Windows update KB3004394 issues

There's a bug report on Oracle's VirtualBox ticket system that seems to be caused by KB3004394. For some, uninstalling the update resolves the VirtualBox failures.

VirtualBox Ticket 13677

Had a look at the VirtualBox breakage.

The problem seems to be that the update does not install any catalog file C:\Windows\System32\CatRoot and it's therefore impossible to verify the new crypto32.dll file that the it installs.  (Compare "sigcheck -i C:\Windows\System32\crypto32.dll" output before and after installing the update. Sigcheck says it's signed before and unsigned after.)

The Windows 8.1 version of the update works, i.e. installs C:\Windows\system32\CatRoot{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1_for_KB3004394~31bf3856ad364e35~amd64~~6.3.1.0.cat that we (and sigcheck.exe from microsoft/sysinternals) can successfully validate the DLL.  (I've only tried 64-bit Windows 8.1 and Windows 7, so I cannot tell exactly which updates are broken.)

The only way to make VirtualBox work again is reverting/removing the update, unless Microsoft fixes the missing .cat file issue.  I sincerely hope that Microsoft will update the update with a working cat file eventually...

-bird

PS. Would be really swell if files like crypto32.dll and wintrust.dll had embedded signatures instead of only external ones. It would not only do away with these kind of issues but also make it a lot easier to verify that the files haven't been tampered with.

We were having problems using published applications (via RemoteApp). Clients were complaining about RDP.

You could connect to the server, run the application from there, but you could not run the application that has been published by RemoteApp.

Once I removed KB3004394 it worked.

I got the same error on two machines, one being a fresh build. I removed KB3004394 and full computer functionality returned. I too stumbled upon a forum where people were discussing the update was breaking the troubleshooter which was another symptom I was having. Windows 7 Pro & Ultimate, both 64 bit.

Also affecting Windows Server 2008 R2 with same workaround currently - uninstall KB3004394:

https://social.technet.microsoft.com/Forums/windowsserver/en-US/facb705a-469e-4c7a-ad8c-9546a000e03c/getting-800706f7-windows-update-error?forum=winservergen&prof=required

This comment from the VirtualBox ticket may help illuminate what's going on:

From what I can tell, the KB3004394 update does not install a catalog file on 64-bit windows 7. It does on Windows 8.1 (C:\Windows\system32\CatRoot{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1_for_KB3004394~31bf3856ad364e35~amd64 6.3.1.0.cat), so VBox works fine there.

The result of the missing .cat file is that VBox (nor SysInternal's SigCheck.exe for that matter) is not able to verify the authenticity of c:\windows\system32\crypt32.dll and wintrust.dll. If we cannot find any valid signature for the files, we have to assume that they have been tampered with and are forced to abort application loading. These two dlls are important for validating other components, so there is absolutely no way we can ignore this.

Until Microsoft fixes the KB3004394 update on Windows 7, the only solution is to revert/uninstall it.