The infamous "wsusscn2.cab signature verification" error

[donobie]

Hello - 1st post - Thanks to those whose efforts make this tool possible!

As a 1st time user, I've multiple questions and request-suggestions.

Environment:

Test Partition clean install of w7sp1x64 Ultimate on i7 16gb RAM 500gb SSD, 50 MB cable dL rj45 connect

Day 1 [Nov.4] - 3 tries, all ending w/ the infamous "wsusscn2.cab signature verification failure".

Day 2 [Nov.6] - after reading every documentation I could find,
plus watching every video I could find,
I decided to uncheck "Verify downloaded Updates".

Now the dL goes quite fast - no errors -
takes 1 - 2 hours ? to dL 2.8 gb w7x64-only + .NET + C++ runtime updates,
then takes 10 minutes to install about 17-19 KB..... updates before 'Done'.

Looking through several checkpoints in w7, I wonder - "This isn't everything is it?"
Then I confirm that no C++ or .NET 4.6.2 have been installed,
so I proceed to install them by clicking on their individual files -- < 10 minutes for that to complete.

I did proceed to navigate the 'net a little after these installs, and things seemed to work fine,
but haven't done any further testing on that partition.

Returned home today and decide to try again w/ "Verify" checked - nope, errors again -
so I join the forum & spend 1-2 hours reading what I can on the forum --
and it seems like such a repetitive problem I wonder -

why hasn't any clearcut documentation been written and posted as a sticky? --
especially concerning such a repetitive and universal problem? --

[if so - please refer me! thx]

and I understand it's MSoft's [mis]handling of updating the catalog file +
not to mention server load balancing-full moon-whatever !
and the advice to ........ wait ..... until ..... MS ..... releases ...... a ..... proper ...... file !

then -- what, specifically, should be done to save the good while you got it? and ...
how to merge-join-combine that in the future when it fails again?

If I knew the answers, I'd be glad to be the one to write 'em up --
and if I can get the answers here in a short time, I WILL write it up if you like.

Here are my questions --

1) Has anyone written a step-by-step documentation as to:

a) any pre-requirements/cautions? such as - Services to turn off/or make sure turned on?

b) applications to turn off/ or make sure turned on? (AntiVirus, firewalls, etc.)

c) how to deal with this catalog file error that seems to be almost universal in everyone's experience??

i.e. - what to Do / Not Do ??
A person begins to resort to "magical thinking" without clear road signs to follow --

"maybe I need to 1st install 'April 2015 Servicing Stack Update KB3020369',
"maybe I need to 1st install 'WindowsUpdateAgent-7.6' etc etc etc

One of the videos says "I just uncheck the Verify Download Updates -
it'll only hang you up with an error if you leave it checked,
and I've never had a problem afterwards by leaving it unchecked."

vs. --

some explicit statements [from this site I believe] -
"Do NOT uncheck - it will only cause problems later."

So the infamous quandry of in-experience :

Who Do You Believe? when you have no experience of your own to guide your own self?

2) Is it possible to uninstall unneeded/undesired language packs [or other items] after the mass install?

Are there any instructions as to what these could be/might be, and how to do that?

I'm grateful for such a useful tool, and especially in light of the [non]future of w7 & the promised 'eternal' Windows "10".

I'm already investing sizeable time each day in several Linux VMs to become proficient there,
but Win7 can run in a VM on Linux host for years probably, w/ the desired 'irreplaceable' apps.

Thank you for your time and assistance.

[donobie]

Thank You for allowing my thread --

in the meantime whilst awaiting approval, I searched more & found your Q&A here :

h**ps://svn.wsusoffline.net/svn/wsusoffline/tags/wsusoffline9.8/doc/faq-enu.txt

and it's answered some of the questions I asked above.

[donobie]

"even a blind squirrel can catch a nut now & then ...."

hey - you don't mind me having this stream-of-consciousness-learning-conversation with myself, do you?
feel free to jump in with, hopefully, only positive suggestions that can accelerate the learning curve!

1st experiment tonite -- dL wsusscn2.cab myself, Rclick > Properties .... well well,
it DOES have a digital signature -- Wednesday, October 26, 2016 11:23:15 PM --

-- hmmm, what would happen if I make a new folder instance of wsusoffline108,
then go ahead & create that \wsusoffline\client\wsus folder ahead of time before running UpdateGenerator,

then copy MY dL of wsusscn2.cab "signature-ized" into it [184 MB],
press Start, & see what happens?

wow - it makes it past the ubiquitous wsusscn2.cab error mode .... but wait - what's that log say?

"deleting unsigned .cab file" -- does that mean MINE? or the one it just dL from MSoft?
-- going into the folder to check several Date attributes, I see it IS MINE that survives! from the earlier afternoon dL.

so yeah - the experiment-trial-hack works ...

Long story short -- pretty quickly, x86 KB......; C++; .NET packs all dL'd @ 1.98 GB,
but will wait to install them tomorrow, because I'm really feeling lucky, so I'm gonna do .....

2nd experiment tonite -- I got plenty space on this SSD, & plenty bandwidth/dL allowance,
so let me now ask for BOTH x32 + x64 -- whilst running from a test install of w7sp1x32 bit,
and another new instance of the program folder.

So here's where the squirrel got lucky --
after whizzing thru the dL of the ornery wsusscn2.cab file,
there's NO "deleting unsigned .cab file" --

huh?

So I go into \wsus, Rclick wsusscn2.cab > Properties, and whaddya know????
weighing in @ 192 MB, in this corner --- Tuesday, November 08, 2016 7:38:47 AM ---
Obviously this test took longer b/c dL both x86 + x64, but what JOY at not having the error!

Oh yeah - 1 more thing -- I previously could not get "Portable Updater" to work --
it would just hang on the "Download" step after successfully fetching its own wsusscn2.cab, etc.

But running it after the installer phase of WSUS Offline, it proceeded to fetch & dL everything
as per my instructions.

So the interesting learn-ey (learning journey) continues ....

[ps - I sure would like to write up a step-by-step + Q/A for other blind-squirrel-dumbies
like meself, who have just enough smarts to hurt theyselves -

plus maybe a truly educational video that goes beyond showing how to
dL, unwrap, and set the new software out on the counter - doesn't it look nice?

so will appreciate any great pointers along the way --
especially the finer details of how to tweak some of those fancy .txt & .cmd files ]

[joglass]

Thank you for the hint about the digital signature. I downloaded the "wsusscn2.cab" manually, as you did, and also found a valid signature via the "Properties" page - which made me very curious. I copied my manually downloaded "wsusscn2.cab" into the proper "client\wsus" subdirectory only to get an error when starting WSUS Offline Update the next time. I tried to update "client\md\hashes-wsus.txt" manually - the proper command can be found as a comment in this file, which is

..\bin\hashdeep64.exe -c md5,sha1,sha256 -l -r ..\wsus

which gave me the peculiar error that "hashdeep64.exe" was no proper Win32 application! Investigating this error showed me that the executable "client\bin\hashdeep64.exe" was indeed broken with a file size of 0! I recovered the correct executable from "wsusoffline108.zip" and still got an error about some verification error. Now I deleted the checksum file "client\md\hashes-wsus.txt" (if those checksum files are not present they will be created) and voilà: WSUS Offline Update worked as expected. So the error in my case was a broken "hashdeep64.exe" executable - an error which does not show up in the "download.log". Surely worth a check...

Best regards
Juergen

[RJARPCGP]

For me, the only fix is to use an overseas DNS server!

Otherwise, the DNS always points to a server with a corrupted wsusscn2.cab file!

[donobie]

I really appreciate seeing a couple people reply, especially it being their 1st post [as indicated by forum metrics] --
a shared collective consciousness can really speed ALL of our learnings --

@joglass -- thx - your understanding of the sigs + hashes is surely beyond mine,
but I hope to soon fully understand what you see

@RJARPCGP -- how do you specify to go thru an overseas server --
do you mean you're connecting thru a VPN or such provider? brilliant workaround

Thank you

[RJARPCGP]

@RJARPCGP -- how do you specify to go thru an overseas server --
do you mean you're connecting thru a VPN or such provider? brilliant workaround

Thank you

Simply change the DNS server! Especially in the Microsoft mirror case, it's tied to the DNS!

I used:

117.52.87.195