Jump to content

Win 11 Cumulative update KB5016629 failing to install due to Malwarebytes


Recommended Posts

Hi Team,

Another Windows update just released is also failing to install on Windows 11 Pro. I have had this issue since July KB updates. It only seems to be affecting the Cumulative update patches though.
Disabling Malwarebytes and restarting the PC is the only way to update the PC.

Someone else posted about the same issue here...

I followed the instructions as suggested by Porthos on that thread and have attached the log files here for someone to take a look.

Thanks in advance for your support.

 

And before someone chimes in about disabling Fast boot... I did try this before, and it did not resolve the issue with the updates failing and hasn't caused any other erroneous system problems.

mbst-grab-results.zip Fixlog.txt

Link to post
Share on other sites

The next task is intended to run the Windows System File Checker & DISM to check the system. And to remove policy restriction on Windows Update. It will also do a quick scan with MS Defender & also to queue up a CHKDSK run on the system at the next reboot. The main goal here is to remove the policy restriction and to cleanup the work-area used by Microsoft Windows Update.

Next, a custom script to do  checks & selected  cleanups. 

We will use FRSTENGLISH.exe  on the Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  AgentZerO  only / for this machine only.

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

  • Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.
  • If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
  • Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt             <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.


RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

  • IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

  • on the FRST window:

Click the Fix button just once, and wait.

frst-fix.jpg.f6a25291b39a03d418acc9a3b7136900.jpg

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

Link to post
Share on other sites

The Windows event logs have the following related to the Windows Update failure.
Installation Failure: Windows failed to install the following update with error 0x8007054f: 2022-08 Cumulative Update for Windows 11 for x64-based Systems (KB5016629).

I am not convinced ( nor believe) of a connection to Malwarebytes. Rather, culprit is likely the network connection or corrupt Windows components. The first suspect here is the policy restriction on Windows Update.
By the way, Windows Update error 0x8007054f is known to have occured on systems that do not have Malwarebytes.

Link to post
Share on other sites

I've followed the steps indicated above and have attached the log file.

I understand your skepticism, however, I was able to install the update successfully after I disabled all of the protection which was active in Malwarebytes early this morning. Prior to that, I made multiple attempts last month to install the July cumulative update without success and then I waited till the cumulative update was released for August and attempted to do the same again which also failed.

To clarify, I disabled Web Protection, Malware Protection, Ransomware Protection, and Exploit Protection. Once these were off, the August cumulative update installed without a hitch. This system I am running on is also very new. I built the system in April with new CPU, Motherboard, RAM, OS Installation. The only parts I reused are my SSDs which are setup in a Raid 1+0 configuration to run the OS. The SSDs themselves are only a year old and have plenty of life in them and have not experienced any faults. Prior to the July cumulative update, the system had no issues installing them and has had no issues installing driver updates and smaller security patches.

Fixlog.txt

  • Like 1
Link to post
Share on other sites

Hello @AgentZer0

Q: When was it exactly that you got a success with Windows Update?  Was it before I sent you & you ran the custom script ?

[ 2 ]

I would like to get a usable report from the system about Windows Update run(s). This is a report only. It will also not involve a reboot or a restart/ It should run quickly. Begin by deleting the prior file Fixlist.txt on Downloads. 

We will use FRSTENGLISH.exe  on the Downloads folder to run a custom script.    

This custom script is for  AgentZerO  only / for this machine only.

  • Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt             <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.


RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

  • IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

  • on the FRST window:

Click the Fix button just once, and wait. It will finish quickly. Once completed, look for a report on the Desktop named

Windowsupdate.log

Please attach that + also attach Fixlog.txt

Link to post
Share on other sites

42 minutes ago, Maurice Naggar said:

Q: When was it exactly that you got a success with Windows Update?  Was it before I sent you & you ran the custom script ?

I got a success before I created this thread after reading through the thread I linked to in my initial post. Also see this link which was posted on another site by the same user.

WindowsUpdate.log Fixlog.txt

Link to post
Share on other sites

Just to clarify on my last post... I got a successful install of the update without implementing the fix that was shared by Porthos to that user. I just simply disabled Malwarebytes protection and it allowed the install to complete successfully. When Malwarebytes was on, the update would download and complete the initial installation steps prior to prompting for a reboot. Then during the reboot the update progress would reach 30% then PC would restart. After booting up again, update progress would resume and it 35% then PC would suddenly reboot again. After booting up a 2nd time, the update progress would resume but after a few seconds it would show the message that something went wrong and that it was reverting the changes. The PC would do this through 2 more reboots until I'd get back into Windows again.

That same behavior happened for both the July update and the August update up until I found the thread I linked in my original post and tried disabling Malwarebytes to see if the update would succeed.

Link to post
Share on other sites

  • Root Admin

Please consider turning OFF the Fast Startup option. This forces the computer to go into a hybrid sleep mode when you shut it off. It does not actually close all your programs and power off the computer. It all stays on as it was in a special sleep mode.

Turn On or Off Fast Startup in Windows 11
https://www.elevenforum.com/t/turn-on-or-off-fast-startup-in-windows-11.1212/

 

The logs show your computer is basically only restarted about every couple of weeks, even if you're shutting it down every night.

 

Thanks

 

  • Thanks 1
Link to post
Share on other sites

1 hour ago, AdvancedSetup said:

Please consider turning OFF the Fast Startup option. This forces the computer to go into a hybrid sleep mode when you shut it off. It does not actually close all your programs and power off the computer. It all stays on as it was in a special sleep mode.

 

As a FYI, disabling Fast Boot has no effect on Restarts. It only applies when you do a full shutdown of the PC and power it back on again. Refer to following screenshot... But to appease this requirement I have disabled it for now.

image.thumb.png.46e787c65035bea6b1302916ebf1ab3d.png

 

Next, I tried to uninstall the KB5016629 update from my PC via Control Panel > Programs and Features > View Installed Updates while all Malwarebytes Protections were enabled.

The PC conducted its preliminary uninstall sequence while Windows was running and then prompted me to reboot the system to finalize it.

Instead of restarting I performed a full shutdown.

While it was shutting down, I saw the prompt where it was displaying the Windows Update progress and like before, the percentage would tick up to 30% and then the system fully shutdown.

After about 10 seconds I powered the system back on, as it went to load windows the Windows Update progress resumed and again reached 35% and the system automatically restarted.

After the system booted up again, the system attempted to resume Windows Update progress and after a second or 2 it displayed the message that something went wrong and was reverting the changes.

The system then restarted twice as it rolled back the uninstall and when I reached Windows Desktop again, I then went to Malwarebytes and disabled 'Exploit Protection' while leaving all other protections on and attempted to uninstall KB5016629 again.

This attempt failed following the same sequence of events as previously described (note that this is the same sequence of events that I experienced when I initially tried to install the Cumulative update as explained above).

Next, I toggled Exploit protection back on and then disabled 'Ransomware Protection' (note all other protection services are toggled on as well), then I attempted to uninstall KB5016629 again.

This time it is successful! The OS was able to process this change without fail while the 'Ransomware Protection' was toggled off.

Also note, I do not have the Tamper Protection toggled on inside the software (this has always been toggled off).

 

Now I'm doing the reverse by attempting to reinstall the update, first with all the Protections toggled on (including Ransomware protection) to see if it fails to install the update.

I'll post another update after I complete this process in reverse.

 

Link to post
Share on other sites

  • Root Admin

Yes, I fully understand Fast Startup ( a terrible and costly mistake for Microsoft in my opinion with thousands of reports of problems) - I was not trying to say that this was the cause, only that it is a terrible setting that does cause a lot of issues.

Thank you for the update. Once completed we'd need to get a fresh set of logs from out MBST tool, please.

Cheers

 

Link to post
Share on other sites

I've replicated my steps to reinstall KB5016629 and I've confirmed that only when the 'Ransomware Protection' is toggled off, the OS is able to install the update. Please drop me a Fixlist.txt file so I can collect the logs you need for analysis. I believe you should also be able to replicate this behavior from your end if you have a test box or VM running Windows 11 (my PC is running Windows 11 Pro). I'm going to install Hyper V and try to replicate this in an isolated VM. One other caveat I should add about my machine... As I don't currently have the installation media for Windows 11 pro, I had initially installed Windows 10 pro and then upgraded it to Windows 11 pro after rebuilding this machine back in April.

Link to post
Share on other sites

52 minutes ago, AgentZer0 said:

I believe you should also be able to replicate this behavior from your end if you have a test box or VM running Windows 11 (my PC is running Windows 11 Pro). I'm going to install Hyper V and try to replicate this in an isolated VM.

I have a clean Win 11 pro VM in Hyper-V. I has no issues updating any of the updates with Malwarebytes fully enabled.

54 minutes ago, AgentZer0 said:

I had initially installed Windows 10 pro and then upgraded it to Windows 11 pro after rebuilding this machine back in April.

Might be a factor.

Out of the handful of Win 11 clients I have, only one had an issue. Disabling MB from startup and quitting from the taskbar icon fixed the issue.

The above is just my "hands on" experience so far.

  • Thanks 1
Link to post
Share on other sites

I know this is not my thread but I may have something to add. I have two threads running on the Microsoft Forum for past KB cumulative updates failing to install (under the name KenMel). I had no problems through the June 14th updates. I couldn't install the June quality update nor the July 12th update. I disabled Malwarebytes and unchecked load at startup. Rebooted and was able to install KB5015814. I haven't tried to install the Aug update yet. What I have seen on my threads is there are many workarounds that have worked. BUT... some work for some people while the same won't work for others. Some people have used a combination of workarounds to get the updates to install. Disabling Malwarebytes; disabling .NETFrameworks; doing an in-place repair using the Win 11 ISO and on and on. This is not an isolated event. 

I chatted with Microsoft support. This a direct quote from that chat: 

Yes, it's a common issue with Windows 11 and we're currently working on it. Apologies for the inconvenience. For now, we highly suggest that you install the updates using the ISO file. This should install all pending updates and quality fixes.
Please go to this link: https://www.microsoft.com/en-us/software-download/windows11 
1. Scroll down a little and once you see Download Windows 11 Disk Image (ISO), please click the dropdown and choose Windows 11 and then choose your desire language and then choose 64 bit and start downloading.
 
I certainly can't explain why disabling MB worked for me. Many others with the problem are not even using MB. This is affecting AMD and Intel CPU's. Brand new store bought PC's. Older home built PC's. I personally am waiting for Microsoft to come up with a "real" fix before I try installing another cumulative update. And this is ONLY affecting cumulative updates. Other updates are installing fine. 
 
 
 
Edited by AdvancedSetup
Corrected font issue
  • Like 1
  • Thanks 2
Link to post
Share on other sites

For AgentZerO, this is to note that no malware is involved in your case.
As to Phxflyer, it seems to me that "Reboot" step you took prior to 'last' install KB5015814 had to be the key ingredient in succes of update. From many many years of experience, it is known that a Reboot does a world of good.
From the rest of what you said & from the gist of what you reported of Microsoft advice, I would posit that a "clean boot startup" just before the Update run would be super helpful ( for those who encounter the same update failure).

Link to post
Share on other sites

In addition to @Phxflyer, I received a DM from another user @cash22 who also seemed to have a similar problem and who also confirmed that disabling Malwarebytes allowed his system to install the cumulative updates. I have also setup the VM via Hyper-V on my system, I installed Windows 10 from an ISO I downloaded, activated it and then performed the upgrade to Win 11 in same fashion that I did with my physical system. Immediately after updating to Win 11, I paused Windows updates and installed and activated a spare license that I had for Malwarebytes Premium, enabled all of the protections and then restarted the VM. Post restart I resumed Windows Updates, and the system had no issues installing the pending security and cumulative updates.

One thing to note though was that it seemed the August cumulative update was installed during the upgrade from Win 10 to Win 11 and when I attempted to remove the update it caused the Start Menu and Taskbar to get stripped away from the VM. Luckily, I had downloaded the cumulative update installer to the VM via Windows Update Catalog prior to attempting to uninstall it and through some creative hoops I managed to get the update reinstalled, thus restoring the Start Menu and Taskbar functionality. Malwarebytes was fully enabled while removing and reinstalling the update in the VM.

One more observation I found was that many of the past updates which I show installed in the Windows Update History under Settings > Windows Update > Update History are not actually showing up in the Installed Updates list located in Control Panel > Programs > Programs and Features > Installed Updates. Aside from the VM, I do not have any other Windows 11 system to compare this against so I'm uncertain if this is the expected behavior or not.

image.thumb.png.046acaa41fea57346c2c49039eb5e95d.png

 

image.thumb.png.1f4aa44fa9a4b0cecca5e4bd7bd80bec.png

Link to post
Share on other sites

Adding a kind note that I ran into the first issue ever with Windows update last month.  When I tried to install KB5015814.  Everything else installed okay, and I thought perhaps this update was the issue.  However had the same issue in August with KB5016629.  I ran sfp and dism, and also the windows update troubleshooter as others seem to have done and then ran the updates again.  Even through standalone installer but same issue - failed to install.  It was only through resarching further and others that I turned off MB live protection.  Also key was preventing it at startup.  Then RESTART.  Then run the standalone installers and updates worked without issue.  The updates then ran and completed successfully.  These were both security updates so something was in contention there. Then I reactivated MB per the prior settings.  Just sharing in the hopes that whatever the issue is can be prevented future.

Link to post
Share on other sites

On 8/12/2022 at 5:56 PM, AdvancedSetup said:

As this is not malware related, I have moved the topic to another help forum. @Maurice Naggar

 

If you want you can close my thread and I'll post into this thread. Keep all the feedback in one place. 

 

My issues is very much what OP has already said. Both of us have been following the same steps but only when MB is disabled does the windows updates install. 

 

June KB is when it started happening for me. 

Link to post
Share on other sites

Well, color me surprised. Turning off MB and rebooting worked for me last month but NOT this month. KB5016629 won't install with MB off. As I expected, there is much more going on here and I'm really not sure MB has anything to do with this problem. I've done everything recommended except turning off .NET Frameworks 3.5 or doing the in-place update with the ISO. I'll probably wait this out until MS comes out with a published "fix" or until 22H2 is released.

  • Like 1
Link to post
Share on other sites

The key steps that worked for me.  First, run the sfm and dism tools.  Then run the windows update troubleshooter.  Once that is done, then turn off MB active protection, all four of them and then also ensure to stop it's boot on startup.  Then reboot. Once that is done, I ran the standalone installers for 5814, first.  Then 6629 second.  Once those updated properly and rebooted, then I reactivated all four of the MB protections and the startup choice.  Version of MB I have is 4.5.12.  An observation is that the other updates all ran okay, except for these designated security updates.  Those needed this step to be successful.  fwiw.  Perhaps due to windows update changes we need to do this prior to running update?  Ymmv. :-)


Dave

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.