Category: Software

Windows Update / Microsoft Update fails with error 0x80072EFD when running McAfee Virus Scan Enterprise 8.0i

C:Amie/ / Software

System Requirements:

  • Windows 2000 SP4 + BITS 2.0
  • Windows XP SP2
  • McAfee Virus Scan Enterprise 8.0i

The Problem:

This is one of those irritations that could (and should) have been sorted immediately, but lingered for months with a really very simple solution.

When you are using a suitably equipped version of Windows and happen to have McAfee Virus Scan Enterprise 8.0i (Confirmed on Patch 11 and 15, but should apply to any patch version and 8.5i) installed, your computer(s) fail to receive automatic updates through the AUClient Windows Automatic Updates service. In addition, if you attempt to access Windows Update or Microsoft Update, the update detection fails with error code 0x80072EFD.

All contemporary fixes / Microsoft suggestions to fix this fail to resolve the problem.

The Fix:

This is well and truly McAfee’s responsibility, it isn’t their fault – but it is what you get when you blur the line between an anti-virus product and a firewall.

I could argue the point that some foresight in providing some foresight in the product on this, or some reference to the issue on their knowledge base would have been useful, particularly as this ‘issue’ impacts users connecting both to the web based WU/MU and any corporate SUS system.

McAfee Virus Scan has a non-default option to inhibit port 80 downloads from non-approved executives. If through group policy, custom installation script, or distribution agreement (as with local authority school distributions of Network Associates McAfee AV) this policy has been enabled, then the Automatic Updates service is prevented from connecting to the Internet and downloading catalogue information.

Internet Explorer sessions to SUS/WU/MU are impacted because as of version 5 server connections they now rely upon the Automatic Updates service and the Background Intelligent Transfer Service (BITS) to make use of Windows Update.

To fix the error you have two options:

  1. Disable to McAfee Access Protection Policy
  2. Add the Service Host process wrapper used by the AU/BITS services to the approved connections list

 

Disable the Access Protection Policy

  1. Open Virus Scan Console as an Administrator
  2. Right click Access Protection
    Virus Scan Console: Access Protection
  3. Choose Properties
  4. Remove the check mark next to “Prevent Downloads from the World Wide Web”
    Access Protection
  5. Click OK

 

Approve the AU/BITS service to perform port 80 downloads

Both the Automatic Updates service and BITS service run as part of the Service Host Process wrapper service (as do many other system services), therefore you must allow the Service Host download permission to resolve this problem without fully disabling the McAfee policy.

As an administrator you should consider this carefully and ensure that if nothing else McAfee is patched and receiving updates properly. If your systems are not adequately protected, they may be vulnerable to exploitation by the plethora of Service Host process resident malware applications and viri, which can potentially embed themselves into a Service Host process. As a direct consequence of disabling this policy any such code will by default receive port 80 (the only port by default) download access.

Disabling through the Interface

  1. In the Access Protection configuration in Virus Scan Console, highlight “Prevent Downloads from the World Wide Web” and click the edit button
  2. Add ‘svchost.exe’ (without the ‘ ) to the exceptions list
    Block Range
  3. Click OK

Disabling through the registry

The fastest way to sort it is to distribute the registry change through group policy (or similar). The information below is correct for VSE 8.0i Patch 15.

HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\On Access Scanner\BehaviourBlocking
REG_SZ: PortBlockWhiteList_3
Value: (see below for overview of the required change)

McAfee Vanilla Install Settings:
outlook.exe,msimn.exe,iexplore.exe,mozilla.exe,netscp.exe,opera.exe,thunderbird.exe,msn6.exe,neo20.exe,mobsync.exe,waol.exe,nlnotes.exe

Required Change based upon Vanilla Install:
outlook.exe,msimn.exe,iexplore.exe,mozilla.exe,netscp.exe,opera.exe,thunderbird.exe,msn6.exe,neo20.exe,mobsync.exe,waol.exe,nlnotes.exe,svchost.exe

Adobe Acrobat Reader 8.0.1 & Adobe Speed Launcher – it’s back, but they did not want you to know

C:Amie/ / Software

System Requirements:

  • Adobe Acrobat Reader 8.1.0

The Problem:

Second Adobe gripe in not too sizable space of time, here is the first.

Adobe Acrobat Reader (It’s Acrobat, it was Acrobat when they released it, it’s Acrobat now, sue me) has developed a superiority complex over the years. For some reason it thinks that it needs to sitting in RAM at boot time on everyone’s system, just so it can dump its IE ActiveX control into the browser AX cache the little bit faster. Newsflash – Every sys-ad under the sun deletes the darn thing.

It looked for a glimmering, magical moment when Adobe released Acrobat Reader 8.1.0 that they had finally woken up… alas they moved it out of the Start-up folder on the Start Menu and dropped it into the registry hoping that no one was going to notice.

The Fix:

Let us be honest here, you don’t really need me to tell you where to go. You already know, you just don’t want to believe it.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Yeah…

So pull out Group Policy and get deleting post-install. There are so many fun, time wasting ways that you can remove this (again and for the 11th time in a reader release).

If you are really stuck, here is a .reg sample that will do it:

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“Adobe Reader Speed Launcher”=-

Adobe Flash Player & Shockwave Player Corporate Distribution i.e. redistributable binary

C:Amie/ / Software

System Requirements:

  • Adobe Flash Player Plug-in
  • Adobe Shockwave Plug-in

The Problem:

Adobe are Google inept…

Here’s a really crazy idea, I want to redistribute Flash to PC’s without going to each PC and installing it by hand!

Obviously I’m off the planet on that one, having 600 workstations that got updated to Macromedia’s Flash 8.2x plug-in over a year ago because I wrote an installer for the blessed thing by hand. 30 workstations which had anything from flash 4 to Flash 8.2x on (which I did upgrade by hand).

Google anything to do with Flash, Deployment, Corporate, Redist, Redistributable… and you’ll get nothing back.

Shockwave is even worse, we wont go there. Suffice it to say much bandwidth was lost on the 30 workstations and the 600 never got touched, despite progressive urgent security updates coming out of Macromedia/Adobe on the poor state of their plug-in.

If anyone from Adobe is reading this, yes, I am irate, you wasted a significant amount of time which I will never get back again! LEARN TO MAKE A WEBSITE.

The Fix:

When Adobe released Flash 9.x, they changed the install system to a binary cab, the installer engine in cab 1, named “Ultrashim.cab” and then the data cab after it. For some reason I couldn’t build a hand installer on these because the thing never registered properly with MSIE.

When they release 9.0.47.0 they removed the second cab completely, favouring some proprietary installer system in ultra-shim. If you pulled ultrashim apart and manually ran it, it would (eventually) install the 1.5MB data download after a significant wait time. Thing is that in my experience users get a little irate if they have to sit at a boot screen waiting for an unspecified amount of time while some unnecessary little loader daemon suckles the proverbial teat of Adobe Systems Inc.

For anyone who wants to look, here are Ultrashim.cab and the “really clever Adobe, you are so hilarious and clever” data file install_flash.foo.s.

 

Contrary to popular belief, and for those who don’t have enough hours in their day to read the small print on every Adobe.com page with “flash” in the text (and who are frantically Googling the topic). Adobe DO have corporate deployment systems for Flash Player and for Shockwave Player, they just don’t want anyone to find it.

Adobe will give you either a .exe installer (which does not have any silent install prompts that I can find) or a .msi which obviously does for both browser technologies. You can get hold of the MSIE version and the non-MSIE version (firefox and what have you), as well as multi-language and Linux/Unix/Mac OS versions.

 

How to get it

You have to site license yourself for it I’m afraid. The small print can be found here.

The following URL’s were valid at the time of publishing.

If you want Flash Player 7,8,9 only go to:
http://www.adobe.com/cfusion/entitlement/index.cfm?e=flash

If you want Shockwave Player 10 only go to:
http://www.adobe.com/cfusion/entitlement/index.cfm?e=shockwave

If you want Flash Player 7,8,9 and Shockwave Player 10 go to:
http://www.adobe.com/cfusion/entitlement/index.cfm?e=flash_shockwave

It is nothing more than a con to get you to sign up to their mail system really. so Adobe, yet again I’m not impressed. You’ll register, they’ll email you your welcome to Adobe fun email and behind that will come the automated download links.

I cannot post the download URL’s because the URL information contains the licensee registration ID. I can state however that the redists seem to be up-to-date at least in terms of Flash 9.

Removing Windows Media Player 7 from Windows Millennium

C:Amie/ / Microsoft, Multimedia, Software

Windows Millennium… The final stage in MS-DOS’s evolution. With this release of Windows, 9x is no more.

As with a lot of Microsoft products… you always feel that you get lumbered with MegaBytes of unnecessary data, programs and dll files.

You could call this page the Head Quarters of the “Say No To 7” campaign.

So what can be done about it:.

We want some of the extra features. We want the operating system shell, Kernel and GUI enhancements, but not all of the features:

Updated 22nd February 2006

Windows Media Player 7

This application may be Microsoft’s first attempt at an all in one media player, and in my opinion… they didn’t quite hit the mark. The biggest problem with it is its resource requirements. They are huge. The application takes far too long to load even on the fastest of systems. This of course means that that you will run out of available memory, run up a huge swap file and have to reboot the system.

There are still problems with the CD audio, you are lumbered with features that you will never use such as the mobile device synchronisation options. All of these could be optional and save on the space.. but no. As with windows, office and so many apps before it you can’t.

NOTE: This has not been tested any other Operating System than Windows Millennium

For those of you devoted to Windows Media Player 6.4 here’s how to get your music life back (Please make sure to read all instructions before proceeding):

To uninstall Windows Media 7 under Windows Millennium

  1. Download and Re-install WM7 from http://www.microsoft.com/windowsmedia/   (This is required to install the uninstall routines)
  2. Open a Command Prompt
  3. On the prompt type(Assuming that ME is installed on c:):
    c:\windows\inf\unregmp2.exe /SafeUninstall:c:\windows\inf\wmp.inf
  4. Press enter
  5. Reboot the Computer
  6. Open a Command Prompt
  7. On the prompt type(Assuming that ME is installed on c:):
    c:\windows\inf\unregmp2.exe /SafeUninstall:c:\windows\inf\mplayer2.inf
  8. Press enter
  9. Reboot the Computer*
  10. Delete the directory C:\Program Files\Windows Media Player
  11. Download and install Windows Media Player 6.4 from http://www.microsoft.com/windowsmedia/

You will now have removed Windows Media 7 from Windows ME, and replaced it with a full copy of Windows Media 6.4:

If you do not wish to install and use Tweak UI, you can place the commands at step 6 and 15 into a Start: Run dialogue box and selecting OK. If this fails then you will have to use Tweak UI

* After this point, and only if you are an advanced user, you can access the system registry and remove all references to Windows Media Player, WMP, mplayer and c:\program files\Windows Media Player . Be sure to back the registry up first of all and Re-Boot after you have finished. This will ensure that you have removed most traces of 7 from your system, and will help keep the registry tidy.
You can also remove certain system files regarding Windows Media Player. Click Here to download a partial list.

No Media Player… No CD Player

New Version 1.3 – Now with Auto Start support!

In removing 7 from your computer, you have now removed Audi CD capabilities. I have compiled a file that will install the Windows 98 CD-Player on Windows ME

  1. Download ME_CD_Patch13.zip (251 KB) from this server
  2. Run the file
  3. Make sure to read all on-screen instructions before proceeding
  4. After installation, all of the required system files will have been updated with the CD Player routines. Except the registry
  5. The registration entry’s will be listed on the desktop as 0.reg – 12.reg. You will need these files in order to install and use auto start
  6. Insert files 0.reg – 12.reg by double clicking them and saying OK *
  7. Open ‘Control Panel’, ‘Add/Remove Programs’. Go to the ‘Windows Setup’ tab, select ‘Multimedia’. Tick ‘CD Player’ and click ‘OK’
  8. The files will install
  9. Reboot Your Computer

* Back up your system registry before running this update

After Running this update you will have to install the registry update files found on the desktop. These files update the Add/Remove Programs tab as to the presence of CD Player and enable the CD Audio auto start feature. I plan to write a automated installation file soon.

To uninstall Windows Media 6.4 under Windows Millennium

  1. Download and Re-install WM6.4 from http://www.microsoft.com/windowsmedia/   (This is required to install the uninstall routines)
  2. Open a Command Prompt
  3. On the prompt type(Assuming that ME is installed on c:):
    c:\windows\inf\unregmp2.exe /SafeUninstall:c:\windows\inf\mplayer2.inf
  4. Press enter
  5. Reboot the Computer*
  6. Delete the directory C:\Program Files\Windows Media Player

You will now have removed Windows Media Player completely from Windows ME.

* After this point, and only if you are an advanced user, you can access the system registry and remove all references to Windows Media Player, WMP, mplayer and c:\program files\Windows Media Player . Be sure to back the registry up first of all and Re-Boot after you have finished. This will ensure that you have removed most traces of 6 from your system, and will help keep the registry tidy.
You can also remove certain system files relating to Windows Media Player.

Keeping Windows Media Player 6.4

So, you’ve decided to do the honourable thing. You value your system resources, that or your worried about your Grid Computing project results being crippled by WM7.

If you check your resources, you’ll find that WM7, playing your average MP3 can take between 60% and 90% of your system processor resources away from you. Catastrophic if you use a processor dependant application such as SETI@Home. In contrast, the New WM8 (Windows XP only) takes 50% – 70% and Windows Media 6.4 anything between 1% and 15% of system resources*

Microsoft, are in fact updating Windows Media 6. They don’t publicise this, as they want everyone on version 7 or above. Microsoft are updating 6.4 to suit the new codec’s and Internet Explorer versions that they produce. This inevitable was their own mistake in deciding not to allow Windows 95 and NT 4 users to use WM7. For what ever reasons they chose to do this, technical or political fortunately for us we can still get the most out of 6.4.

The latest build of Windows Media 6.4 is version:

For Windows 3.1x:
3.5.980703
(Maximum Internet Explorer version 5.0 build 913.2206)

For Windows NT 3.5x:
Not released
(Maximum Internet Explorer version 5.0 build 913.2206)

For Windows 95:
6.4.07.1124
(Maximum Internet Explorer version 5.5 SP2 build 4807.2300 + Q320920)

For Windows NT4. 98 and Millennium:
6.4.07.1129
(This version ships with Internet Explorer 6.0 SP1 build 2800.1106 + Q828026)

For Windows 2000:
6.4.09.1129
(This version ships with Internet Explorer 6.0 SP1 build 2800.1106 + Q828026)

For Windows XP Home, Professional:
6.4.09.1130
(This version ships with Internet Explorer 6.0 SP2 build 2900.2180)

For Windows Server 2003:
6.4.09.1130
(This version ships with Windows 2003 Internet Explorer 6.0 build 3790.0)

If your using Windows Media Player v6.4, you can extend its functionality by installing the following patches and utilities.
Note: These will not work with Windows Media Player for Windows 3.x. Do not install on Windows XP installations

Patch Downloads Codec Downloads

The remaining life in Windows Media Player 6 is on borrowed time. With Windows 95 having been retired on Dec 31st 2001 and likewise with NT 4 / Windows 98 being retired in July 2003 users can expect 6.4 to become a distant memory.

Microsoft have always had a thing about it’s media players. Distributing the old MCI version of it right up until Windows Millennium. Even then in Windows Millennium 6.4 remained present side by side with 7.0. Windows XP no longer included the Windows 3.11 MCI version, but 6.4 remains side by side with 8.0 & 9.0.

I predicted that “Windows .net, the next Windows version due in 2003 will not contain 2 versions of Media Player. The minimum system specification by then won’t warrant it. But by then you are likely to see the ability to choose your Media Player and Internet Browser, at least the front end of it. Personally, I’ll be sticking with Microsoft’s contributions to the industry.”

With the release of Windows 2003 Server, the renamed Windows .net, Windows Media Player 6.4 still ships along side 9.0. Windows Media Player 9 updates that modify the core .OCX drivers in media player will however continue to incriment the Windows Media Player 6.4 build number, as has been shown by the univeral rise to build version 1128 with the relase of Q808226.

But at the end of the day its entirely down to personal preference

*Statistics taken on an Intel PIII 733eb with 256 MB RAM

Windows Media Player 9.0

Windows Media Services 9 is upon us, and with this comes Windows Media Player version 9. What makes this significane is that it, unlike version 8 can be installed on other Operating Systems. I can confirm from seeing the beta’s that 9 installs on Windows 2000 and runs quite well. I’ve not tried it on any 9x OS, however under Microsofts Operating System retirement policy, I would expect it to install on Windows Millennium, and perhapse Windows 98SE, but I would hold me breath over any of the 98’s.

Windows Media Player 9 is virtually identical aestetics wise to that of Windows XP’s version 8, however there have been refinments to both the code, the layout, the look and most importantly the codecs and underlying backbone of Windows Media format.

The player in its beta format handles better than Windows Media 7 does. However users won’t be surprised to learn that it covers the same sort of CPU and memory overhaeds as 7.1 and 8 respectivly do on their OS’s. This is perhapse the price we pay for eveoloution, who knows. The crux of the matter is that 6.4 unfortunatly is becoming more and more unstable especially when connecting to streaming servers. Its reliability is deminsihing.

With this volly of new Windows Media technologies, I can only guess that there will be new ActiveX plugins finally to facilitate the advances in browser technology and in Streaming technology. This change will spell the ultimate end for 6.4. Even if the 9 format will play on 6.4, it is unlikly that it will be able to play back on 6.4’s ActiveX, that has for so long been the only realy way to deliver any Windows Media, ASx / WMx / Proparetly WM6 format content over the internet.

I still use 6.4 for my MP3 listening and for video playback where it can handle it. But I’m increasingly using 8 to watch streaming content and inevitably under Windows XP to listen to Music CD’s. Reluctantly I’m being dragged kicking and screaming into the 21st MultiMedia century, and I imagine so will you. Although not necesarily with Microsofts player.

The Question that I can see your all posing to me right at this moment… Can I remove Windows Media Player 9.0.. answer… Not the Beta version you can’t!

UPDATE 7th August 2002:
Having now had a chance to play with 9 properly, I have to say that I am very much impressed. Microsoft have clearly been listening to the Windows Media community over it.

Some key points worth noting are:

  • The new Taskbar Tile player, perfect for keeping an eye on web feeds, dvd’s, visualisations and controlling your multi media
  • Info Centre. New improved to provide track and album info, as well as links to purchasing the music
  • Improved CD recognition technologies. Non-US CD versions of a release now display the correct track data (UK Releases at least)
  • .NET services bar. I suspect that this will become more of a feature in the future as the inductry drives towards cleaning up the Internet Music environment
  • New A/V mulitmedia effects. Such as cross fading of media and the little touches on minimisang and maximising video

Removing Windows Media Player 8

Can it be done, can it be removed From Windows XP?

No, not using the methods described here on this page. I also do not want to experiment with this as, until we see Windows Media Player 8.1 arrive, there is no way to re-install it once its gone, short of a system re-install.

However, due to the current legal wrangles going on between the Microsoft Corporation, the United States and the European Union. Microsoft have submitted to the findings of the litigation and, in the forthcoming Microsoft Windows XP Service Pack 1 (SP1), estimated to be released to the general consumer in August / September 2002. Usefs will have the ability to uninstall at least the front end of Windows Media Player from their systems using the Control Panel Add / Remove programs applet. The Service Pack will also allow users to uninstall Microsoft Internet Explorers front end, Windows Messenger (Currently removable via the sysoc process) and several other previously embedded utilities.

In the mean time, if you need to use a low process dependant version of Media Player, for example if you run SETI@Home or like to listen to music while Compiling or Rendering all I can suggest is:

  1. Open Windows Media Player 8
  2. Click the Tools button in the Menu Bar, and select Options
  3. Choose the File Types tab and deselect everything except for the CD and DVD options
  4. Click OK to conrim and exit Windows Media Player 8
  5. Browse to x:\Program Files\Windows Media Player (Where x: is the System Drive)
  6. Run mplayer2.exe
  7. Click the View button in the Menu Bar, and select Options
  8. Select the Formats tab
  9. Click the Select All button
  10. Click OK to confirm, then re-start Media Player
  11. You can also point the Start Menu Shortcut to mplayer2.exe

This will default all Media File types to open in Windows Media 6.4. CD Audio, VCD and DVD disks will still open in Windows Media Player 8.

Now that we are seeing openness on the part of the Microsoft Corporation and its integrated products, where does the future lie for the Microsoft vision. This is something only time will tell, however, if Real Networks get their media player onto a Microsoft Operating system CD ever again, Microsoft can say good by to me as a customer. I personally don’t want anything to do with Real Player or their dire codecs.

UPDATE: 03 June 2002:
Microsoft are not going for Windows Media 8.1 as CNet predicted, but instead have invested their efforts on a complete overhaul of the Windows Media Suite and family of products and services in “Windows Media Services 9”

UPDATE: 11 August 2002:
The time of reckoning has finally arrived for 6.4. Here for your viewing pleasure is the new ActiveX control for Windows Media Player Content.

ActiveX Control Screenshot