forums.wsusoffline.net

Hello!
During the download process, at the stage of file signatures verification, I get strange warnings about deleting some of the just downloaded files, including even the wmp11 distribution.
First, I run downloading wxp rus on a clean, just unpacked distribution of ver.6.81. Here is a fragment of the log:

Code: Select all

—в 10.03.2011 15:01:17.44 - Info: Downloaded/validated 3 statically defined updates for wxp glb
—в 10.03.2011 15:01:18.67 - Info: Cleaned up client directory for wxp glb
—в 10.03.2011 15:01:18.73 - Info: Deleted alternate data streams for wxp glb
—в 10.03.2011 15:01:24.72 - Warning: Deleted unsigned file "F:\root\wsusoffline\client\wxp\glb\WindowsXP-KB968930-x86-ENG.exe"
—в 10.03.2011 15:01:24.73 - Info: Verified digital file signatures for wxp glb
—в 10.03.2011 15:01:25.60 - Info: Created integrity database for wxp glb
...
—в 10.03.2011 15:15:13.05 - Info: Downloaded/validated 130 dynamically determined updates for wxp rus
—в 10.03.2011 15:15:21.64 - Info: Cleaned up client directory for wxp rus
—в 10.03.2011 15:15:21.64 - Info: Deleted alternate data streams for wxp rus
—в 10.03.2011 15:18:35.58 - Warning: Deleted unsigned file "F:\root\wsusoffline\client\wxp\rus\WindowsXP-KB968930-x86-RUS.exe"
—в 10.03.2011 15:18:35.58 - Warning: Deleted unsigned file "F:\root\wsusoffline\client\wxp\rus\WindowsXP-KB969084-x86-rus.exe"
—в 10.03.2011 15:18:35.74 - Info: Verified digital file signatures for wxp rus
—в 10.03.2011 15:20:08.08 - Info: Created integrity database for wxp rus
—в 10.03.2011 15:20:08.51 - Info: Ending WSUS Offline Update download for wxp rus


Afterwards, I run downloading wxp enu and get this:

Code: Select all

—в 10.03.2011 16:29:26.43 - Info: Downloaded/validated 3 statically defined updates for wxp glb
—в 10.03.2011 16:29:26.70 - Info: Cleaned up client directory for wxp glb
—в 10.03.2011 16:29:26.70 - Info: Deleted alternate data streams for wxp glb
—в 10.03.2011 16:29:34.80 - Warning: Deleted unsigned file "F:\root\wsusoffline\client\wxp\glb\WindowsXP-KB968930-x86-ENG.exe"
—в 10.03.2011 16:29:34.81 - Info: Verified digital file signatures for wxp glb
—в 10.03.2011 16:29:35.75 - Info: Created integrity database for wxp glb
...
—в 10.03.2011 16:43:59.58 - Info: Downloaded/validated 143 dynamically determined updates for wxp enu
—в 10.03.2011 16:44:07.64 - Info: Cleaned up client directory for wxp enu
—в 10.03.2011 16:44:07.64 - Info: Deleted alternate data streams for wxp enu
—в 10.03.2011 16:47:31.65 - Warning: Deleted unsigned file "F:\root\wsusoffline\client\wxp\enu\WindowsXP-KB969084-x86-enu.exe"
—в 10.03.2011 16:47:31.65 - Warning: Deleted unsigned file "F:\root\wsusoffline\client\wxp\enu\wmp11-windowsxp-x86-enu.exe"
—в 10.03.2011 16:47:31.94 - Info: Verified digital file signatures for wxp enu
—в 10.03.2011 16:49:15.01 - Info: Created integrity database for wxp enu
—в 10.03.2011 16:49:15.76 - Info: Ending WSUS Offline Update download for wxp enu


Apparently, KB968930-x86-ENG has been downloaded and deleted once again, and even WMP11 did not escape the fate.
Can anyone give me a hint of what is going on?

Hi OlegK,

an unsigned patch file is suspicious, thus it's deletd by WOU if verification is enabled.
To avoid deletion of unsigned files, just turn off verification.

Regards
Torsten Wittrock

Thanks, Torsten!
I understand that it is not a bug in WOU. But still, the loss of certain patches, including even WMP11, seems a very serious side effect from turning on verification. Maybe, the user should be warned when turning on this option. Or, maybe, there is some workaround like requesting the missing signatures from some reliable source...

Normally ALL Microsoft patches are signed, I've yet to hear about an unsigned one.

Note that requesting signatures is not possible, they are firmly embedded within the PE executable.

To be specific, this hotfix:
http://download.microsoft.com/download/ ... 86-ENG.exe
displays a valid signature when I download it manually and right-click on it.
But it gets deleted by WOU immediately after automatic downloading, with "Warning: Deleted unsigned file ..." message.
By the way, it is a statically defined update.

Hi OlegK,

actually, this is not the case at my place:

Code: Select all

14.03.2011 13:23:37,83 - Info: Verified integrity of existing updates for wxp glb
14.03.2011 13:23:38,04 - Info: Determined statical update urls for wxp glb
14.03.2011 13:23:38,51 - Info: Determined dynamical update urls for wxp glb
14.03.2011 13:23:39,49 - Info: Downloaded/validated 3 statically defined updates for wxp glb
14.03.2011 13:23:39,62 - Info: Cleaned up client directory for wxp glb
14.03.2011 13:23:39,62 - Info: Deleted alternate data streams for wxp glb
14.03.2011 13:23:39,89 - Info: Verified digital file signatures for wxp glb
14.03.2011 13:23:40,04 - Info: Created integrity database for wxp glb


...and WindowsXP-KB968930-x86-ENG.exe is (still) present in ...\client\wxp\glb...



Regards
Torsten Wittrock

Hmmm, maybe it's time to get a Linux-based Offline Virusscanner and to scan your system for infections. Just to be sure it's not a side-effect of an infection.
http://www.avira.com/en/support-downloa ... cue-system

Doesn't it depend on the version of sigcheck?
The following is what I get when I check manually the hotfix which was downloaded also manually (download link is in my previous post), without the use of WOU.

Code: Select all

H:\adm_rw>sigcheck WindowsXP-KB968930-x86-ENG.exe

Sigcheck v1.71 - File version and signature viewer
Copyright (C) 2004-2010 Mark Russinovich
Sysinternals - www.sysinternals.com

H:\adm_rw\WindowsXP-KB968930-x86-ENG.exe:
        Verified:       Invalid Chain
        Signing date:   2:41 pm 14.03.2011
        Publisher:      Microsoft Corporation
        Description:    Self-Extracting Cabinet
        Product:        Microsoftо Windowsо Operating System
        Version:        6.3.0015.0
        File version:   6.3.0015.0 built by: dnsrv

Here is what I get:

Code: Select all

D:\wsusoffline\bin>sigcheck ..\client\wxp\glb\WindowsXP-KB968930-x86-ENG.exe

Sigcheck v1.71 - File version and signature viewer
Copyright (C) 2004-2010 Mark Russinovich
Sysinternals - www.sysinternals.com

D:\wsusoffline\client\wxp\glb\WindowsXP-KB968930-x86-ENG.exe:
        Verified:       Signed
        Signing date:   00:52 10.10.2009
        Publisher:      Microsoft Corporation
        Description:    Self-Extracting Cabinet
        Product:        Microsoft« Windows« Operating System
        Version:        6.3.0015.0
        File version:   6.3.0015.0 built by: dnsrv

D:\wsusoffline\bin>sigcheck sigcheck.exe

Sigcheck v1.71 - File version and signature viewer
Copyright (C) 2004-2010 Mark Russinovich
Sysinternals - www.sysinternals.com

D:\wsusoffline\bin\sigcheck.exe:
        Verified:       Signed
        Signing date:   20:56 12.10.2010
        Publisher:      Sysinternals - www.sysinternals.com
        Description:    File version and signature viewer
        Product:        Sysinternals Sigcheck
        Version:        1.71
        File version:   1.71


I get the same as harry does, and that's what shows your problem - you get an "Invalid Chain" where we get a "Signed".
File properties at my place:
- WindowsXP-KB968930-x86-ENG.exe: 6.156.064 Bytes (MD5: 9859a26d5e72bbb0685af813b409d99d)
- sigcheck.exe: 220.024 Bytes

Regards
Torsten Wittrock