Belarc Advisor Reporting KB902400 Needs "Reinstall!" - Caused by sfc /scannow ?

I tried to revive my nearly year old unresolved thread directly related to this post but Windows BBS wouldn't let me.


PeteC, I think I have determined what causes the "Reinstall!" alert next to the KB902400 entry in Belarc Advisor's "Installed Microsoft Hotfixes" section. Perhaps you are willing to confirm/deny it occurs with yours too.

I think the culprit is Start > Run > [FONT= "Fixedsys"]sfc /scannow[/FONT]

Recently, I ran Belarc Advisor (BA) and discovered KB902400 needed to be reinstalled (according to BA) again! Therefore, I reinstalled KB904200. (I did not uninstall first.) Afterwards, BA did not report the KB902400 needed to be reinstalled (as expected).

Then I ran sfc /scannow and ran BA again after SFC completed. BA reported KB902400 needed to be reinstalled. I did a little playing with reboots and the "Reinstall!" issue remained.

After running these sfc /scannow trials, Event Viewer did not show any Windows Protection-related events between Event IDs 64016 and 64017. (I was connected to the Internet during at least one of the trials and the W32Time event snuck in during that time, but I expect that was unrelated to SFC.)

I haven't tested yet with Start > Run > [FONT= "Fixedsys"]qfecheck.exe /l:C:\ /v[/FONT] yet to confirm BA's report. I expect that will yield similar results. (See my old thread for details.)



I'm curious whether other people test sfc /scannow and report the same results or not. If anyone else with this issue (hawkeye?) would be willing to test, I would appreciate it.

If anyone with this issue wants to test my theory, here are links to the hotfixes you may need to reinstall (if your computer behaves as mine did).

• KB902400
• KB913580 <--Might be needed if you uninstall KB902400 before reinstalling per the method I described in my old thread.

If sfc /scannow appears to be directly related to the issue (for several people), then I think we should let MS know about this issue and see what they might have to say. (I don't know yet how to contact MS about this though.)



BTW, I have the I386 folder from my Windows XP Home SP1 CD copied to my hard drive (and Registry edited accordingly) so I can avoid having to insert the CD when SFC needs to replace a Windows Protected System File. I do not know whether this variable would make a difference or not.

NOTE: During my last run of SFC, my computer locked up. I had to reboot twice before I could get back to using Windows. That may or may not be related to KB902400. (I had enabled the Server service prior to that test run for another unrelated reason.) However, SFC apparently did get far enough to reproduce the KB902400 issue.

I will investigate this KB902400 issue further after the weekend. I hope to see some interesting results from other people's tests around Monday.

 

Windows BBS > Operating Systems > Windows XP > Belarc Advisor Reporting KB902400

I installed KB902400 yesterday

Then ran sfc /scannow this morning

Then ran Belarc and it reported needs reinstall

sfc /scannow is causing this problem

 

Thanks, hawkeye and PeteC!

I'm glad it appears we have the mystery further understood.

Thanks for the slipstreamed CD idea, Pete. I didn't think of that. I copied my C:\I386 contents to C:\I386-SP1 and then copied the contents of the I386 folder from my SP2 slipstreamed CD to my C:\I386 folder. I directed Windows to overwrite all files with existing filenames.

I ran sfc /scannow again (using the I386 folder contents from the SP2 slipstreamed CD) and Belarc Advisor unfortunately reported the KB902400 needed reinstall.

Since migregdb.exe seems to be related to this KB902400 issue, I searched my hard drive for migregdb and discovered a copy of migregdb.exe in C:\Windows\ServicePackFiles (as well as other places).

After reinstalling KB902400, I renamed C:\Windows\ServicePackFiles\migregdb.exe to migregdb.SPF and then I copied the July 25, 2005 migregdb.exe from the dllcache to the ServicePackFiles folder. All seems well now. I just finished a run of sfc /scannow and Belarc Advisor reports all hotfixes are properly installed.

It appears sfc /scannow might snag migregdb.exe from the C:\WINDOWS\ServicePackFiles folder when replacing the file in the dllcache folder.

Although I think we have narrowed down the issue to sfc /scannow, I think I still have a ways to go before I understand it.

Thanks again for your assistance, hawkeye and PeteC. I appreciate it.

 

I dug up my other old (LONG) thread relating to the graphics card/SFC issue I had a year ago so I could recall the registry location SFC uses.

My HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup key matches JRosenfeld's as described in Post #33 of that thread. That post also describes where JRosenfeld thought/thinks SFC checks/validates files.

(Today I changed the ServicePackSourcePath value to %windir%\ServicePackFiles per KB900910 but that still, in effect, is the same as C:\Windows\ServicePackFiles if I understand correctly...since I Have Windows installed on C:\.)


Pete, as far as I can grasp this issue at the moment, I think your theory about a "slightly botched hotfix installer" for KB902400 might be correct since SFC was apparently replacing the July 25, 2005 migregdb.exe file in my dllcache folder with the older August 4, 2004 migregdb.exe file from the C:\Windows\ServicePackFiles\I386 folder. (I reached this conclusion after renaming/replacing the ServicePackFiles\I386\migregdb.exe file with the July 25, 2005 file. SFC did not produce the "Reinstall!" flag in Belarc Advisor after I did that.)

I also found a long-winded Microsoft TechNet article describing how MS installers work. I'm posting the link below so it's easily accessible for further study in my quest to understand what was happening. Might be helpful for other people as well.

• Microsoft TechNet: The Package Installer (Formerly Called Update.exe) for Microsoft Windows Operating Systems and Windows Components
  

I currently have three different log files related to KB902400 in my C:\Windows folder.

• KB902400.log (755 KB - contains logs from 2005/10/11 23:57:14.015 to 2007/07/11 11:40:24.468)
• KB902400.log.1.log (3 KB - contains a single failed install log 2006/08/21 13:56:01.703)
  
• KB902400Uninst.log (209 KB - contains logs from 2006/08/12 00:56:49.453 to 2006/08/21 13:48:49.250)

There are various error codes in those logs I expect I will need to investigate before I understand this issue. Maybe in another year I'll figure it out. Might switch to Vista Ultimate first though. Might be a good excuse to build a new computer for Vista and keep this one with XP installed just so I can tinker with KB902400.

I'll try to remember to bump this thread with new potentially useful information within every 60 days so I can keep this information in one place until this is fully resolved.


EDIT: BTW, I made an error in Post #4 above.

Correction: migregdb.exe is located in C:\Windows\ServicePackFiles\i386

 

Hi Mailman, I read your post last night (15th.July NZ time) and checked with Belarc Advisor and all MS updates were present and correct. Today, (1.15pm Mon 16th.) I ran sfc /scannow and lo and behold when it had finished I ran Belarc Advisor and KB914440 needed to be re-installed!! I downloaded and ran KB914440 and checked with Belarc again and everything is sweet again. Go figure. I can only assume from all the replies to your query that sfc / scannow does have an affect on random MS updates. Re-install of the update goes without a hitch and it is the same (KB914440) with mine each time. It does not affect KB902400 or KB913580. Neil

 

We can only wonder why MS has waited so long and amassed so many hotfixes without releasing a full SP to cover them all. Problems like this would not happen if they would do that.

I think it stinks that when you reinstall your XP system you have to spend all day getting it up to date again by getting individual updates.

I quit updating my system in March of 2006 and haven't regretted it yet. The sky is not falling! If my system totally crashed as a result of not being updated, I'd still be ahead of the game in the time I've saved and the grief I've missed.

 

Hi, Neil.

That's an interesting twist! You get NO "Reinstall!" notification for KB902400. KB914440 doesn't even appear to be a security update either.

Perhaps the variable is related the method used to update. Sometimes I use the yellow shield in my system tray. Other times I use the Micorosoft Update page. Sometimes I have gone to the Microsoft Update page and downloaded after the yellow shield download appeared to stall. On occasion I think I have even used the Microsoft Download Catalog to do a first-install of a hotfix instead of the yellow shield or MU to download/install.

The plot thickens.

Thanks for your info!