Hi
I've seen several questions in this forum of the same fault, but none appear to match the problem we've been having.
Our clients are running Windows XP SP3, connected to a downstream WIndows Server 2003 SP2 with WSUS 3.0 SP2 installed. All Windows clients and servers are standalone (not part of any domain)
The downstream WSUS server is not connected to the internet. We have a separate upstream WSUS server which we use to download metadata and the requested security fixes on, then we transfer the metadata and incremental downloaded content to the downstream server to be imported.
We've downloaded and installed the following KB manually rather than approve via WSUS because the server is only configured for security updates
Update for Windows Server Update Services 3.0 Service Pack 2 (KB2734608)
This installs without any issue.
On the Windows XP client, an event is logged
Source: Windows Update Agent
Category: Installation
Type: Information
Event ID: 19
Installation Successful: Windows successfully installed the following: Automatic Updates
After a few days of continuous usage, we get the following popup:
"16 bit MS-DOS Subsystem" message: "C:\Windows\system32\wuauclt.exe The NTVDM CPU has encountered an illegal instruction. CS:0000 IP:0113 OP:f0 2f 32 00 f0 Choose 'Close' to terminate the application. "
This is also captured in System Event log ID 28.
On further inspection, the file "C:\Windows\system32\wuauclt.exe" looks corrupt. On viewing File Properties, Date/time stamp/last modified date/size remain the same, but the Version tab is missing. The file stamp is 02/06/2012.
If we replace the file with one from a working machine (i.e. File stamp 02/06/2012 version 7.6.7600.256) via stopping Automatic Updates service beforehand and restarting the service, this fixes the problem.
We have McAfee VirusScan Enterprise 8.7i but I do not believe this would have caused the file corruption.
Any clues?
Jung Wan