Thursday, March 15, 2007

LiveUpdate blues

Today i decided to do a backup of my laptop; it had been a while since the last time. So I enabled all the Symantec services and started Norton Ghost to get the backup running. I also decided to check for updates at the same time, just to be sure. I launched LiveUpdate from the Norton Ghost main menu and it checked for updates and stopped with a cryptic:

LU1848: Couldn't create callback object

OK, lets ask Google. I got a lot of hits. But the common recommendation seems to be to uninstall all Symantec software and reinstall it again. A lot of people also recommended to ignore the second step and buy something different.

I thought this was a good opportunity to test out our next product. Application Inspector. Application Inspector is an easy to use merge of regmon and filemon, built for non developers. It works by recording a lot of systems API calls the application does and checks for errors. I started the luall.exe using application inspector and after fixing a couple of bugs (it's still in development) I got a result. LiveUpdate was looking for a COM object with the CLSID of:


A quick search using Google this CLSID gave my the faulting Symantec product. It should be pointing toward a SymIDSLU.LUCallback object that was missing from my system. I had noticed before a reference to an IDS program in the list of application that LiveUpdate was trying to update. I think this must be a leftover from an old Norton Internet Security installation that Dell shipped with the computer.

OK, now how to fix this? I had some time, the computer was just doing backup anyway and it was almost to slow to do any real work. I started to poke around among the LiveUpdate files and looked at the configuration files for LiveUpdate. But the Product.Inventory.LiveUpdate file that keeps a list of installed applications that LiveUpdate is supposed to update is encrypted or something, it's not readable. I when found the ProductRegCom_2_6.DLL module and started to look at the TypeLibrary embedded in that file. The API was simple and I soon had a small test program working to dump all the information I needed, and a small fix again I had that faulty application removed from LiveUpdate repository. Nice!

Here is the code:

#include "stdafx.h"

#import "c:\program files\symantec\LiveUpdate\ProductRegCom_2_6.dll" named_guids

using namespace PRODUCTREGCOMLib;

_COM_SMARTPTR_TYPEDEF(IEnumString, __uuidof(IEnumString));

int main(int argc, char* argv[])


hr = CoInitialize(0);
if (FAILED(hr)) {
printf("Failed to init COM\n");

IluProductRegPtr p;

hr = CoCreateInstance(CLSID_luProductReg,NULL,CLSCTX_INPROC_SERVER,IID_IluProductReg,(void**)&p);
if (FAILED(hr)) {
printf("Failed to create LiveUpdate Product Reg object\n");

if (argc) {
hr = p->DeleteProduct(*argv);
if (FAILED(hr)) {
printf("Failed to delete product\n");
return 0;

IEnumStringPtr t;

t = p->GetProductMonikerEnum();


while(t->Next(1,&prod,NULL) == S_OK) {

IEnumStringPtr x;

x = p->GetPropEnum(prod);

while(x->Next(1,&prop,NULL) == S_OK) {
printf(" %S\n",prop);




printf(" %S\n",v.bstrVal);

return 0;

No comments: