Windows 7 - 0x80072EE7 windows update error

Asked By Minus27 on 17-Dec-07 02:57 PM
Hi guys

I get the error message 0x80072EE7 when I try to download updates.
There are no IP addresses for microsoft in the HOSTS file although there is
127.0.0.1 localhost in the file

I hope you can help me
--
Today is the first day of the rest of your life!




TaurArian replied on 17-Dec-07 03:20 PM
This error code translates to ERROR_INTERNET_CANNOT_CONNECT. This could be caused by
firewall software blocking the Windows Update Site.
You may receive an "Error 0x80072EE2," "Error 0x80072EE7," "Error 0x80072EFD," "Error
0x80072F76," or "Error 0x80072F78" error message when you try to use the Windows Update
Web site or the Microsoft Update Web site
http://support.microsoft.com/?kbid=836941

When searching for available updates on the Update site, you see the 0x80072EE7 error
http://update.microsoft.com/windowsupdate/v6/showarticle.aspx?articleid=22&ln=en&IsMu=False

You may receive an error message when you search for available updates on the Windows
Update Web site or on the Microsoft Update Web site
http://support.microsoft.com/?kbid=883821



--
====================================
TaurArian [MVP] 2005-2008 - Australia
====================================
How to ask a question: http://support.microsoft.com/kb/555375
http://taurarian.mvps.org/index.htm
Emails will not be acknowledged - please post to the newsgroup so all may benefit.
window updat replied on 17-Dec-07 05:27 PM
"Minus273" wrote:
Minus27 replied on 17-Dec-07 06:23 PM
Hi

below did not help!  What do i need to do now, or what other
information do you need from me?
--
Today is the first day of the rest of your life!
guzarv replied on 18-Dec-07 04:44 PM
"TaurArian" wrote:
michgal2 replied on 20-Dec-07 08:36 AM
download fixwareout -
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe
Note: You will need to run this tool while having an Internet Connection.
The tool will download other files while running.
Save it to your desktop and run it. Click Next, then Install, make sure "Run
fixit" is checked and click Finish.
The fix will begin; follow the prompts.
If your firewall gives an alert, (because this tool will download an
additional files from the internet), please don't let your firewall block it,
but allow it instead.
You will be asked to reboot your computer; please do so. Your system may
take longer than usual to load; this is normal.
Once the desktop loads a text file will open (report.txt).

After that try the microsoft update - it worked great for me.
If you think about it, let me know
MowGreen [MVP] replied on 20-Dec-07 05:34 PM
Why are you recommending running a malware specific tool when you have
no evidence that the OP's system is infected ?
Just because your system was infected does not mean that others' systems
are. Do you know the consequences of running Fixwareout on a CLEAN system ?
If not, then please refrain from this type of post.
If you do, then please present the evidence that the OPs system is infected.
The error message involves a protocol talker. The cause can be related
to a number of factors, it is *not* strictly related to malware.


MowGreen  [MVP 2003-2008]
===============
*-343-*  FDNY
Never Forgotten
================
Minus27 replied on 20-Dec-07 07:50 PM
Below is the content of the Windowsupdate.log file - does this help to
identify the issue, and what can I do to correct it?

2007-12-21	00:32:34:734	3420	828	Misc	===========  Logging initialized
(build: 7.0.6000.381, tz: -0000)  ===========
2007-12-21	00:32:34:734	3420	828	Misc	  = Process: C:\Program Files\Internet
Explorer\IEXPLORE.EXE
2007-12-21	00:32:34:734	3420	828	Misc	  = Module:
C:\WINDOWS\system32\wuapi.dll
2007-12-21	00:32:34:734	3420	828	COMAPI	-----------  COMAPI:
IUpdateServiceManager::AddService  -----------
2007-12-21	00:32:34:734	3420	828	COMAPI	  - ServiceId =
{7971f918-a847-4430-9279-4a52d1efe18d}
2007-12-21	00:32:34:734	3420	828	COMAPI	  - AuthorizationCabPath =
C:\WINDOWS\SoftwareDistribution\AuthCabs\muauth.cab
2007-12-21	00:32:34:781	 852	f00	Misc	Validating signature for
C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\7971f918-a847-4430-9279-4a52d1efe18d.auth.cab.temp\muauth.cab:
2007-12-21	00:32:34:796	 852	f00	Misc	 Microsoft signed: Yes
2007-12-21	00:32:35:015	3788	f38	Misc	===========  Logging initialized
(build: 7.0.6000.381, tz: -0000)  ===========
2007-12-21	00:32:35:015	3788	f38	Misc	  = Process:
C:\WINDOWS\system32\wuauclt.exe
2007-12-21	00:32:35:015	3788	f38	Misc	  = Module:
C:\WINDOWS\system32\wuaueng.dll
2007-12-21	00:32:35:015	3788	f38	DtaStor	Update service properties: service
registered with AU is {7971F918-A847-4430-9279-4A52D1EFE18D}
2007-12-21	00:32:35:046	3420	828	COMAPI	  - Added service, URL =
http://update.microsoft.com/microsoftupdate/
2007-12-21	00:32:35:046	3420	828	COMAPI	-----------  COMAPI:
IUpdateServiceManager::RegisterServiceWithAU  -----------
2007-12-21	00:32:35:046	3420	828	COMAPI	  - ServiceId =
{7971f918-a847-4430-9279-4a52d1efe18d}
2007-12-21	00:32:35:093	3420	828	Misc	===========  Logging initialized
(build: 7.0.6000.381, tz: -0000)  ===========
2007-12-21	00:32:35:093	3420	828	Misc	  = Process: C:\Program Files\Internet
Explorer\IEXPLORE.EXE
2007-12-21	00:32:35:093	3420	828	Misc	  = Module:
C:\WINDOWS\system32\muweb.dll
2007-12-21	00:32:35:093	3420	828	Misc	Validating signature for
C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
2007-12-21	00:32:35:109	3420	828	Misc	 Microsoft signed: Yes
2007-12-21	00:32:35:515	3420	828	Misc	WARNING: DownloadFileInternal failed
for http://download.windowsupdate.com/v7/windowsupdate/redir/wuredir.cab:
error 0x80072ee7
2007-12-21	00:32:35:515	3420	828	Misc	Validating signature for
C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
2007-12-21	00:32:35:531	3420	828	Misc	 Microsoft signed: Yes
2007-12-21	00:32:36:312	3420	828	Misc	Validating signature for
C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
2007-12-21	00:32:36:328	3420	828	Misc	 Microsoft signed: Yes
2007-12-21	00:32:36:359	3420	828	Misc	Validating signature for
C:\WINDOWS\SoftwareDistribution\WebSetup\wuident.cab:
2007-12-21	00:32:36:375	3420	828	Misc	 Microsoft signed: Yes
2007-12-21	00:32:36:843	3420	828	Misc	Validating signature for
C:\WINDOWS\SoftwareDistribution\WebSetup\wuident.cab:
2007-12-21	00:32:36:843	3420	828	Misc	 Microsoft signed: Yes
2007-12-21	00:32:37:250	3420	828	Misc	WARNING: DownloadFileInternal failed
for
http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab: error 0x80072ee7

--
MowGreen [MVP] replied on 20-Dec-07 10:26 PM
Hang in there. As one can see, this is what is known as an 'emerging
issue '.
The section of the log posted doesn't show which version of Windows  the
system is running ... I'm guessing XP, right ?
What is the installed antivirus/security software ?

MowGreen  [MVP 2003-2008]
===============
*-343-*  FDNY
Never Forgotten
===============
Minus27 replied on 21-Dec-07 10:21 AM
Hi - thanks for the help.  I do have XP with SP2.  I am running AVG free, and
also have AVG antispyware, windows defender and Spybot S&D on the machine.  I
have never had any problems or conflicts with these
MowGreen [MVP] replied on 21-Dec-07 03:39 PM
I pinged someone at MS about this 'emerging issue' but have not heard
back yet. If you'd care to, we can do some checking ourselves.
What stands out in the log is this entry :

2007-12-21	00:32:34:734	3420	828	COMAPI	-----------  COMAPI:
IUpdateServiceManager::AddService  -----------

I've not seen that in my log nor on others that have encountered the
0x80072EE7 error.
http://msdn2.microsoft.com/en-us/library/aa386819.aspx


0x80072EE7 ERROR_INTERNET_NAME_NOT_RESOLVED

I'm not sure if the issue lies with the redirect cabs on the system or
from the update server.
Suggest you download wsus3setup.cab from this link using Internet
Explorer and save it to the Desktop :
http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab

After the download completes, close IE.
If there is a 3rd party compression tool installed, such as WinZip or
7zip, you can use them to extract the contents of wsus3setup.cab to a
new folder on the Desktop.
IF not, then create a folder on the Desktop and name it wsus3setup
Open the wsus3setup.cab on the Desktop and right click the two files
contained therein, wsus3setup.cat and wsus3setup.inf, choose Extract,
and extract them to the newly created wsus3setup folder
Open the wsus3setup folder and *right* click wsus3setup.inf, choose
Install.

When the .inf file is installed, close any open windows and programs.
Now try a manual visit to Microsoft Update.

Did that resolve the issue ?

MowGreen  [MVP 2003-2008]
===============
*-343-*  FDNY
Never Forgotten
===============
MowGreen [MVP] replied on 22-Dec-07 03:36 PM
Forget the previous instructions. Instead, open a Command Prompt from
Start > Run > type in

cmd
Click OK or press Enter

At the prompt type these commands in, *press Enter after each one*
[NOTE the space after the g]

ipconfig /flushdns
exit

Now see if the system can access the update site

MowGreen  [MVP 2003-2008]
===============
*-343-*  FDNY
Never Forgotten
===============
Minus27 replied on 23-Dec-07 05:48 AM
Sorry - below did not help, I still get the same error message
--
MowGreen [MVP] replied on 23-Dec-07 03:18 PM
Nothing to be sorry about, you didn't create this issue <w>
Let's give this a shot ...
show hidden files, folders, and system files:
http://www.bleepingcomputer.com/tutorials/tutorial62.html#winxp

Using Windows Explorer, navigate to
WINDOWS\SoftwareDistribution\WuRedir

Open the WuRedir subfolder. How many folders are in there ?
I'm hoping 2 ...
Now open the folders and check the Created and Modified Dates of the
wuredir.xml files by right clicking them and choosing Properties.

Please post back with the Created and Modified dates and how many
folders are present in WuRedir.

I think the issue is that the update server is checking the validity of
the wuredir and wsus3setup.cabs and for some reason, the system is not
sending a response to back to the update server. The update server than
appears to be attempting to download the .cabs to the system but fails
to do so due to the 0x80072EE7 error.

BTW, who is your ISP ?


MowGreen  [MVP 2003-2008]
===============
*-343-*  FDNY
Never Forgotten
===============
Minus27 replied on 25-Dec-07 08:25 AM
Thanks again
There are two folders in the subfolder

1.  7971F918-A847-4430-9279-4A52D1EFE18D dated 21/12/2007
Inside are two WINZIP files and the XML file.
XML file says created, modified and accessed 21 March 2007 at 12:48:42

2.  9482F4B4-E343-43B6-B170-9A65BC822C77 dated 25/12/2007
Inside is one WINZIP file and the XML file
XML file says created, modified and accessed 21 March 2007 at 12:48:26

ISP is through Pipex

Have a good Christmas
MowGreen [MVP] replied on 25-Dec-07 10:00 PM
The 2 folders inside of 7971F918-A847-4430-9279-4A52D1EFE18D ... are
their extensions .cab or .zip ?
Same question for 9482F4B4-E343-43B6-B170-9A65BC822C77 ... is the
folder's extension .cab or .zip ?

Is this XP Home or Pro ?

MowGreen  [MVP 2003-2008]
===============
*-343-*  FDNY
Never Forgotten
===============
Minus27 replied on 26-Dec-07 06:48 PM
Hi

XP Home

Curious result.  Using DOS command prompt the result is they have a .cab
extension.  Using windows explorer i get the following results

7971F918-A847-4430-9279-4A52D1EFE18D

muredir is a winzip file created 28 March 2007 at 23:08.  Modified 11 June
2007 at 18:06.  Accessed 11 Jun 2007 at 17:55.  Properties show it as a
WinZip file that is 9.75 kb

wuredir is a winzip file created 24 October 2007 at 11:52.  Modified 11 June
20077 at 18:06.  Accessed 24 Octover 2007 at 11:52.  Properties show it as a
WinZip file that is 9.70 kb

9482F4B4-E343-43B6-B170-9A65BC822C77

wuredir is a winzip file created 28 March 2007 at 23:08.  Modified 25
December 2007 at 22:11.  Accessed 25 December 2007 at 13:50.  Properties
shows it as a winzip file that is 9.8 kb




--
Today is the first day of the rest of your life!
MowGreen [MVP] replied on 27-Dec-07 08:46 PM
Which version of IE is installed [IE 6 or 7] and which firewall is being
used ?

In WINDOWS\SoftwareDistribution\SelfUpdate\Default is a copy of
wsus3setup.inf
What is the Created Date of wsus3setup.inf ?

In WINDOWS\SoftwareDistribution\WebSetup is another instance of
wsus3setup.inf
What is it's Created Date ?


MowGreen  [MVP 2003-2008]
===============
*-343-*  FDNY
Never Forgotten
===============
Minus27 replied on 29-Dec-07 09:20 AM
IE 7 and I am using Windows Firewall

WINDOWS\SoftwareDistribution\SelfUpdate\Default\wsus3setup.inf was created
on 30/07/2007 at 19:23

WINDOWS\SoftwareDistribution\WebSetup\wsus3setup.inf was created on
30/07/2007 at 19:23

Both versions are 13kb in size
MowGreen [MVP] replied on 29-Dec-07 12:15 PM
Much thanks for sticking with this and the information.
So, we've eliminated the redirect as the cause of the error and the
proper ActiveX controls appear to be installed.

Now ... can the system update Automatically ?
Not sure which options you've chosen for the Automatic Updates applet in
the Control Panel ... for now, please set it to " Notify me but don't
automatically download or install them ".
For this to work, you need to set the Automatic Updates service to at
least Manual [Automatic is preferred, but Manual will work] and
Background Intelligent Transfer Service [BITS] to at least Manual.

With all programs and IE closed, go to Start > Run > type in

wuauclt /detectnow

Click OK or press Enter
If any downloads are available the yellow icon should pop up in the
Notification area . If the latest definition for Windows Defender hasn't
been installed yet, that should be there now.

Install any that you wish to install, if offered.
Then copy and paste the last 40 - 50 lines in the WU.log into your
reply, please.

MowGreen  [MVP 2003-2008]
===============
*-343-*  FDNY
Never Forgotten
===============
abosma replied on 29-Dec-07 02:15 PM
Hi

this helped for me, i had the same problem + defender did not want to update
too.

log file of what was done by fixwareout:
Username "Alain" - 29/12/2007 19:58:19 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdagz.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{14DA0548-F08A-4628-BCF8-87BE1E990921}
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{39DE6436-3235-4923-9885-265EDD7F1BAF}
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{E4193466-3A4D-4AC3-BEE0-1F28417E99CE}
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F2B93A91-75AA-4ACA-9AAB-4FB24C970B59}
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{14DA0548-F08A-4628-BCF8-87BE1E990921}
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{39DE6436-3235-4923-9885-265EDD7F1BAF}
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{654B47DA-CBDC-4315-AA62-60AC5C2A575E}
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{F2B93A91-75AA-4ACA-9AAB-4FB24C970B59}

Successfully flushed the DNS Resolver Cache.

hope this will not cause something else, but after searching for 4 days...
finally something that helps

Greetings and happy nw year
MowGreen [MVP] replied on 29-Dec-07 02:34 PM
The system was infected with the malware WareOut :

HKLM\SOFTWARE\~\Winlogon\ "System"="kdagz.exe"

The malware made those entries in the registry that installed DNS
redirectors, essentially proxy redirectors, and the entire DNS process
was compromised.

* Fixwareout.exe will not harm a system that is not infected with Wareout *

It removes the rootkit in Winlogon, removes the TCP/IP registry
parameters that redirect DNS to it's own servers, and flushes the DNS cache.

http://research.sunbelt-software.com/threatdisplay.aspx?name=WareOut&threatid=40280

MowGreen  [MVP 2003-2008]
===============
*-343-*  FDNY
Never Forgotten
===============
Minus27 replied on 30-Dec-07 06:23 AM
Hi - below failed.  The yellow icon appeared and then dissapeared.  It
remained at 0%.  Below are the lines from the WU log you requested

2007-12-30	11:12:53:731	1604	e50	Misc	  = Process:
C:\WINDOWS\system32\wuauclt.exe
2007-12-30	11:12:53:731	1604	e50	Misc	  = Module:
C:\WINDOWS\system32\wucltui.dll
2007-12-30	11:12:53:731	1604	e50	CltUI	AU client got new directive =
'Download Progress', serviceId = {7971F918-A847-4430-9279-4A52D1EFE18D},
return = 0x00000000
2007-12-30	11:12:53:731	1604	e50	CltUI	AU client creating UI plugin,
clsid={3809920F-B9D4-42DA-92E0-E26265E0FB89}
2007-12-30	11:12:59:262	 848	bcc	Misc	WARNING: Send failed with hr = 80072ee7.
2007-12-30	11:12:59:262	 848	bcc	Misc	WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30	11:12:59:262	 848	bcc	Misc	WARNING: WinHttp:
SendRequestUsingProxy failed for
0x8024402c
2007-12-30	11:12:59:262	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30	11:12:59:262	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30	11:12:59:262	 848	bcc	Misc	WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30	11:13:12:731	 848	ff8	DnldMgr	Error 0x8024402c occurred while
downloading update; notifying dependent calls.
2007-12-30	11:13:12:731	 848	bd0	AU	AU checked download status and it
changed: Downloading is paused
2007-12-30	11:13:12:731	1604	e50	CltUI	AU client got new directive =
'Shutdown', serviceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, return =
0x00000000
2007-12-30	11:13:12:746	 848	68c	AU	AU received handle event
2007-12-30	11:13:14:262	 848	bcc	Misc	WARNING: Send failed with hr = 80072ee7.
2007-12-30	11:13:14:262	 848	bcc	Misc	WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30	11:13:14:262	 848	bcc	Misc	WARNING: WinHttp:
SendRequestUsingProxy failed for
0x8024402c
2007-12-30	11:13:14:262	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30	11:13:14:262	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30	11:13:14:262	 848	bcc	Misc	WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30	11:13:29:278	 848	bcc	Misc	WARNING: Send failed with hr = 80072ee7.
2007-12-30	11:13:29:278	 848	bcc	Misc	WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30	11:13:29:278	 848	bcc	Misc	WARNING: WinHttp:
SendRequestUsingProxy failed for
0x8024402c
2007-12-30	11:13:29:278	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30	11:13:29:278	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30	11:13:29:278	 848	bcc	Misc	WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30	11:13:29:278	 848	bcc	Misc	WARNING: DownloadFileInternal failed
for http://download.windowsupdate.com/v7/windowsupdate/redir/wuredir.cab:
error 0x8024402c
2007-12-30	11:13:29:278	 848	bcc	Misc	Validating signature for
C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
2007-12-30	11:13:29:278	 848	bcc	Misc	 Microsoft signed: Yes
2007-12-30	11:13:29:949	 848	bcc	Misc	Validating signature for
C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
2007-12-30	11:13:29:949	 848	bcc	Misc	 Microsoft signed: Yes
2007-12-30	11:13:29:949	 848	bcc	Misc	Validating signature for
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
2007-12-30	11:13:29:965	 848	bcc	Misc	 Microsoft signed: Yes
2007-12-30	11:13:30:356	 848	bcc	Misc	Validating signature for
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
2007-12-30	11:13:30:371	 848	bcc	Misc	 Microsoft signed: Yes
2007-12-30	11:13:45:371	 848	bcc	Misc	WARNING: Send failed with hr = 80072ee7.
2007-12-30	11:13:45:371	 848	bcc	Misc	WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30	11:13:45:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestUsingProxy failed for
2007-12-30	11:13:45:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30	11:13:45:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30	11:13:45:371	 848	bcc	Misc	WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30	11:14:00:371	 848	bcc	Misc	WARNING: Send failed with hr = 80072ee7.
2007-12-30	11:14:00:371	 848	bcc	Misc	WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30	11:14:00:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestUsingProxy failed for
2007-12-30	11:14:00:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30	11:14:00:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30	11:14:00:371	 848	bcc	Misc	WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30	11:14:15:371	 848	bcc	Misc	WARNING: Send failed with hr = 80072ee7.
2007-12-30	11:14:15:371	 848	bcc	Misc	WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30	11:14:15:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestUsingProxy failed for
2007-12-30	11:14:15:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30	11:14:15:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30	11:14:15:371	 848	bcc	Misc	WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30	11:14:30:371	 848	bcc	Misc	WARNING: Send failed with hr = 80072ee7.
2007-12-30	11:14:30:371	 848	bcc	Misc	WARNING: SendRequest failed with hr =
80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes
used : <>
2007-12-30	11:14:30:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestUsingProxy failed for
2007-12-30	11:14:30:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c
2007-12-30	11:14:30:371	 848	bcc	Misc	WARNING: WinHttp:
SendRequestToServerForFileInformation failed with 0x8024402c
2007-12-30	11:14:30:371	 848	bcc	Misc	WARNING: WinHttp:
ShouldFileBeDownloaded failed with 0x8024402c
2007-12-30	11:14:30:371	 848	bcc	Misc	WARNING: DownloadFileInternal failed
for
http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab: error 0x8024402c
2007-12-30	11:14:30:371	 848	bcc	Setup	FATAL: IsUpdateRequired failed with
error 0x8024402c
2007-12-30	11:14:30:371	 848	bcc	Setup	WARNING: SelfUpdate: Default Service:
IsUpdateRequired failed: 0x8024402c
2007-12-30	11:14:30:371	 848	bcc	Setup	WARNING: SelfUpdate: Default Service:
IsUpdateRequired failed, error = 0x8024402C
2007-12-30	11:14:30:371	 848	bcc	Agent	  * WARNING: Skipping scan,
self-update check returned 0x8024402C
2007-12-30	11:14:30:387	 848	bcc	Agent	  * WARNING: Exit code = 0x8024402C
2007-12-30	11:14:30:387	 848	bcc	Agent	*********
2007-12-30	11:14:30:387	 848	bcc	Agent	**  END  **  Agent: Finding updates
[CallerId = AutomaticUpdates]
2007-12-30	11:14:30:387	 848	bcc	Agent	*************
2007-12-30	11:14:30:387	 848	bcc	Agent	WARNING: WU client failed Searching
for update with error 0x8024402c
2007-12-30	11:14:30:606	 848	bd0	AU	AU checked download status and it
changed: Downloading is not paused
2007-12-30	11:14:30:606	 848	bd0	AU	AU setting pending client directive to
'Download Progress'
2007-12-30	11:14:30:606	 848	bd0	AU	>>##  RESUMED  ## AU: Search for updates
[CallId = {212E51E1-D6C1-46DD-9709-10C01DF57723}]
2007-12-30	11:14:30:606	 848	bd0	AU	  # WARNING: Search callback failed,
result = 0x8024402C
2007-12-30	11:14:30:606	 848	bd0	AU	  # WARNING: Failed to find updates with
error code 8024402C
2007-12-30	11:14:30:606	 848	bd0	AU	#########
2007-12-30	11:14:30:606	 848	bd0	AU	##  END  ##  AU: Search for updates
[CallId = {212E51E1-D6C1-46DD-9709-10C01DF57723}]
2007-12-30	11:14:30:606	 848	bd0	AU	#############
2007-12-30	11:14:30:606	 848	bd0	AU	AU setting next detection timeout to
2007-12-30 16:14:30
2007-12-30	11:14:45:621	 848	68c	AU	Launched new AU client for directive
'Download Progress', session id = 0x0
2007-12-30	11:14:45:668	2144	850	Misc	===========  Logging initialized
(build: 7.0.6000.381, tz: -0000)  ===========
2007-12-30	11:14:45:668	2144	850	Misc	  = Process:
C:\WINDOWS\system32\wuauclt.exe
2007-12-30	11:14:45:668	2144	850	AUClnt	Launched Client UI process
2007-12-30	11:14:45:715	2144	850	Misc	===========  Logging initialized
(build: 7.0.6000.381, tz: -0000)  ===========
2007-12-30	11:14:45:715	2144	850	Misc	  = Process:
C:\WINDOWS\system32\wuauclt.exe
2007-12-30	11:14:45:715	2144	850	Misc	  = Module:
C:\WINDOWS\system32\wucltui.dll
2007-12-30	11:14:45:715	2144	850	CltUI	AU client got new directive =
'Download Progress', serviceId = {7971F918-A847-4430-9279-4A52D1EFE18D},
return = 0x00000000
2007-12-30	11:14:45:731	2144	850	CltUI	AU client creating UI plugin,
clsid={3809920F-B9D4-42DA-92E0-E26265E0FB89}
2007-12-30	11:15:09:403	 848	ab0	DnldMgr	Error 0x8024402c occurred while
downloading update; notifying dependent calls.
2007-12-30	11:15:09:403	 848	bd0	AU	AU checked download status and it
changed: Downloading is paused
2007-12-30	11:15:09:403	2144	850	CltUI	AU client got new directive =
'Shutdown', serviceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, return =
0x00000000
2007-12-30	11:15:09:434	 848	68c	AU	AU received handle event
TaurArian replied on 30-Dec-07 06:48 AM
Whilst you're awaiting Mow, Have you checked these articles Minus273?

When searching for available updates on the Update site, you receive the 0x8024402C error
http://update.microsoft.com/windowsupdate/v6/showarticle.aspx?articleid=30&ln=en
A misconfigured Proxy/Firewall can cause this problem. Double-check the Proxy/Firewall
settings

You may receive an error message when you search for available updates on the Windows
Update Web site or on the Microsoft Update Web site
http://support.microsoft.com/kb/883821


--
====================================
TaurArian [MVP] 2005-2008 - Australia
====================================
How to ask a question: http://support.microsoft.com/kb/555375
http://taurarian.mvps.org/index.htm
Emails will not be acknowledged - please post to the newsgroup so all may benefit.


C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
error 0x8024402c
error 0x8024402c
error 0x8024402c
error 0x8024402c
http://download.windowsupdate.com/v7/windowsupdate/a/selfupdate/WSUS3/x86/Other/wsus3setup.cab:
error 0x8024402c
MowGreen [MVP] replied on 31-Dec-07 05:05 PM
I'm not convinced that your system is free of malware.
WareOut can set false proxy servers in the registry to prevent the
system from obtaining updates.
Please open the registry editor Start > Run > type in

regedit
Click OK or press Enter

Navigate to this key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Click *on* Parameters
In the right frame under Name,  is NameServer
What is it's ValueData ?

MowGreen  [MVP 2003-2008]
===============
*-343-*  FDNY
Never Forgotten
===============
Minus27 replied on 03-Jan-08 06:36 AM
Sorry for delay - flu!

Data against NameServer is 208.67.220.220 208.67.222.222

Thanks!
MowGreen [MVP] replied on 03-Jan-08 03:25 PM
I've been under the weather, too. No apologies necessary ... bourbon is
though. <w>
Here's some info on 208.67.220.220 - 208.67.222.222
http://www.dnsstuff.com/tools/whois.ch?ip=208.67.220.220

http://freedomfinancialnetwork.com/

Suggest you delete the ValueData for
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\
NameServer
Right click NameServer, choose Modify
Remove both URLs for Value data
Click OK
Close the registry editor and restart the system
Now try to access WU/MU

MowGreen  [MVP 2003-2008]
===============
*-343-*  FDNY
Never Forgotten
===============
stusmudge replied on 03-Jan-08 06:16 PM
All,

I've been following this thread (and understanding very little of it) as
I've recently had the 0x80072EE7 error. I bought my wife aPalm HandHeld for
Christmas but was unable to sunchronise it with Window XP as the drivers
weren't installed. Palm technical support directed me to Microsoft updates
which is when I received the error message.

I've followed the error resolution solution advised by Microsoft i.e. HOST
file and the inclusion of '#' but this didn't work. I then went to Microsoft
on-line technical support who - helpfully! - referred me to their on-line
support (round in circles) I've sent them a response but have yet to receive
a reply.

Can you provide a solution? Please be aware that I'm a luddite when it comes
to computers so any advice will need to be idiot proof and free from any
techno jargon.

Fingers crossed and regards,

stusmudger
dennis_marty replied on 06-Jan-08 03:54 AM
On Dec 31 2007, 5:05=A0pm, "MowGreen [MVP]" <mowgr...@nowandzen.com>
It
=3D Process:
=3D Module:
nt got new directive =3D
},
nt creating UI plugin,
NG: Send failed with hr =3D 80072ee7.
NG: SendRequest failed with hr =3D
emes
NG: WinHttp:
rror
NG: WinHttp:

NG: WinHttp:
NG: WinHttp:
4402c occurred while
checked download status and it
nt got new directive =3D
=3D
received handle event
NG: Send failed with hr =3D 80072ee7.
NG: SendRequest failed with hr =3D
emes
NG: WinHttp:
rror
NG: WinHttp:

NG: WinHttp:
NG: WinHttp:
NG: Send failed with hr =3D 80072ee7.
NG: SendRequest failed with hr =3D
emes
NG: WinHttp:
rror
NG: WinHttp:

NG: WinHttp:
NG: WinHttp:
NG: DownloadFileInternal failed

ating signature for
2C7=AD7\wuredir.cab:
osoft signed: Yes
ating signature for
2C7=AD7\wuredir.cab:
osoft signed: Yes
ating signature for
osoft signed: Yes
ating signature for
osoft signed: Yes
NG: Send failed with hr =3D 80072ee7.
NG: SendRequest failed with hr =3D
emes
NG: WinHttp:
.>.error0x8024402c
NG: WinHttp:

NG: WinHttp:
NG: WinHttp:
NG: Send failed with hr =3D 80072ee7.
NG: SendRequest failed with hr =3D
emes
NG: WinHttp:
.>.error0x8024402c
NG: WinHttp:

NG: WinHttp:
NG: WinHttp:
NG: Send failed with hr =3D 80072ee7.
NG: SendRequest failed with hr =3D
emes
NG: WinHttp:
.>.error0x8024402c
NG: WinHttp:

NG: WinHttp:
NG: WinHttp:
NG: Send failed with hr =3D 80072ee7.
NG: SendRequest failed with hr =3D
emes
NG: WinHttp:
.>.error0x8024402c
NG: WinHttp:

NG: WinHttp:
NG: WinHttp:
NG: DownloadFileInternal failed
rror0x8024402c
IsUpdateRequired failed with
ARNING: Skipping scan,
ARNING: Exit code =3D 0x8024402C
**
ND =A0** =A0Agent: Finding updates
******
checked download status and it
setting pending client directive to
=A0# WARNING: Search callback failed,
=A0# WARNING: Failed to find updates with

Not sure if you guys figured this out but I ran across the solution.
It is scamware that changes the DNS server details from automatically
obtaining  to using there own ip.

Solution: Get to your Local Area Connection and click properties.
Click TCP/IP then properties. Click "Obtain DNS Automatically".

Also if you go to your reg. you will find this ip 85.255.115.18. This
ip leads directly to the scammers and they also give details how to
remove the software.

Thanks to abosman for the clue in your post above.
PA Bear [MS MVP] replied on 05-Jan-08 01:51 AM
That's a symptom of a WareOut infection.  Run a /thorough/ check for
hijackware, including posting your hijackthis log to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert.  **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/
Espen4 replied on 11-Jan-08 05:48 PM
Dear all,
I had problem updating windows XP (got error "0x80072EE7" every time I
tried to update).  I tried to fix it using all I could
find on the internet.  In the end I got help from a friend
who told me to check the DNS of my internet service provider
(it had probably been changed lately because it was different
from earlier). I found the DNS on the web-site of my internet service
provider.
I changed the DNS in XP the following way:

1. Click on the Start Menu.
2. Go to the Control Panel.
3. Double-click on Network and Internet Connections. (XP users in
Classic mode will not see this choice. Skip to #4.)
4. Double-click on Network Connections.
5. Double-click on Local Area Connection then click on the Properties
button.
6. Under This connection select Internet Protocol (TCP/IP) and click
the Properties button.
7. Change the DNS adress to the updated one you got from your internet
service provider.

Now windows update should work (it did for me !!!)

Espen


--
Espen4
------------------------------------------------------------------------
Espen4's Profile: http://forums.techarena.in/member.php?userid=39416
View this thread: http://forums.techarena.in/showthread.php?t=873684

http://forums.techarena.in
Minus27 replied on 15-Jan-08 01:01 PM
All - sorry for delays in answering, been in hospital.  Below has fixed my
updates problem.  As I have not removed anything from my PC do I need to do
anything else?