Critical Update Media Player KB828026

  1. #1
    kwilliams335 is offline Newbie

    Critical Update Media Player KB828026

    Hello
    For the past several weeks I have been going to the Windows Update site to see if there are any important updates, and I keep getting the same update that I have downloaded 8 or 9 times. I have downloaded this update using several different methods, both from the Windows Update site and downloading it directly to my desktop and than installing it. But when I go back to the Windows Update site it still tells me I need to download it.
    I have been searching the internet for an answer to this problem. Apparantly a lot of people are having the same problem I am, but the only answers I can find concern Windows XP. I have ME.
    I would be eternally gratefull to anyone who could help me with this.
    I really love the Windows Media Player, and I have recently been getting script error messages every time I open it. I was hoping that this update would fix this problem.


  2. #2
    spud is offline D-A-L Team Member (UK)
    i would try the link under my downloads list called owens help then follow the advice that he gives there si that we know for definate that you have not got a virus problem then we can look in to it further for you

  3. #3
    kwilliams335 is offline Newbie
    Hi
    Thanks for the reply. Here's the Logfile I got from hijack this.


    Logfile of HijackThis v1.99.1
    Scan saved at 12:03:17 PM, on 4/10/2005
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    C:\PROGRAM FILES\SIBER SYSTEMS\AI ROBOFORM\ROBOTASKBARICON.EXE
    C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE
    C:\PROGRAM FILES\ROCKET SOFTWARE\ROCKETTIME\ROCKETTIME.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\WINDOWS\SYSTEM\LEXBCES.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\SYSTEM\LEXPPS.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/...nsumer&LC=0409
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/r...rchbar&LC=0409
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/r...search&LC=0409
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/r...rchbar&LC=0409
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/r...search&LC=0409
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.presario.net/scripts/r...rchbar&LC=0409
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
    O2 - BHO: IEPlugin Class - {CF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRAM FILES\ADVANCED SYSTEM OPTIMIZER\IEHELPER.DLL
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
    O2 - BHO: PopupBlockerBHO.CPopupBlockerBHO - {0D929918-C804-4756-B0AC-640EF3F061E9} - C:\PROGRAM FILES\SMARTPOPUPBLOCKER\POPUPBLOCKERBHO.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
    O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
    O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE" /Q
    O4 - Startup: Rocket.Time.lnk = C:\Program Files\Rocket Software\RocketTime\RocketTime.exe
    O8 - Extra context menu item: RoboForm &2 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
    O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
    O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing)
    O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing)
    O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing)
    O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing)
    O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing)
    O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing)
    O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing)
    O9 - Extra 'Tools' menuitem: AV Live - {06FE5D04-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing)
    O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
    O9 - Extra 'Tools' menuitem: RoboForm &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
    O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://www.activation.rr.com/install...ad/tgctlcm.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://63.175.189.40/activex/AxisCamControl.cab
    O16 - DPF: {92CA8ACC-4E99-4A2A-93F1-B2C5CADC8613} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1d...APANEL_USA.cab
    O16 - DPF: {084F552D-19EB-4668-9788-984CBC781A8F} (AsyncDownloader Class) - http://survey.otxresearch.com/Preloader.dll
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/262bb866...p/RdxIE601.cab

  4. #4
    handler is offline Newbie
    I had the same problem when I was on SP1. And it blocked for new downloads from Windows Update.

    I downloaded and installed Service Pack 2 (SP2) from www.microsoft.com

    This solved the problem.

  5. #5
    Qwerty is offline Newbie
    Sorry to drag this thread back up again, but I thought it might be useful to give my solution to this problem.

    I installed WMP 9 over the top of WMP 7.1, as directed by Windows Update, and then experienced the problem being discussed in this thread. So I then downloaded the update for KB828026 for WMP 9 on WinMe using Windows Update Catalog, and used the /c installation switch, as described in the KB article, to inspect its contents. This update is a bizarre hybrid of files which belong to WMP versions 6.4, 7.1 and 9. In particular, the following files are supplied by the update:

    msdxm.ocx, version 6.4.7.1128
    wmp.dll, version 9.0.0.3075
    wmpcore.dll, version 7.10.0.3075

    whereas the files already sitting in my WINDOWS\SYSTEM folder are

    msdxm.ocx, version 6.4.7.1128
    wmp.dll, version 9.0.0.3344
    wmpcore.dll, version 9.0.0.2980

    So my versions of wmp.dll and wmpcore.dll are already newer than the versions offered by the update, which presumably implies that the update was superceded by some other WMP 9 update that I had (previously or subsequently) installed using Windows Update. Thus it seems that Windows Update is misreporting KB828026 as a required update. Inspecting one of the installation info files (the one for WMP 9, namely "wm828026Me9.inf") that comes with the update, we see that it wishes to modify some registry entries. However, a quick check of the registry shows that these entries are /not/ being modified when the update is actually installed. In fact, the registry entries currently found on the system match those requested by the info file for WMP 7.1, namely "wm828026Me7.inf". Hence the fault lies not with Windows Update but with a dodgy installation routine which uses the wrong inf file. Manually applying the registry entries found in the WMP 9 inf file fixed the problem for me. These entries are as follows. (Note: be sure to back up your registry before you make manual changes.)

    Key:
    HKLM\SOFTWARE\Microsoft\Updates\Windows Media Player\wm828026

    Value:
    PlayerVersion

    Data:
    9

    (the original data was "7.1")


    Modifying the above entry is enough to fix the problem.


    [Note that the WMP 9 inf file wants to apply the following entry, too:

    Key:
    HKLM\SOFTWARE\MicrosoftUpdates\Windows Media Player\wm828026\FileList\File2

    Value:
    Version

    Data:
    9.0.0.3075

    This key is the metadata for the wmpcore.dll file. However, I did /not/ apply this entry manually, since the actual entry on my system is "7.1.0.3075" (supplied by the WMP 7.1 inf file) which matches the (unused) version of the wmpcore.dll file supplied by the update [almost? 1 vs 10?]. Further, the version "9.0.0.3075" suggested by the WMP 9 inf file doesn't actually exist: the version of wmpcore.dll on my system is 9.0.0.2980. Moreover, the KB article implies that wmpcore is not actually part of the update for WMP 9 on WinMe; look at the file version table it displays for Windows Media Player 7.1 and 9 for WinMe. Personally, I don't think it would matter what data you actually gave for this key, or even if you deleted the key altogether; I suspect its only use is for uninstalling the update, but you /can't/ "formally" uninstall this update on WinMe anyway (although apparently you can on WinXP).]

    Basically, it looks to me as if Microsoft's attempt to mix together files and data for WMP 7.1 and WMP 9 has resulted in a ****-up. It is somewhat typical of M$ that they haven't bothered to address this problem themselves, despite the large number of people experiencing it, and yet it was diagnosed in about 10 minutes...

    Best wishes,
    Anton P.

+ Reply to Thread