I have seen this too, specifically with SCCM deployed Updates. The only solution I have found is here:
http://vstepic.blogspot.ca/2013/11/windows-security-update-for-windows-xp.html
Windows Security Update for Windows XP
(KB2862330)
In this case, a colleague of
mine was complaining that his old XP client pc was installing updates every day
and was requesting to reboot the machine every day in last 30 days. Fortunately,
there was a single problematic update KB2862330 that was trying to install every
day and requesting to reboot the pc every day. According from KB article http://support.microsoft.com/kb/2862330/en-gb there
are known issues regarding installation of this update. In this case the update
was installing successfully, requesting for reboot, and after the reboot same
update was offered as available update for installing in endless loop.
I
tried to uninstall and install the update, but it didn't help the
situation.
According from KB article Scenario 3, I have disabled all the USB
Enhanced Host Controllers from device manager before installing the update, and
enable them after the reboot, but same update was on list for available updates
for installation again.
I've decided to check the update log (KB2862330.log)
for this update, I've found a lot of error events:
.........................
SetupVerifyInfFile
failed with error 0x490 for usbstor.inf of device
USB\VID_058F&PID_6387\28197C13
SetupVerifyInfFile failed with error 0x490
for usbstor.inf of device USB\VID_058F&PID_6387\2RNGA2U1
SetupVerifyInfFile failed with error 0x490
for usbstor.inf of device USB\VID_058F&PID_6387\4H5SLQD0
SetupVerifyInfFile failed with error 0x490
for usbstor.inf of device USB\VID_058F&PID_6387\5742D984
.......................
So, cryptographic
service was set to run automatically, and I've decided to rebuild the catroot2
folder. Stopping the Cryptographic service, renaming
the %systemroot%\System32\Catroot2 into catroot2-old, and restarting the
Cryptographic service will regenerate new Caroot2 folder.
Now with
disabled USB Enhanced Host Controllers, I ran the update KB2862330 again. The
update log (KB2862330.log) was generating completely different lines. Something
like :
............
C:\WINDOWS\system32\CatRoot{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
trusts inf
c:\windows\inf\oem3.inf of device
PCI\VEN_8086&DEV_24C2&SUBSYS_00C50E11&REV_01\3&61AAA01&0&E8
..............
After the requested
rebooted, I've enabled the disabled USB host controllers, and the update was not
offered as available update for installation again anymore, and was finally
successfully installed.