P4. Is the CPU fan clean/clear and spinning ? Post temperature as reported in BIOS.


----------



## rjwolfgang (Oct 6, 2010)

Sorry about that. I forgot to post that information in my last response:

BIOS temp. readings:
CPU: 54 deg. C
MB: 43 deg. C
CPU fan speed: 3461 rpm
Power fan speed: 1834 rpm

BIOS Voltage readings:
VCORE: 1.56 V
+3.3V: 3.23 V
+5V: 4.89 V
+12V: 11.84 V

Also, the CPU fan is clear and spinning. I typically will open up the case and blow out any dust I find every few months or so.

Thanks,
Bob


----------



## rjwolfgang (Oct 6, 2010)

Also, I checked the Applications list under the Event Viewer option under the Administrative Tools Control Panel applet, but I didn't see anything related to chkdsk entries, unless it's known by a different name.

Thanks,
Bob


----------



## BlackHatJack (Sep 18, 2010)

rjwolfgang said:


> Also, I checked the Applications list under the Event Viewer option under the Administrative Tools Control Panel applet, but I didn't see anything related to chkdsk entries, unless it's known by a different name.
> 
> Thanks,
> Bob


The chkdsk entries are hard to find, but they are in there. You can bracket where it is by bracketing WHEN the check was run. If you can't find the results, run the check again and note it's results.

Your voltages look good, please post the manufacturer, model and power output of the PSU so we can get a feel for it's reliability.

54C is high but normal I think for your Pentium, and I don't think it's high enough to corrupt data. Since power looks good and if there are no hard drive errors, I can think of nothing other than malware to be the "general" cause. So, despite the inconvenience, I'd recommend getting vetted-out by one of the Security Experts/Analysts. If that comes up clean, then you really are into the thick of it.

The choice there would be to either treat the problem with a "General" fix, i.e. a Repair Install, or try to find someone that has very technical knowledge of this error, how it's caused, how it's fixed, etc....

And I agree as you've stated by your determined actions, you've got to be able to get Windows Updates. This is something that has to be fixed.

It seems to be network related, the error message. Maybe someone in networking can help. Also the audio driver issue


----------



## rjwolfgang (Oct 6, 2010)

Hi BlackHatJack,

Thanks for sticking with me on this; I really do appreciate it. Also, you'll be pleased to know that I installed a PC case fan (yay!) and now look at my temperatures:

Temp1: 38C
Temp2: 39C
Temp3: 39C
Temp4: 25C
Temp: 39C
Temp: 39C
HD0: 48C

A lot better than before!

My power supply is an Antec True430 with 430 W max. rating. It also had this information on the label:

+5V, +12V and +3.3V max. load 410 W.

Thanks again for all your help! I'll be standing by for any further guidance.

Bob


----------



## BlackHatJack (Sep 18, 2010)

Antec is a good brand, and that wattage should be good.

I guess it's too much to hope that the problem has gone away since the introduction of the case fan ?

If not, I'd go do the Securities Forum thing, start a new thread there, give a basic description, i.e. you can't update windows, this forum can't find the cause and you'd like to get checked in case you are infected despite the fact that you have no real evidence that you are. Post a link to this thread in that post so someone there can read through it if they like.


----------



## BlackHatJack (Sep 18, 2010)

Also, I think dial-a-fix does this one for you, but it might be a good idea to try the second method listed:

http://support.microsoft.com/kb/943144


----------

