Can't install Service Pack (or some/all other updates) directly, from Windows Update or by WSUS. See http://support.microsoft.com/default.aspx?scid=kb;en-us;822798 for solutions.
This worked for me:
create batch file (catroot2.cmd)
net stop cryptsvc
ren %systemroot%\System32\Catroot2 oldcatroot2
net start cryptsvc
cd %systemroot%\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
del /Q tmp*.cat
exit
Then delete all tmp*.cat files from %systemroot%\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} (or add to batch file, as above)