Windows Update Service Disabled - Error 80070422
Question
-
Hi,
On Windows Vista Ultimate SP1, when I go to Windows Update I see a "Check For Updates" button. When I click it I get an 80070422 error and "Try Again" button which does not work.
I have tried all that is explained in Help on this error, but it's still not working. Let me write in more detail: I opened "Administrative Tools", went to "Services", "Windows Update" service is disabled. I set the "Startup Type" to "Automatic", click on Apply and then I click the "Start" button to start the service. I get an error: 1058: "Windows could not start the Windows Update service on Local Computer", "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it".
I downloaded "WindowsUpdateAgent30-x86.exe" and installed it, hoping that the problem will be fixed, but no luck.
I read somewhere on this forum that a user faced a similar problem and searched in "Windows\System32" for "wu*.*" files and changed the security settings for all of them to allow SYSTEM and Administrators full control and re-registered through "regsvr32" all of the .dll files, but, after doing all of these I still had no luck.
My Windows Update still displays the error 80070422 and when I try to start the Windows Update service I get the error that the service cannot be started and it always sets itself on "Disabled", no matter what I do.
Could someone please help me with this problem? I really don't know what else to do.
Answers
All replies
-
Okay, found another step that I tried: I checked if the Background Intelligent Transfer Service [BITS] and the Windows Modules Installer Service are not disabled. "If these services are disabled, Vista cannot properly install its updates from Windows Update." so I read. I checked BITS and it was enabled, and I checked on Win Modules Installer and it was stopped. I started it, but when I want to start the Windows Update service I still get the same error and it won't start.
Does anyone have a clue? Thanks!
-
Okay, here's what's what:
Three days ago I got infected with a virus. I had Norton AV 2007 up-to-day virus updated and everything, but it still got through. It hit hard: Windows Updates and Task Manager were unable to start and system performance and stability really got hit. I don't know how I got infected, but it could have been a program/activeX control etc from the Internet as someone else was using the computer at the time, too, and I didn't really know what pages were visited, what got installed etc. Needless to say, Windows updates were all up-to-date, too. I figured I should try to disinfect the PC somehow and I ran Panda ActiveScan and Kaspersky Online scan and even NOD32 online scan, alongside Norton AV scan from my PC and Panda reported some cookies, Kaspersky I think found a virus file and NOD32 and Norton got nothing. Not being able to disinfect I just formated my partitions and installed Vista fresh. The thing is, I don't know exactly when it happend, but after I downloaded SP1 and installed Messenger and other small apps, like NetLimiter and Billeo, Windows Update got disabled in the process somehow. I tried all the methods that I've written about just above and still nothing. This morning I tried this:
I ran msconfig and looked at the startup programs. I found and disabled the following:
98d8e608 - Unknown - Rundll32.exe "..." - HKLM\...
BM9bebd594 - Unknown - Rundll32.exe "..." - HKLM\...
MSServer - Unknown - Rundll32.exe ... - HKLM\...
Language Application - Unknown - [Path to CyberLink PowerDVD, but I disabled it to be sure] - HKLM\...
And just to be really sure I disabled some more processes that I thought were not critical, like Symantec or Creative or HP or NVidia. I also checked under Services and (after I hid all Microsoft services) and I disabled some, just to be sure:
FLEXnet Licensing Service - Macrovision... - [Don't know exactly what it is]
Adobe Active File Monitor V6 - Unknown - [I presume if it were from Adobe it wouldn't have written Unknown under Manufacturer]
Symantec Core LC - Unknown [Again, some apps under Manufacturer had Symantec Corporation, this one had Unknown and I disabled it]
And some others that I thought were not critical and could do without, just to be sure and in case they got infected.
One important note: if you try and remove the some startup items while running in Windows Normal Mode they just get enabled again, jsut run msconfig again and you'll see they get enabled instantly. So in order for this not to happen I started Windows in Safe Mode and done all of the above.
After I done the above in Safe Mode I started Windows normally. I went to Administrative Tools, Services, checked that BITS is running (it was running), Windows Modules Installer is running (was not running) and then enabled Windows Update service (it was disabled and stopped) and started it. Then I could establish a connection to Windows Update, it worked.
Some interesting things I found along the way: if you execute Windows Internet Explorer, the startup baddies will be enabled. Also, sometimes I get a fake warning for installing I-don't-know-what program or plug-in for spyware and malware detection etc. So clearly there's a new virus in town that makes all these bad things.Also note: I have the windows taskbar in autohide mode and since I got infected (before reinstalling Windows and just after Windows Update got disabled) the bar just keeps popping up from time to time and then goes back just as fast, but it's really annoying.
In order to browse the Internet I installed FireFox and the baddies don't get enabled or new entries into the startup tab from msconfig. Note that the above names, like BM9bebd594 might be random and different on another machine.
After all this I scanned my PC again, this time with Norton AV 2008 (I do have NIS 2008 and the firewall sometimes displays an info that Download or Downloader program was stoped downloading certain files to my computer) and again with Panda, but nothing was found.
Does anyone have any idea about what kind of virus this is and how can and with what AV solution one can get rid of it? Thanks a lot! -
Wow, great!
I ran the tool that you mentioned and the virus in question was detected as: Trojan.Vundo
Maybe the logs will help some others, too: Here's the log on the first scan:
Malwarebytes' Anti-Malware 1.14
Database version: 8088:40:22 PM 5/31/2008
mbam-log-5-31-2008 (20-40-22).txtScan type: Full Scan (C:\|D:\|)
Objects scanned: 169731
Time elapsed: 42 minute(s), 47 second(s)Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 9
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 8Memory Processes Infected:
(No malicious items detected)Memory Modules Infected:
C:\Windows\System32\byXOHaBU.dll (Trojan.Vundo) -> Unloaded module successfully.Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{1449fa3b-f8a5-40ec-87da-707e80637ddd} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1449fa3b-f8a5-40ec-87da-707e80637ddd} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{663656df-6bae-460c-a612-8133df519346} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{663656df-6bae-460c-a612-8133df519346} (Trojan.Vundo) -> Quarantined and deleted successfully.Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\byxohabu -> Quarantined and deleted successfully.Folders Infected:
(No malicious items detected)Files Infected:
C:\Windows\System32\byXOHaBU.dll (Trojan.Vundo) -> Delete on reboot.
C:\Users\Shere Khan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LK0KREDB\kb516107[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\fccywwts.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\gEwtTLFy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\yayvSiHb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\_Shere_Quarantine\fmsnvygd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\byXnMghG.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\byXPfgfe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.Here's the log on the second scan, after a restart:
Malwarebytes' Anti-Malware 1.14
Database version: 8089:48:01 PM 5/31/2008
mbam-log-5-31-2008 (21-48-01).txtScan type: Full Scan (C:\|D:\|)
Objects scanned: 168808
Time elapsed: 56 minute(s), 31 second(s)Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2Memory Processes Infected:
(No malicious items detected)Memory Modules Infected:
(No malicious items detected)Registry Keys Infected:
(No malicious items detected)Registry Values Infected:
(No malicious items detected)Registry Data Items Infected:
(No malicious items detected)Folders Infected:
(No malicious items detected)Files Infected:
C:\Windows\System32\byXOHaBU.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\dqhreobq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.On the third scan, no other infections were found. The files and locations and one or two registry entries are similar to what I suspected was not allright, so I guess the (right) virus has been found and eliminated. Have enabled Java in FireFox and everything seems fine, haven't touched Internet Explorer just to be on the safe side so I can't say anything about that, but everything looks allright. Seems this was the problem. Thanks again, mate, your post was a life saver.
-
Guys this Malwarebytes' Anti-Malware software saved my life............ Install this and scan your computer completely twice or thrice...... all your malware and spamware will be cleared!
Thanks Guys................
-
guys! ... this program is like the magic . finally after 3 days working on this s*** new virous , this lil thing solv the problem. and i start thinking to reformat all my hard drive
i really was going to lose my work for many years just because of stupid virous . thanks god and really thank you guys . you saved my life . i actually don't know what to say but just thanks alot. -
YES, IT WORKS & FIXED MY PC. IT'S REALLY A GREAT & POWERFUL SOFTWARE! *Thumbs up*
WHAT A "LIVE SAVER" !!!
THANK YOU FOR THE TIPS & THANKS MALWAREBYTE!
P.S: Make sure you close all the applications before you run the scan and/or REMOVE those found virus/spyware... and then RE-RUN SCANNING AGAIN to make sure your system is clean from those virus/spyware.
