Automatic Updates Will Not Turn On

  • Thread starter Thread starter redhoward
  • Start date Start date
I am running McAfee Security Center
That is the antivirus program and firewall.
when I got the virus in the computer I loaded Spyware Doctor with a malware
program.
I have a home network setup in my house with 2 other computers on it. There
has been no problems with either of the other computers though.

"MowGreen [MVP]" wrote:

> 2008-05-21 18:46:35:890 2368 a3c Setup WARNING: Could not move
> C:\WINDOWS\system32\wuapi.dll to
> C:\WINDOWS\system32\wuapi.dll.wusetup.1842453.bak due to 0x80070020
>
> Some 'thing' is interfering with the above operation.
>
> What is the installed antivirus\security suite and/or anti-malware
> software ?
> [ An older Version of Spybot is the cause of the 0x80070020 error when
> TeaTimer is enabled ]
>
> Which firewall is being used ?
> Is the system on a network ?
>
> You receive a "0x80070020 The process cannot access the file because it
> is being used by another process" error message when you try to download
> an update from Windows Update
> http://support.microsoft.com/kb/883825
>
> MowGreen [MVP 2003-2008]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
> DCB wrote:
>
> > Yes the 1058 error occurs after I change the setting to autoatic, then I try
> > to start it and I get the 1058 error. I am not sure what you mean by post the
> > last 50 or so lines. I am not sure where to find the log to copy and paste
> > the lines. Is this what you meant?:
> >
> > 2008-05-21 18:46:35:453 2368 a3c Setup ** START ** Setup: Installing client
> > binaries
> > 2008-05-21 18:46:35:453 2368 a3c Setup *********
> > 2008-05-21 18:46:35:453 2368 a3c Setup * Download directory:
> > C:\WINDOWS\SoftwareDistribution\WebSetup
> > 2008-05-21 18:46:35:453 2368 a3c Setup * Stop and start service: Yes
> > 2008-05-21 18:46:35:531 2368 a3c Setup Starting file operations for section
> > wuapi
> > 2008-05-21 18:46:35:859 2368 a3c Setup Successfully copied source file
> > C:\WINDOWS\SoftwareDistribution\WebSetup\wuapi.dll to
> > C:\WINDOWS\system32\wuapi.dll.wusetup.1842406.new
> > 2008-05-21 18:46:35:890 2368 a3c Setup WARNING: Could not move
> > C:\WINDOWS\system32\wuapi.dll to
> > C:\WINDOWS\system32\wuapi.dll.wusetup.1842453.bak due to 0x80070020
> > 2008-05-21 18:46:36:203 2368 a3c Setup File operations for section wuapi
> > completed successfully
> > 2008-05-21 18:46:36:218 2368 a3c Setup Starting file operations for section
> > wuauclt
> > 2008-05-21 18:46:36:515 2368 a3c Setup Successfully copied source file
> > C:\WINDOWS\SoftwareDistribution\WebSetup\wuauclt.exe to
> > C:\WINDOWS\system32\wuauclt.exe.wusetup.1843046.new
> > 2008-05-21 18:46:36:562 2368 a3c Setup Setup successfullly moved
> > C:\WINDOWS\system32\wuauclt.exe.wusetup.1843046.new to
> > C:\WINDOWS\system32\wuauclt.exe
> > 2008-05-21 18:46:36:562 2368 a3c Setup File operations for section wuauclt
> > completed successfully
> > 2008-05-21 18:46:36:578 2368 a3c Setup Starting file operations for section
> > wuaucpl
> > 2008-05-21 18:46:36:796 2368 a3c Setup Successfully copied source file
> > C:\WINDOWS\SoftwareDistribution\WebSetup\wuaucpl.cpl to
> > C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843359.new
> > 2008-05-21 18:46:36:875 2368 a3c Setup Setup successfullly moved
> > C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843359.new to
> > C:\WINDOWS\system32\wuaucpl.cpl
> > 2008-05-21 18:46:36:875 2368 a3c Setup File operations for section wuaucpl
> > completed successfully
> > 2008-05-21 18:46:36:890 2368 a3c Setup Starting file operations for section
> > wuaueng_WebSetup
> > 2008-05-21 18:46:37:375 2368 a3c Setup Successfully copied source file
> > C:\WINDOWS\SoftwareDistribution\WebSetup\wuaueng.dll to
> > C:\WINDOWS\system32\wuaueng.dll.wusetup.1843937.new
> > 2008-05-21 18:46:37:437 2368 a3c Setup Setup successfullly moved
> > C:\WINDOWS\system32\wuaueng.dll.wusetup.1843937.new to
> > C:\WINDOWS\system32\wuaueng.dll
> > 2008-05-21 18:46:37:437 2368 a3c Setup File operations for section
> > wuaueng_WebSetup completed successfully
> > 2008-05-21 18:46:37:453 2368 a3c Setup Starting file operations for section
> > wucltui
> > 2008-05-21 18:46:37:640 2368 a3c Setup Successfully copied source file
> > C:\WINDOWS\SoftwareDistribution\WebSetup\wucltui.dll to
> > C:\WINDOWS\system32\wucltui.dll.wusetup.1844203.new
> > 2008-05-21 18:46:37:765 2368 a3c Setup Setup successfullly moved
> > C:\WINDOWS\system32\wucltui.dll.wusetup.1844203.new to
> > C:\WINDOWS\system32\wucltui.dll
> > 2008-05-21 18:46:38:531 2368 a3c Setup Successfully copied source file
> > C:\WINDOWS\SoftwareDistribution\WebSetup\en\wuau.adm to
> > C:\WINDOWS\INF\wuau.adm.wusetup.1845109.new
> > 2008-05-21 18:46:38:562 2368 a3c Setup Setup successfullly moved
> > C:\WINDOWS\INF\wuau.adm.wusetup.1845109.new to C:\WINDOWS\INF\wuau.adm
> > 2008-05-21 18:46:38:562 2368 a3c Setup File operations for section wucltui
> > completed successfully
> > 2008-05-21 18:46:38:578 2368 a3c Setup Starting file operations for section
> > wups
> > 2008-05-21 18:46:38:703 2368 a3c Setup Successfully copied source file
> > C:\WINDOWS\SoftwareDistribution\WebSetup\wups.dll to
> > C:\WINDOWS\system32\wups.dll.wusetup.1845265.new
> > 2008-05-21 18:46:38:765 2368 a3c Setup File operations for section wups
> > completed successfully
> > 2008-05-21 18:46:38:765 2368 a3c Setup Starting registry operations for
> > section wuapi
> > 2008-05-21 18:46:38:781 2368 a3c Setup Completed registration operations for
> > section wuapi: status 0
> > 2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
> > section wuauclt
> > 2008-05-21 18:46:38:796 2368 a3c Setup Completed registration operations for
> > section wuauclt: status 0
> > 2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
> > section wuaucpl
> > 2008-05-21 18:46:38:796 2368 a3c Setup Completed registration operations for
> > section wuaucpl: status 0
> > 2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
> > section wuaueng_WebSetup
> > 2008-05-21 18:46:38:812 2368 a3c Misc Registering binary:
> > C:\WINDOWS\system32\regsvr32.exe /s "C:\WINDOWS\system32\wuaueng.dll"
> > 2008-05-21 18:46:44:593 2368 a3c Setup Completed registration operations for
> > section wuaueng_WebSetup: status 0
> > 2008-05-21 18:46:44:609 2368 a3c Setup Starting registry operations for
> > section wucltui
> > 2008-05-21 18:46:44:609 2368 a3c Misc Registering binary:
> > C:\WINDOWS\system32\regsvr32.exe /s "C:\WINDOWS\system32\wucltui.dll"
> > 2008-05-21 18:46:45:562 2368 a3c Setup Completed registration operations for
> > section wucltui: status 0
> > 2008-05-21 18:46:45:578 2368 a3c Setup Starting registry operations for
> > section wups
> > 2008-05-21 18:46:45:578 2368 a3c Setup Completed registration operations for
> > section wups: status 0
> > 2008-05-21 18:46:45:578 2368 a3c Setup Processing registry operations
> > completed. Deleting backup files.
> > 2008-05-21 18:46:45:578 2368 a3c Setup Successfully deleted backup file
> > C:\WINDOWS\system32\wuauclt.exe.wusetup.1843109.bak
> > 2008-05-21 18:46:45:593 2368 a3c Setup Successfully deleted backup file
> > C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843390.bak
> > 2008-05-21 18:46:45:593 2368 a3c Setup Successfully deleted backup file
> > C:\WINDOWS\system32\wuaueng.dll.wusetup.1843968.bak
> > 2008-05-21 18:46:45:609 2368 a3c Setup Successfully deleted backup file
> > C:\WINDOWS\system32\wucltui.dll.wusetup.1844234.bak
> > 2008-05-21 18:46:45:609 2368 a3c Setup Successfully deleted backup file
> > C:\WINDOWS\INF\wuau.adm.wusetup.1845125.bak
> > 2008-05-21 18:46:45:625 2368 a3c Setup FATAL: Warning: Failed to restart
> > wuauserv service: 0x80070422
> > 2008-05-21 18:46:45:625 2368 a3c Setup * WARNING: Exit code = 0x80070422
> > 2008-05-21 18:46:45:625 2368 a3c Setup *********
> > 2008-05-21 18:46:45:625 2368 a3c Setup ** END ** Setup: Installing client
> > binaries
> > 2008-05-21 18:46:45:625 2368 a3c Setup *************
> > 2008-05-21 18:46:45:625 2368 a3c Setup FATAL: InstallUpdatedBinaries failed
> > with error 0x80070422
> > 2008-05-21 18:46:45:625 2368 a3c WUWeb FATAL: InstallUpdatedBinaries failed
> > with error:0x80070422
> > 2008-05-21 18:46:45:625 2368 a3c WUWeb FATAL: UpdateClientWorker failed:
> > error 0x80070422
> >
> > Any help is greatly appreciated!
>
 
Either McAfee or malware is preventing the operation from being carried
out. The only way you can determine which is the culprit is to rule out
one or the other first.
You state that the system was infected with a virus but it was cleaned
up by Spyware Doctor. One would assume that McAfee would have cleaned up
the virus as that's one of it's functions ... an antivirus.
Spyware Doctor is not an antivirus.

Suggest you first ensure that the system is totally free of malware.
If you've already done that, then either system files have been damaged
beyond use by the malware or McAfee is the cause of the file replacement
issue.

Consult McAfee's User Guide or web site to learn how to completely
disable *all* of Security Center's protections. This includes all
running services, script blockers, site blockers, etc.
Learn how the firewall can be disabled and how to enable the native
Windows firewall.

After learning the above, disconnect from the network prior to enabling
the Windows firewall.
Then see if the system can successfully update.

If not, we'll have elimnated malware and McAfee as the causes of the
updating issue.

Then we'll run a new tool to see if it can restore the system's ability
to update successfully.
Hang in there.

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============




DCB wrote:

> I am running McAfee Security Center
> That is the antivirus program and firewall.
> when I got the virus in the computer I loaded Spyware Doctor with a malware
> program.
> I have a home network setup in my house with 2 other computers on it. There
> has been no problems with either of the other computers though.
>
> "MowGreen [MVP]" wrote:
>
>
>>2008-05-21 18:46:35:890 2368 a3c Setup WARNING: Could not move
>>C:\WINDOWS\system32\wuapi.dll to
>>C:\WINDOWS\system32\wuapi.dll.wusetup.1842453.bak due to 0x80070020
>>
>>Some 'thing' is interfering with the above operation.
>>
>>What is the installed antivirus\security suite and/or anti-malware
>>software ?
>>[ An older Version of Spybot is the cause of the 0x80070020 error when
>>TeaTimer is enabled ]
>>
>>Which firewall is being used ?
>>Is the system on a network ?
>>
>>You receive a "0x80070020 The process cannot access the file because it
>>is being used by another process" error message when you try to download
>>an update from Windows Update
>>http://support.microsoft.com/kb/883825
>>
>>MowGreen [MVP 2003-2008]
>>===============
>> *-343-* FDNY
>>Never Forgotten
>>===============
>>
>>
>>DCB wrote:
>>
>>
>>>Yes the 1058 error occurs after I change the setting to autoatic, then I try
>>>to start it and I get the 1058 error. I am not sure what you mean by post the
>>>last 50 or so lines. I am not sure where to find the log to copy and paste
>>>the lines. Is this what you meant?:
>>>
>>>2008-05-21 18:46:35:453 2368 a3c Setup ** START ** Setup: Installing client
>>>binaries
>>>2008-05-21 18:46:35:453 2368 a3c Setup *********
>>>2008-05-21 18:46:35:453 2368 a3c Setup * Download directory:
>>>C:\WINDOWS\SoftwareDistribution\WebSetup
>>>2008-05-21 18:46:35:453 2368 a3c Setup * Stop and start service: Yes
>>>2008-05-21 18:46:35:531 2368 a3c Setup Starting file operations for section
>>>wuapi
>>>2008-05-21 18:46:35:859 2368 a3c Setup Successfully copied source file
>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuapi.dll to
>>>C:\WINDOWS\system32\wuapi.dll.wusetup.1842406.new
>>>2008-05-21 18:46:35:890 2368 a3c Setup WARNING: Could not move
>>>C:\WINDOWS\system32\wuapi.dll to
>>>C:\WINDOWS\system32\wuapi.dll.wusetup.1842453.bak due to 0x80070020
>>>2008-05-21 18:46:36:203 2368 a3c Setup File operations for section wuapi
>>>completed successfully
>>>2008-05-21 18:46:36:218 2368 a3c Setup Starting file operations for section
>>>wuauclt
>>>2008-05-21 18:46:36:515 2368 a3c Setup Successfully copied source file
>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuauclt.exe to
>>>C:\WINDOWS\system32\wuauclt.exe.wusetup.1843046.new
>>>2008-05-21 18:46:36:562 2368 a3c Setup Setup successfullly moved
>>>C:\WINDOWS\system32\wuauclt.exe.wusetup.1843046.new to
>>>C:\WINDOWS\system32\wuauclt.exe
>>>2008-05-21 18:46:36:562 2368 a3c Setup File operations for section wuauclt
>>>completed successfully
>>>2008-05-21 18:46:36:578 2368 a3c Setup Starting file operations for section
>>>wuaucpl
>>>2008-05-21 18:46:36:796 2368 a3c Setup Successfully copied source file
>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuaucpl.cpl to
>>>C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843359.new
>>>2008-05-21 18:46:36:875 2368 a3c Setup Setup successfullly moved
>>>C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843359.new to
>>>C:\WINDOWS\system32\wuaucpl.cpl
>>>2008-05-21 18:46:36:875 2368 a3c Setup File operations for section wuaucpl
>>>completed successfully
>>>2008-05-21 18:46:36:890 2368 a3c Setup Starting file operations for section
>>>wuaueng_WebSetup
>>>2008-05-21 18:46:37:375 2368 a3c Setup Successfully copied source file
>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuaueng.dll to
>>>C:\WINDOWS\system32\wuaueng.dll.wusetup.1843937.new
>>>2008-05-21 18:46:37:437 2368 a3c Setup Setup successfullly moved
>>>C:\WINDOWS\system32\wuaueng.dll.wusetup.1843937.new to
>>>C:\WINDOWS\system32\wuaueng.dll
>>>2008-05-21 18:46:37:437 2368 a3c Setup File operations for section
>>>wuaueng_WebSetup completed successfully
>>>2008-05-21 18:46:37:453 2368 a3c Setup Starting file operations for section
>>>wucltui
>>>2008-05-21 18:46:37:640 2368 a3c Setup Successfully copied source file
>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wucltui.dll to
>>>C:\WINDOWS\system32\wucltui.dll.wusetup.1844203.new
>>>2008-05-21 18:46:37:765 2368 a3c Setup Setup successfullly moved
>>>C:\WINDOWS\system32\wucltui.dll.wusetup.1844203.new to
>>>C:\WINDOWS\system32\wucltui.dll
>>>2008-05-21 18:46:38:531 2368 a3c Setup Successfully copied source file
>>>C:\WINDOWS\SoftwareDistribution\WebSetup\en\wuau.adm to
>>>C:\WINDOWS\INF\wuau.adm.wusetup.1845109.new
>>>2008-05-21 18:46:38:562 2368 a3c Setup Setup successfullly moved
>>>C:\WINDOWS\INF\wuau.adm.wusetup.1845109.new to C:\WINDOWS\INF\wuau.adm
>>>2008-05-21 18:46:38:562 2368 a3c Setup File operations for section wucltui
>>>completed successfully
>>>2008-05-21 18:46:38:578 2368 a3c Setup Starting file operations for section
>>>wups
>>>2008-05-21 18:46:38:703 2368 a3c Setup Successfully copied source file
>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wups.dll to
>>>C:\WINDOWS\system32\wups.dll.wusetup.1845265.new
>>>2008-05-21 18:46:38:765 2368 a3c Setup File operations for section wups
>>>completed successfully
>>>2008-05-21 18:46:38:765 2368 a3c Setup Starting registry operations for
>>>section wuapi
>>>2008-05-21 18:46:38:781 2368 a3c Setup Completed registration operations for
>>>section wuapi: status 0
>>>2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
>>>section wuauclt
>>>2008-05-21 18:46:38:796 2368 a3c Setup Completed registration operations for
>>>section wuauclt: status 0
>>>2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
>>>section wuaucpl
>>>2008-05-21 18:46:38:796 2368 a3c Setup Completed registration operations for
>>>section wuaucpl: status 0
>>>2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
>>>section wuaueng_WebSetup
>>>2008-05-21 18:46:38:812 2368 a3c Misc Registering binary:
>>>C:\WINDOWS\system32\regsvr32.exe /s "C:\WINDOWS\system32\wuaueng.dll"
>>>2008-05-21 18:46:44:593 2368 a3c Setup Completed registration operations for
>>>section wuaueng_WebSetup: status 0
>>>2008-05-21 18:46:44:609 2368 a3c Setup Starting registry operations for
>>>section wucltui
>>>2008-05-21 18:46:44:609 2368 a3c Misc Registering binary:
>>>C:\WINDOWS\system32\regsvr32.exe /s "C:\WINDOWS\system32\wucltui.dll"
>>>2008-05-21 18:46:45:562 2368 a3c Setup Completed registration operations for
>>>section wucltui: status 0
>>>2008-05-21 18:46:45:578 2368 a3c Setup Starting registry operations for
>>>section wups
>>>2008-05-21 18:46:45:578 2368 a3c Setup Completed registration operations for
>>>section wups: status 0
>>>2008-05-21 18:46:45:578 2368 a3c Setup Processing registry operations
>>>completed. Deleting backup files.
>>>2008-05-21 18:46:45:578 2368 a3c Setup Successfully deleted backup file
>>>C:\WINDOWS\system32\wuauclt.exe.wusetup.1843109.bak
>>>2008-05-21 18:46:45:593 2368 a3c Setup Successfully deleted backup file
>>>C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843390.bak
>>>2008-05-21 18:46:45:593 2368 a3c Setup Successfully deleted backup file
>>>C:\WINDOWS\system32\wuaueng.dll.wusetup.1843968.bak
>>>2008-05-21 18:46:45:609 2368 a3c Setup Successfully deleted backup file
>>>C:\WINDOWS\system32\wucltui.dll.wusetup.1844234.bak
>>>2008-05-21 18:46:45:609 2368 a3c Setup Successfully deleted backup file
>>>C:\WINDOWS\INF\wuau.adm.wusetup.1845125.bak
>>>2008-05-21 18:46:45:625 2368 a3c Setup FATAL: Warning: Failed to restart
>>>wuauserv service: 0x80070422
>>>2008-05-21 18:46:45:625 2368 a3c Setup * WARNING: Exit code = 0x80070422
>>>2008-05-21 18:46:45:625 2368 a3c Setup *********
>>>2008-05-21 18:46:45:625 2368 a3c Setup ** END ** Setup: Installing client
>>>binaries
>>>2008-05-21 18:46:45:625 2368 a3c Setup *************
>>>2008-05-21 18:46:45:625 2368 a3c Setup FATAL: InstallUpdatedBinaries failed
>>>with error 0x80070422
>>>2008-05-21 18:46:45:625 2368 a3c WUWeb FATAL: InstallUpdatedBinaries failed
>>>with error:0x80070422
>>>2008-05-21 18:46:45:625 2368 a3c WUWeb FATAL: UpdateClientWorker failed:
>>>error 0x80070422
>>>
>>>Any help is greatly appreciated!
>>
 
Hi to all,

I am facing the exact same problems.
The automatic updates don't start and I have the error 1058!

I downloaded the Superantispyware and I scanned my disc and I had a lot of
malware.

But I reboot the PC in order to fully remove them.

The windows cannot load properly and I had to choose the last state when the
system operated properly in order the windows to start.

As as result, the vundo-malware remain in my computer and I cannot get rid
of the problem.

Could someone please help me with that.

Thank you in advance.






"MowGreen [MVP]" wrote:

> Good to hear, Bill. Nice detective work ! It would behoove you to post
> to a reputable anti-malware just to ensure that Vundo did not bring
> along any uninvited guests.
>
> Please read the guidelines of the forum of your choice prior to posting
> there:
>
> http://aumha.org/downloads/hijackthis.zip
> http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Merijn
> http://www.bleepingcomputer.com/forums/index.php?showtutorial=42 -
> another tutorial
> http://aumha.net/ - Click on the HijackThis forum. Read the announcement
> and the stickies *first*.
> http://www.atribune.org/forums/index.php?showforum=9
> http://aumha.net/viewforum.php?f=30
> http://www.bleepingcomputer.com/forums/forum22.html
> http://castlecops.com/forum67.html
> http://www.dslreports.com/forum/cleanup
> http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
> http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
> http://gladiator-antivirus.com/forum/index.php?showforum=170
> http://spywarewarrior.com/viewforum.php?f=5
> http://forums.techguy.org/54-security/
> http://forums.tomcoyote.org/
>
>
> MowGreen [MVP 2003-2008]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
> Bill Ball wrote:
>
> > It turned out to be malware. I could see it with Hijack This. There were
> > two unknown BHOs loading. I tried a pile of utilities to remove it (Spybot
> > Search and Destroy, Combofix, Panda, Avast, etc.) and none were successful
> > until I ran Superantispyware.
> > http://www.superantispyware.com/
> >
> > Here is what it found and eliminated.
> >
> > Trojan.Vundo-Variant/Small-GEN
> > C:\WINDOWS\SYSTEM32\CBXNDTML.DLL
> > C:\WINDOWS\SYSTEM32\CBXNDTML.DLL
> >
> > Trojan.Vundo-Variant/Small
> > HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
> > Objects\{09A78B33-C7F6-465D-9CCA-98D5B98B78CB}
> > HKCR\CLSID\{09A78B33-C7F6-465D-9CCA-98D5B98B78CB}
> > HKCR\CLSID\{09A78B33-C7F6-465D-9CCA-98D5B98B78CB}\InprocServer32
> > HKCR\CLSID\{09A78B33-C7F6-465D-9CCA-98D5B98B78CB}\InprocServer32#ThreadingModel
> > HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{09A78B33-C7F6-465D-9CCA-98D5B98B78CB}
> > Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\cbXNDTml
> >
> > Everything is working now.
> >
> > "MowGreen [MVP]" wrote:
> >
> >
> >>Is BITS set to at least Manual for startup type ?
> >>Is RPC set to Automatic ?
> >>
> >>Reinstalling the AU client is the last step. If there's malware present
> >>then reinstalling the AU client will be useless as the malware will
> >>corrupt/damage it again.
> >>
> >>Please try to update manually by clicking the Windows Update link on the
> >>Start Menu or, open IE, and click Tools, Windows Update.
> >>If updating fails, post the *last* 50 lines or so of the
> >>WindowsUpdate.log located in WINDOWS.
> >>
> >>
> >>MowGreen [MVP 2003-2008]
> >>===============
> >> *-343-* FDNY
> >>Never Forgotten
> >>===============
> >>
> >>
> >>
> >>Bill Ball wrote:
> >>
> >>
> >>>I just developed this problem today. Unfortunately even this last procedure
> >>>did not correct the 1058 error. I will try it again.
> >>>
> >>>Bill
> >>>
> >>>"MowGreen [MVP]" wrote:
> >>>
> >>>
> >>>
> >>>>Procedure to manually Re-install Automatic Update Client
> >>>>http://www.wsuswiki.com/ProceduretomanuallyRe-InstallAutomaticUpdateClient
> >>>>
> >>>>MowGreen [MVP 2003-2008]
> >>>>===============
> >>>> *-343-* FDNY
> >>>>Never Forgotten
> >>>>===============
> >>>>
> >>>>
> >>>>redhoward wrote:
> >>>>
> >>>>
> >>>>
> >>>>>Good Afternoon MowGreen,
> >>>>>
> >>>>>Thank you for responding to my post!
> >>>>>
> >>>>>I have registered all of the files below in the command prompt and all have
> >>>>>been accepted with the exception of "net start wuauserv". The command prompt
> >>>>>displays the Error 1058 again even after I go through the entire procedure.
> >>>>>To the best of my knowledge, I have turned every service in the services list
> >>>>>to "automatic" and double checked that the Logon User Profiles are all
> >>>>>"Enabled". The only one left is that darn "Automatic Updates" that will not
> >>>>>change from "Disabled".
> >>>>>
> >>>>>Is there any way to restore or reload the service directly or circumvent
> >>>>>that darn 1058 error?
> >>>>>
> >>>>>Thanks again for helping me out!
> >>>>>
> >>>>>Adam
> >>>>>
> >>>>>"MowGreen [MVP]" wrote:
> >>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>>>Is Remote Procedural Call (RPC) also set to Automatic on startup ?
> >>>>>>If yes, then try registering these files from a Command Prompt.
> >>>>>>Type in each command exactly as written, *press Enter* after each one:
> >>>>>>
> >>>>>>Start > Run > type in
> >>>>>>
> >>>>>>cmd
> >>>>>>net stop wuauserv
> >>>>>>regsvr32 atl.dll
> >>>>>>regsvr32 wuapi.dll
> >>>>>>regsvr32 wuaueng.dll
> >>>>>>regsvr32 wuaueng1.dll,
> >>>>>>regsvr32 wucltui.dll
> >>>>>>regsvr32 wups.dll
> >>>>>>regsvr32 wups2.dll
> >>>>>>regsvr32 msxml3.dll
> >>>>>>regsvr32 qmgr.dll
> >>>>>>regsvr32 qmgrprxy.dll
> >>>>>>net start wuauserv
> >>>>>>exit
> >>>>>>
> >>>>>>See if AU can be started now. You can copy&paste the commands into the
> >>>>>>Command Prompt window by *right* clicking right after the prompt and
> >>>>>>choosing Paste after you've Copied them.
> >>>>>>
> >>>>>>MowGreen [MVP 2003-2008]
> >>>>>>===============
> >>>>>>*-343-* FDNY
> >>>>>>Never Forgotten
> >>>>>>===============
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>redhoward wrote:
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>I am having trouble turning on Automatic Updates. I have been into the
> >>>>>>>service menu, checked the properties for Automatic Updates and when I try to
> >>>>>>>change Startup Type to Automatic, I get "Error 1058: The service cannot
> >>>>>>>started, either because it is disabled or because it has no enabled devices
> >>>>>>>associated with it." Both the BIT and Event Log are set to Automatic and
> >>>>>>>running properly.
> >>>>>>>
> >>>>>>>Because of this problem with Automatic Update I am unable to download any
> >>>>>>>updates from the Microsoft Update website (I get Error number: 0x8DDD0018).
> >>>>>>>Does anyone know how I can get Automatic Updates running again?
> >>>>>>>
> >>>>>>>Thanks,
> >>>>>>>
> >>>>>>>Adam
> >>>>>>
>
 
Suggest you post to a reputable anti-malware to receive assistance in
removing Vundo.

Please read the guidelines of the forum of your choice prior to posting
there:

http://aumha.org/downloads/hijackthis.zip
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Merijn
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42 -
another tutorial
http://aumha.net/ - Click on the HijackThis forum. Read the announcement
and the stickies *first*.
http://www.atribune.org/forums/index.php?showforum=9
http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://spywarewarrior.com/viewforum.php?f=5
http://forums.techguy.org/54-security/
http://forums.tomcoyote.org/


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



Vasilis wrote:
> Hi to all,
>
> I am facing the exact same problems.
> The automatic updates don't start and I have the error 1058!
>
> I downloaded the Superantispyware and I scanned my disc and I had a lot of
> malware.
>
> But I reboot the PC in order to fully remove them.
>
> The windows cannot load properly and I had to choose the last state when the
> system operated properly in order the windows to start.
>
> As as result, the vundo-malware remain in my computer and I cannot get rid
> of the problem.
>
> Could someone please help me with that.
>
> Thank you in advance.
>
>
>
>
>
>
> "MowGreen [MVP]" wrote:
>
>
>>Good to hear, Bill. Nice detective work ! It would behoove you to post
>>to a reputable anti-malware just to ensure that Vundo did not bring
>>along any uninvited guests.
>>
>>Please read the guidelines of the forum of your choice prior to posting
>>there:
>>
>>http://aumha.org/downloads/hijackthis.zip
>>http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Merijn
>>http://www.bleepingcomputer.com/forums/index.php?showtutorial=42 -
>>another tutorial
>>http://aumha.net/ - Click on the HijackThis forum. Read the announcement
>>and the stickies *first*.
>>http://www.atribune.org/forums/index.php?showforum=9
>>http://aumha.net/viewforum.php?f=30
>>http://www.bleepingcomputer.com/forums/forum22.html
>>http://castlecops.com/forum67.html
>>http://www.dslreports.com/forum/cleanup
>>http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
>>http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
>>http://gladiator-antivirus.com/forum/index.php?showforum=170
>>http://spywarewarrior.com/viewforum.php?f=5
>>http://forums.techguy.org/54-security/
>>http://forums.tomcoyote.org/
>>
>>
>>MowGreen [MVP 2003-2008]
>>===============
>> *-343-* FDNY
>>Never Forgotten
>>===============
>>
>>
>>Bill Ball wrote:
>>
>>
>>>It turned out to be malware. I could see it with Hijack This. There were
>>>two unknown BHOs loading. I tried a pile of utilities to remove it (Spybot
>>>Search and Destroy, Combofix, Panda, Avast, etc.) and none were successful
>>>until I ran Superantispyware.
>>>http://www.superantispyware.com/
>>>
>>>Here is what it found and eliminated.
>>>
>>>Trojan.Vundo-Variant/Small-GEN
>>> C:\WINDOWS\SYSTEM32\CBXNDTML.DLL
>>> C:\WINDOWS\SYSTEM32\CBXNDTML.DLL
>>>
>>>Trojan.Vundo-Variant/Small
>>> HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
>>>Objects\{09A78B33-C7F6-465D-9CCA-98D5B98B78CB}
>>> HKCR\CLSID\{09A78B33-C7F6-465D-9CCA-98D5B98B78CB}
>>> HKCR\CLSID\{09A78B33-C7F6-465D-9CCA-98D5B98B78CB}\InprocServer32
>>> HKCR\CLSID\{09A78B33-C7F6-465D-9CCA-98D5B98B78CB}\InprocServer32#ThreadingModel
>>> HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{09A78B33-C7F6-465D-9CCA-98D5B98B78CB}
>>> Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\cbXNDTml
>>>
>>>Everything is working now.
>>>
>>>"MowGreen [MVP]" wrote:
>>>
>>>
>>>
>>>>Is BITS set to at least Manual for startup type ?
>>>>Is RPC set to Automatic ?
>>>>
>>>>Reinstalling the AU client is the last step. If there's malware present
>>>>then reinstalling the AU client will be useless as the malware will
>>>>corrupt/damage it again.
>>>>
>>>>Please try to update manually by clicking the Windows Update link on the
>>>>Start Menu or, open IE, and click Tools, Windows Update.
>>>>If updating fails, post the *last* 50 lines or so of the
>>>>WindowsUpdate.log located in WINDOWS.
>>>>
>>>>
>>>>MowGreen [MVP 2003-2008]
>>>>===============
>>>> *-343-* FDNY
>>>>Never Forgotten
>>>>===============
>>>>
>>>>
>>>>
>>>>Bill Ball wrote:
>>>>
>>>>
>>>>
>>>>>I just developed this problem today. Unfortunately even this last procedure
>>>>>did not correct the 1058 error. I will try it again.
>>>>>
>>>>>Bill
>>>>>
>>>>>"MowGreen [MVP]" wrote:
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>>Procedure to manually Re-install Automatic Update Client
>>>>>>http://www.wsuswiki.com/ProceduretomanuallyRe-InstallAutomaticUpdateClient
>>>>>>
>>>>>>MowGreen [MVP 2003-2008]
>>>>>>===============
>>>>>>*-343-* FDNY
>>>>>>Never Forgotten
>>>>>>===============
>>>>>>
>>>>>>
>>>>>>redhoward wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>>Good Afternoon MowGreen,
>>>>>>>
>>>>>>>Thank you for responding to my post!
>>>>>>>
>>>>>>>I have registered all of the files below in the command prompt and all have
>>>>>>>been accepted with the exception of "net start wuauserv". The command prompt
>>>>>>>displays the Error 1058 again even after I go through the entire procedure.
>>>>>>>To the best of my knowledge, I have turned every service in the services list
>>>>>>>to "automatic" and double checked that the Logon User Profiles are all
>>>>>>>"Enabled". The only one left is that darn "Automatic Updates" that will not
>>>>>>>change from "Disabled".
>>>>>>>
>>>>>>>Is there any way to restore or reload the service directly or circumvent
>>>>>>>that darn 1058 error?
>>>>>>>
>>>>>>>Thanks again for helping me out!
>>>>>>>
>>>>>>>Adam
>>>>>>>
>>>>>>>"MowGreen [MVP]" wrote:
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>>Is Remote Procedural Call (RPC) also set to Automatic on startup ?
>>>>>>>>If yes, then try registering these files from a Command Prompt.
>>>>>>>>Type in each command exactly as written, *press Enter* after each one:
>>>>>>>>
>>>>>>>>Start > Run > type in
>>>>>>>>
>>>>>>>>cmd
>>>>>>>>net stop wuauserv
>>>>>>>>regsvr32 atl.dll
>>>>>>>>regsvr32 wuapi.dll
>>>>>>>>regsvr32 wuaueng.dll
>>>>>>>>regsvr32 wuaueng1.dll,
>>>>>>>>regsvr32 wucltui.dll
>>>>>>>>regsvr32 wups.dll
>>>>>>>>regsvr32 wups2.dll
>>>>>>>>regsvr32 msxml3.dll
>>>>>>>>regsvr32 qmgr.dll
>>>>>>>>regsvr32 qmgrprxy.dll
>>>>>>>>net start wuauserv
>>>>>>>>exit
>>>>>>>>
>>>>>>>>See if AU can be started now. You can copy&paste the commands into the
>>>>>>>>Command Prompt window by *right* clicking right after the prompt and
>>>>>>>>choosing Paste after you've Copied them.
>>>>>>>>
>>>>>>>>MowGreen [MVP 2003-2008]
>>>>>>>>===============
>>>>>>>>*-343-* FDNY
>>>>>>>>Never Forgotten
>>>>>>>>===============
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>redhoward wrote:
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>>I am having trouble turning on Automatic Updates. I have been into the
>>>>>>>>>service menu, checked the properties for Automatic Updates and when I try to
>>>>>>>>>change Startup Type to Automatic, I get "Error 1058: The service cannot
>>>>>>>>>started, either because it is disabled or because it has no enabled devices
>>>>>>>>>associated with it." Both the BIT and Event Log are set to Automatic and
>>>>>>>>>running properly.
>>>>>>>>>
>>>>>>>>>Because of this problem with Automatic Update I am unable to download any
>>>>>>>>>updates from the Microsoft Update website (I get Error number: 0x8DDD0018).
>>>>>>>>>Does anyone know how I can get Automatic Updates running again?
>>>>>>>>>
>>>>>>>>>Thanks,
>>>>>>>>>
>>>>>>>>>Adam
>>>>>>>>
 
Reinstall the Windows Update Agent according to the steps laid out here:
http://www.bleepingcomputer.com/blogs/mowgreen/index.php?showentry=1172


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============


aras wrote:

>
> "MowGreen [MVP]" wrote:
>
>
>>Is Remote Procedural Call (RPC) also set to Automatic on startup ?
>>If yes, then try registering these files from a Command Prompt.
>>Type in each command exactly as written, *press Enter* after each one:
>>
>>Start > Run > type in
>>
>>cmd
>>net stop wuauserv
>>regsvr32 atl.dll
>>regsvr32 wuapi.dll
>>regsvr32 wuaueng.dll
>>regsvr32 wuaueng1.dll,
>>regsvr32 wucltui.dll
>>regsvr32 wups.dll
>>regsvr32 wups2.dll
>>regsvr32 msxml3.dll
>>regsvr32 qmgr.dll
>>regsvr32 qmgrprxy.dll
>>net start wuauserv
>>exit
>>
>>See if AU can be started now. You can copy&paste the commands into the
>>Command Prompt window by *right* clicking right after the prompt and
>>choosing Paste after you've Copied them.
>>
>>MowGreen [MVP 2003-2008]
>>===============
>> *-343-* FDNY
>>Never Forgotten
>>===============
>>
>>
>>
>>redhoward wrote:
>>
>>
>>>I am having trouble turning on Automatic Updates. I have been into the
>>>service menu, checked the properties for Automatic Updates and when I try to
>>>change Startup Type to Automatic, I get "Error 1058: The service cannot
>>>started, either because it is disabled or because it has no enabled devices
>>>associated with it." Both the BIT and Event Log are set to Automatic and
>>>running properly.
>>>
>>>Because of this problem with Automatic Update I am unable to download any
>>>updates from the Microsoft Update website (I get Error number: 0x8DDD0018).
>>>Does anyone know how I can get Automatic Updates running again?
>>>
>>>Thanks,
>>>
>>>Adam
>>
>>LOadLibrary("wuaueng1.dll,") failed - The specified module could not be found. I get this , what i have to do?
 
Mow,
I was away for the weekend and just saw your reply. As I have been dealing
with this for almost a week now I decided to try another route. I re-formated
my hard drive and re-installed Windows. It was kind od a pain to have to
re-install all of my programs, but at least I know that everthing is fresh
now. I really appreciate all of your help. It was just easier for me this way.

"MowGreen [MVP]" wrote:

> Either McAfee or malware is preventing the operation from being carried
> out. The only way you can determine which is the culprit is to rule out
> one or the other first.
> You state that the system was infected with a virus but it was cleaned
> up by Spyware Doctor. One would assume that McAfee would have cleaned up
> the virus as that's one of it's functions ... an antivirus.
> Spyware Doctor is not an antivirus.
>
> Suggest you first ensure that the system is totally free of malware.
> If you've already done that, then either system files have been damaged
> beyond use by the malware or McAfee is the cause of the file replacement
> issue.
>
> Consult McAfee's User Guide or web site to learn how to completely
> disable *all* of Security Center's protections. This includes all
> running services, script blockers, site blockers, etc.
> Learn how the firewall can be disabled and how to enable the native
> Windows firewall.
>
> After learning the above, disconnect from the network prior to enabling
> the Windows firewall.
> Then see if the system can successfully update.
>
> If not, we'll have elimnated malware and McAfee as the causes of the
> updating issue.
>
> Then we'll run a new tool to see if it can restore the system's ability
> to update successfully.
> Hang in there.
>
> MowGreen [MVP 2003-2008]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
>
>
> DCB wrote:
>
> > I am running McAfee Security Center
> > That is the antivirus program and firewall.
> > when I got the virus in the computer I loaded Spyware Doctor with a malware
> > program.
> > I have a home network setup in my house with 2 other computers on it. There
> > has been no problems with either of the other computers though.
> >
> > "MowGreen [MVP]" wrote:
> >
> >
> >>2008-05-21 18:46:35:890 2368 a3c Setup WARNING: Could not move
> >>C:\WINDOWS\system32\wuapi.dll to
> >>C:\WINDOWS\system32\wuapi.dll.wusetup.1842453.bak due to 0x80070020
> >>
> >>Some 'thing' is interfering with the above operation.
> >>
> >>What is the installed antivirus\security suite and/or anti-malware
> >>software ?
> >>[ An older Version of Spybot is the cause of the 0x80070020 error when
> >>TeaTimer is enabled ]
> >>
> >>Which firewall is being used ?
> >>Is the system on a network ?
> >>
> >>You receive a "0x80070020 The process cannot access the file because it
> >>is being used by another process" error message when you try to download
> >>an update from Windows Update
> >>http://support.microsoft.com/kb/883825
> >>
> >>MowGreen [MVP 2003-2008]
> >>===============
> >> *-343-* FDNY
> >>Never Forgotten
> >>===============
> >>
> >>
> >>DCB wrote:
> >>
> >>
> >>>Yes the 1058 error occurs after I change the setting to autoatic, then I try
> >>>to start it and I get the 1058 error. I am not sure what you mean by post the
> >>>last 50 or so lines. I am not sure where to find the log to copy and paste
> >>>the lines. Is this what you meant?:
> >>>
> >>>2008-05-21 18:46:35:453 2368 a3c Setup ** START ** Setup: Installing client
> >>>binaries
> >>>2008-05-21 18:46:35:453 2368 a3c Setup *********
> >>>2008-05-21 18:46:35:453 2368 a3c Setup * Download directory:
> >>>C:\WINDOWS\SoftwareDistribution\WebSetup
> >>>2008-05-21 18:46:35:453 2368 a3c Setup * Stop and start service: Yes
> >>>2008-05-21 18:46:35:531 2368 a3c Setup Starting file operations for section
> >>>wuapi
> >>>2008-05-21 18:46:35:859 2368 a3c Setup Successfully copied source file
> >>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuapi.dll to
> >>>C:\WINDOWS\system32\wuapi.dll.wusetup.1842406.new
> >>>2008-05-21 18:46:35:890 2368 a3c Setup WARNING: Could not move
> >>>C:\WINDOWS\system32\wuapi.dll to
> >>>C:\WINDOWS\system32\wuapi.dll.wusetup.1842453.bak due to 0x80070020
> >>>2008-05-21 18:46:36:203 2368 a3c Setup File operations for section wuapi
> >>>completed successfully
> >>>2008-05-21 18:46:36:218 2368 a3c Setup Starting file operations for section
> >>>wuauclt
> >>>2008-05-21 18:46:36:515 2368 a3c Setup Successfully copied source file
> >>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuauclt.exe to
> >>>C:\WINDOWS\system32\wuauclt.exe.wusetup.1843046.new
> >>>2008-05-21 18:46:36:562 2368 a3c Setup Setup successfullly moved
> >>>C:\WINDOWS\system32\wuauclt.exe.wusetup.1843046.new to
> >>>C:\WINDOWS\system32\wuauclt.exe
> >>>2008-05-21 18:46:36:562 2368 a3c Setup File operations for section wuauclt
> >>>completed successfully
> >>>2008-05-21 18:46:36:578 2368 a3c Setup Starting file operations for section
> >>>wuaucpl
> >>>2008-05-21 18:46:36:796 2368 a3c Setup Successfully copied source file
> >>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuaucpl.cpl to
> >>>C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843359.new
> >>>2008-05-21 18:46:36:875 2368 a3c Setup Setup successfullly moved
> >>>C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843359.new to
> >>>C:\WINDOWS\system32\wuaucpl.cpl
> >>>2008-05-21 18:46:36:875 2368 a3c Setup File operations for section wuaucpl
> >>>completed successfully
> >>>2008-05-21 18:46:36:890 2368 a3c Setup Starting file operations for section
> >>>wuaueng_WebSetup
> >>>2008-05-21 18:46:37:375 2368 a3c Setup Successfully copied source file
> >>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuaueng.dll to
> >>>C:\WINDOWS\system32\wuaueng.dll.wusetup.1843937.new
> >>>2008-05-21 18:46:37:437 2368 a3c Setup Setup successfullly moved
> >>>C:\WINDOWS\system32\wuaueng.dll.wusetup.1843937.new to
> >>>C:\WINDOWS\system32\wuaueng.dll
> >>>2008-05-21 18:46:37:437 2368 a3c Setup File operations for section
> >>>wuaueng_WebSetup completed successfully
> >>>2008-05-21 18:46:37:453 2368 a3c Setup Starting file operations for section
> >>>wucltui
> >>>2008-05-21 18:46:37:640 2368 a3c Setup Successfully copied source file
> >>>C:\WINDOWS\SoftwareDistribution\WebSetup\wucltui.dll to
> >>>C:\WINDOWS\system32\wucltui.dll.wusetup.1844203.new
> >>>2008-05-21 18:46:37:765 2368 a3c Setup Setup successfullly moved
> >>>C:\WINDOWS\system32\wucltui.dll.wusetup.1844203.new to
> >>>C:\WINDOWS\system32\wucltui.dll
> >>>2008-05-21 18:46:38:531 2368 a3c Setup Successfully copied source file
> >>>C:\WINDOWS\SoftwareDistribution\WebSetup\en\wuau.adm to
> >>>C:\WINDOWS\INF\wuau.adm.wusetup.1845109.new
> >>>2008-05-21 18:46:38:562 2368 a3c Setup Setup successfullly moved
> >>>C:\WINDOWS\INF\wuau.adm.wusetup.1845109.new to C:\WINDOWS\INF\wuau.adm
> >>>2008-05-21 18:46:38:562 2368 a3c Setup File operations for section wucltui
> >>>completed successfully
> >>>2008-05-21 18:46:38:578 2368 a3c Setup Starting file operations for section
> >>>wups
> >>>2008-05-21 18:46:38:703 2368 a3c Setup Successfully copied source file
> >>>C:\WINDOWS\SoftwareDistribution\WebSetup\wups.dll to
> >>>C:\WINDOWS\system32\wups.dll.wusetup.1845265.new
> >>>2008-05-21 18:46:38:765 2368 a3c Setup File operations for section wups
> >>>completed successfully
> >>>2008-05-21 18:46:38:765 2368 a3c Setup Starting registry operations for
> >>>section wuapi
> >>>2008-05-21 18:46:38:781 2368 a3c Setup Completed registration operations for
> >>>section wuapi: status 0
> >>>2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
> >>>section wuauclt
> >>>2008-05-21 18:46:38:796 2368 a3c Setup Completed registration operations for
> >>>section wuauclt: status 0
> >>>2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
> >>>section wuaucpl
> >>>2008-05-21 18:46:38:796 2368 a3c Setup Completed registration operations for
> >>>section wuaucpl: status 0
> >>>2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
> >>>section wuaueng_WebSetup
> >>>2008-05-21 18:46:38:812 2368 a3c Misc Registering binary:
> >>>C:\WINDOWS\system32\regsvr32.exe /s "C:\WINDOWS\system32\wuaueng.dll"
> >>>2008-05-21 18:46:44:593 2368 a3c Setup Completed registration operations for
> >>>section wuaueng_WebSetup: status 0
> >>>2008-05-21 18:46:44:609 2368 a3c Setup Starting registry operations for
> >>>section wucltui
> >>>2008-05-21 18:46:44:609 2368 a3c Misc Registering binary:
> >>>C:\WINDOWS\system32\regsvr32.exe /s "C:\WINDOWS\system32\wucltui.dll"
> >>>2008-05-21 18:46:45:562 2368 a3c Setup Completed registration operations for
> >>>section wucltui: status 0
> >>>2008-05-21 18:46:45:578 2368 a3c Setup Starting registry operations for
> >>>section wups
> >>>2008-05-21 18:46:45:578 2368 a3c Setup Completed registration operations for
> >>>section wups: status 0
> >>>2008-05-21 18:46:45:578 2368 a3c Setup Processing registry operations
> >>>completed. Deleting backup files.
> >>>2008-05-21 18:46:45:578 2368 a3c Setup Successfully deleted backup file
> >>>C:\WINDOWS\system32\wuauclt.exe.wusetup.1843109.bak
> >>>2008-05-21 18:46:45:593 2368 a3c Setup Successfully deleted backup file
> >>>C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843390.bak
> >>>2008-05-21 18:46:45:593 2368 a3c Setup Successfully deleted backup file
> >>>C:\WINDOWS\system32\wuaueng.dll.wusetup.1843968.bak
> >>>2008-05-21 18:46:45:609 2368 a3c Setup Successfully deleted backup file
> >>>C:\WINDOWS\system32\wucltui.dll.wusetup.1844234.bak
> >>>2008-05-21 18:46:45:609 2368 a3c Setup Successfully deleted backup file
> >>>C:\WINDOWS\INF\wuau.adm.wusetup.1845125.bak
> >>>2008-05-21 18:46:45:625 2368 a3c Setup FATAL: Warning: Failed to restart
> >>>wuauserv service: 0x80070422
> >>>2008-05-21 18:46:45:625 2368 a3c Setup * WARNING: Exit code = 0x80070422
> >>>2008-05-21 18:46:45:625 2368 a3c Setup *********
> >>>2008-05-21 18:46:45:625 2368 a3c Setup ** END ** Setup: Installing client
> >>>binaries
> >>>2008-05-21 18:46:45:625 2368 a3c Setup *************
> >>>2008-05-21 18:46:45:625 2368 a3c Setup FATAL: InstallUpdatedBinaries failed
> >>>with error 0x80070422
> >>>2008-05-21 18:46:45:625 2368 a3c WUWeb FATAL: InstallUpdatedBinaries failed
> >>>with error:0x80070422
> >>>2008-05-21 18:46:45:625 2368 a3c WUWeb FATAL: UpdateClientWorker failed:
> >>>error 0x80070422
> >>>
> >>>Any help is greatly appreciated!
> >>
>
 
No problemo, DCB. You've done the right thing, as painful as it was.
If it all possible, suggest you steer clear of security suites as they
tend to get nothing right while attempting to do everything.


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============


DCB wrote:

> Mow,
> I was away for the weekend and just saw your reply. As I have been dealing
> with this for almost a week now I decided to try another route. I re-formated
> my hard drive and re-installed Windows. It was kind od a pain to have to
> re-install all of my programs, but at least I know that everthing is fresh
> now. I really appreciate all of your help. It was just easier for me this way.
>
> "MowGreen [MVP]" wrote:
>
>
>>Either McAfee or malware is preventing the operation from being carried
>>out. The only way you can determine which is the culprit is to rule out
>>one or the other first.
>>You state that the system was infected with a virus but it was cleaned
>>up by Spyware Doctor. One would assume that McAfee would have cleaned up
>>the virus as that's one of it's functions ... an antivirus.
>>Spyware Doctor is not an antivirus.
>>
>>Suggest you first ensure that the system is totally free of malware.
>>If you've already done that, then either system files have been damaged
>>beyond use by the malware or McAfee is the cause of the file replacement
>>issue.
>>
>>Consult McAfee's User Guide or web site to learn how to completely
>>disable *all* of Security Center's protections. This includes all
>>running services, script blockers, site blockers, etc.
>>Learn how the firewall can be disabled and how to enable the native
>>Windows firewall.
>>
>>After learning the above, disconnect from the network prior to enabling
>>the Windows firewall.
>>Then see if the system can successfully update.
>>
>>If not, we'll have elimnated malware and McAfee as the causes of the
>>updating issue.
>>
>>Then we'll run a new tool to see if it can restore the system's ability
>>to update successfully.
>>Hang in there.
>>
>>MowGreen [MVP 2003-2008]
>>===============
>> *-343-* FDNY
>>Never Forgotten
>>===============
>>
>>
>>
>>
>>DCB wrote:
>>
>>
>>>I am running McAfee Security Center
>>>That is the antivirus program and firewall.
>>> when I got the virus in the computer I loaded Spyware Doctor with a malware
>>>program.
>>>I have a home network setup in my house with 2 other computers on it. There
>>>has been no problems with either of the other computers though.
>>>
>>>"MowGreen [MVP]" wrote:
>>>
>>>
>>>
>>>>2008-05-21 18:46:35:890 2368 a3c Setup WARNING: Could not move
>>>>C:\WINDOWS\system32\wuapi.dll to
>>>>C:\WINDOWS\system32\wuapi.dll.wusetup.1842453.bak due to 0x80070020
>>>>
>>>>Some 'thing' is interfering with the above operation.
>>>>
>>>>What is the installed antivirus\security suite and/or anti-malware
>>>>software ?
>>>>[ An older Version of Spybot is the cause of the 0x80070020 error when
>>>>TeaTimer is enabled ]
>>>>
>>>>Which firewall is being used ?
>>>>Is the system on a network ?
>>>>
>>>>You receive a "0x80070020 The process cannot access the file because it
>>>>is being used by another process" error message when you try to download
>>>>an update from Windows Update
>>>>http://support.microsoft.com/kb/883825
>>>>
>>>>MowGreen [MVP 2003-2008]
>>>>===============
>>>> *-343-* FDNY
>>>>Never Forgotten
>>>>===============
>>>>
>>>>
>>>>DCB wrote:
>>>>
>>>>
>>>>
>>>>>Yes the 1058 error occurs after I change the setting to autoatic, then I try
>>>>>to start it and I get the 1058 error. I am not sure what you mean by post the
>>>>>last 50 or so lines. I am not sure where to find the log to copy and paste
>>>>>the lines. Is this what you meant?:
>>>>>
>>>>>2008-05-21 18:46:35:453 2368 a3c Setup ** START ** Setup: Installing client
>>>>>binaries
>>>>>2008-05-21 18:46:35:453 2368 a3c Setup *********
>>>>>2008-05-21 18:46:35:453 2368 a3c Setup * Download directory:
>>>>>C:\WINDOWS\SoftwareDistribution\WebSetup
>>>>>2008-05-21 18:46:35:453 2368 a3c Setup * Stop and start service: Yes
>>>>>2008-05-21 18:46:35:531 2368 a3c Setup Starting file operations for section
>>>>>wuapi
>>>>>2008-05-21 18:46:35:859 2368 a3c Setup Successfully copied source file
>>>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuapi.dll to
>>>>>C:\WINDOWS\system32\wuapi.dll.wusetup.1842406.new
>>>>>2008-05-21 18:46:35:890 2368 a3c Setup WARNING: Could not move
>>>>>C:\WINDOWS\system32\wuapi.dll to
>>>>>C:\WINDOWS\system32\wuapi.dll.wusetup.1842453.bak due to 0x80070020
>>>>>2008-05-21 18:46:36:203 2368 a3c Setup File operations for section wuapi
>>>>>completed successfully
>>>>>2008-05-21 18:46:36:218 2368 a3c Setup Starting file operations for section
>>>>>wuauclt
>>>>>2008-05-21 18:46:36:515 2368 a3c Setup Successfully copied source file
>>>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuauclt.exe to
>>>>>C:\WINDOWS\system32\wuauclt.exe.wusetup.1843046.new
>>>>>2008-05-21 18:46:36:562 2368 a3c Setup Setup successfullly moved
>>>>>C:\WINDOWS\system32\wuauclt.exe.wusetup.1843046.new to
>>>>>C:\WINDOWS\system32\wuauclt.exe
>>>>>2008-05-21 18:46:36:562 2368 a3c Setup File operations for section wuauclt
>>>>>completed successfully
>>>>>2008-05-21 18:46:36:578 2368 a3c Setup Starting file operations for section
>>>>>wuaucpl
>>>>>2008-05-21 18:46:36:796 2368 a3c Setup Successfully copied source file
>>>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuaucpl.cpl to
>>>>>C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843359.new
>>>>>2008-05-21 18:46:36:875 2368 a3c Setup Setup successfullly moved
>>>>>C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843359.new to
>>>>>C:\WINDOWS\system32\wuaucpl.cpl
>>>>>2008-05-21 18:46:36:875 2368 a3c Setup File operations for section wuaucpl
>>>>>completed successfully
>>>>>2008-05-21 18:46:36:890 2368 a3c Setup Starting file operations for section
>>>>>wuaueng_WebSetup
>>>>>2008-05-21 18:46:37:375 2368 a3c Setup Successfully copied source file
>>>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wuaueng.dll to
>>>>>C:\WINDOWS\system32\wuaueng.dll.wusetup.1843937.new
>>>>>2008-05-21 18:46:37:437 2368 a3c Setup Setup successfullly moved
>>>>>C:\WINDOWS\system32\wuaueng.dll.wusetup.1843937.new to
>>>>>C:\WINDOWS\system32\wuaueng.dll
>>>>>2008-05-21 18:46:37:437 2368 a3c Setup File operations for section
>>>>>wuaueng_WebSetup completed successfully
>>>>>2008-05-21 18:46:37:453 2368 a3c Setup Starting file operations for section
>>>>>wucltui
>>>>>2008-05-21 18:46:37:640 2368 a3c Setup Successfully copied source file
>>>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wucltui.dll to
>>>>>C:\WINDOWS\system32\wucltui.dll.wusetup.1844203.new
>>>>>2008-05-21 18:46:37:765 2368 a3c Setup Setup successfullly moved
>>>>>C:\WINDOWS\system32\wucltui.dll.wusetup.1844203.new to
>>>>>C:\WINDOWS\system32\wucltui.dll
>>>>>2008-05-21 18:46:38:531 2368 a3c Setup Successfully copied source file
>>>>>C:\WINDOWS\SoftwareDistribution\WebSetup\en\wuau.adm to
>>>>>C:\WINDOWS\INF\wuau.adm.wusetup.1845109.new
>>>>>2008-05-21 18:46:38:562 2368 a3c Setup Setup successfullly moved
>>>>>C:\WINDOWS\INF\wuau.adm.wusetup.1845109.new to C:\WINDOWS\INF\wuau.adm
>>>>>2008-05-21 18:46:38:562 2368 a3c Setup File operations for section wucltui
>>>>>completed successfully
>>>>>2008-05-21 18:46:38:578 2368 a3c Setup Starting file operations for section
>>>>>wups
>>>>>2008-05-21 18:46:38:703 2368 a3c Setup Successfully copied source file
>>>>>C:\WINDOWS\SoftwareDistribution\WebSetup\wups.dll to
>>>>>C:\WINDOWS\system32\wups.dll.wusetup.1845265.new
>>>>>2008-05-21 18:46:38:765 2368 a3c Setup File operations for section wups
>>>>>completed successfully
>>>>>2008-05-21 18:46:38:765 2368 a3c Setup Starting registry operations for
>>>>>section wuapi
>>>>>2008-05-21 18:46:38:781 2368 a3c Setup Completed registration operations for
>>>>>section wuapi: status 0
>>>>>2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
>>>>>section wuauclt
>>>>>2008-05-21 18:46:38:796 2368 a3c Setup Completed registration operations for
>>>>>section wuauclt: status 0
>>>>>2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
>>>>>section wuaucpl
>>>>>2008-05-21 18:46:38:796 2368 a3c Setup Completed registration operations for
>>>>>section wuaucpl: status 0
>>>>>2008-05-21 18:46:38:796 2368 a3c Setup Starting registry operations for
>>>>>section wuaueng_WebSetup
>>>>>2008-05-21 18:46:38:812 2368 a3c Misc Registering binary:
>>>>>C:\WINDOWS\system32\regsvr32.exe /s "C:\WINDOWS\system32\wuaueng.dll"
>>>>>2008-05-21 18:46:44:593 2368 a3c Setup Completed registration operations for
>>>>>section wuaueng_WebSetup: status 0
>>>>>2008-05-21 18:46:44:609 2368 a3c Setup Starting registry operations for
>>>>>section wucltui
>>>>>2008-05-21 18:46:44:609 2368 a3c Misc Registering binary:
>>>>>C:\WINDOWS\system32\regsvr32.exe /s "C:\WINDOWS\system32\wucltui.dll"
>>>>>2008-05-21 18:46:45:562 2368 a3c Setup Completed registration operations for
>>>>>section wucltui: status 0
>>>>>2008-05-21 18:46:45:578 2368 a3c Setup Starting registry operations for
>>>>>section wups
>>>>>2008-05-21 18:46:45:578 2368 a3c Setup Completed registration operations for
>>>>>section wups: status 0
>>>>>2008-05-21 18:46:45:578 2368 a3c Setup Processing registry operations
>>>>>completed. Deleting backup files.
>>>>>2008-05-21 18:46:45:578 2368 a3c Setup Successfully deleted backup file
>>>>>C:\WINDOWS\system32\wuauclt.exe.wusetup.1843109.bak
>>>>>2008-05-21 18:46:45:593 2368 a3c Setup Successfully deleted backup file
>>>>>C:\WINDOWS\system32\wuaucpl.cpl.wusetup.1843390.bak
>>>>>2008-05-21 18:46:45:593 2368 a3c Setup Successfully deleted backup file
>>>>>C:\WINDOWS\system32\wuaueng.dll.wusetup.1843968.bak
>>>>>2008-05-21 18:46:45:609 2368 a3c Setup Successfully deleted backup file
>>>>>C:\WINDOWS\system32\wucltui.dll.wusetup.1844234.bak
>>>>>2008-05-21 18:46:45:609 2368 a3c Setup Successfully deleted backup file
>>>>>C:\WINDOWS\INF\wuau.adm.wusetup.1845125.bak
>>>>>2008-05-21 18:46:45:625 2368 a3c Setup FATAL: Warning: Failed to restart
>>>>>wuauserv service: 0x80070422
>>>>>2008-05-21 18:46:45:625 2368 a3c Setup * WARNING: Exit code = 0x80070422
>>>>>2008-05-21 18:46:45:625 2368 a3c Setup *********
>>>>>2008-05-21 18:46:45:625 2368 a3c Setup ** END ** Setup: Installing client
>>>>>binaries
>>>>>2008-05-21 18:46:45:625 2368 a3c Setup *************
>>>>>2008-05-21 18:46:45:625 2368 a3c Setup FATAL: InstallUpdatedBinaries failed
>>>>>with error 0x80070422
>>>>>2008-05-21 18:46:45:625 2368 a3c WUWeb FATAL: InstallUpdatedBinaries failed
>>>>>with error:0x80070422
>>>>>2008-05-21 18:46:45:625 2368 a3c WUWeb FATAL: UpdateClientWorker failed:
>>>>>error 0x80070422
>>>>>
>>>>>Any help is greatly appreciated!
>>>>
 
I am having the same problem, have you gotten any responses on how to resolve
this issue. Please let me know.
--
GaryN.


"redhoward" wrote:

> I am having trouble turning on Automatic Updates. I have been into the
> service menu, checked the properties for Automatic Updates and when I try to
> change Startup Type to Automatic, I get "Error 1058: The service cannot
> started, either because it is disabled or because it has no enabled devices
> associated with it." Both the BIT and Event Log are set to Automatic and
> running properly.
>
> Because of this problem with Automatic Update I am unable to download any
> updates from the Microsoft Update website (I get Error number: 0x8DDD0018).
> Does anyone know how I can get Automatic Updates running again?
>
> Thanks,
>
> Adam
 
GaryNestor@msn.com wrote:

> I am having the same problem, have you gotten any responses on how to resolve
> this issue. Please let me know.

Gary,

Please read this: Using Web-based Newsreaders
http://support.microsoft.com/default.aspx?pr=newswhelp&style=toc#usenewsweb

There are several response, you just haven't seen them. You will after
reading the ' Reading Messages ' section. <w>


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============
 
download freeware Avast! virus scanner. I spent a week trying to fix it and
this works. After running it turn on your Automatic Updates
jim

"GaryNestor@msn.com" wrote:

> I am having the same problem, have you gotten any responses on how to resolve
> this issue. Please let me know.
> --
> GaryN.
>
>
> "redhoward" wrote:
>
> > I am having trouble turning on Automatic Updates. I have been into the
> > service menu, checked the properties for Automatic Updates and when I try to
> > change Startup Type to Automatic, I get "Error 1058: The service cannot
> > started, either because it is disabled or because it has no enabled devices
> > associated with it." Both the BIT and Event Log are set to Automatic and
> > running properly.
> >
> > Because of this problem with Automatic Update I am unable to download any
> > updates from the Microsoft Update website (I get Error number: 0x8DDD0018).
> > Does anyone know how I can get Automatic Updates running again?
> >
> > Thanks,
> >
> > Adam
 
Yes. There are many options but in my experience of this problem, the
start point must be to ensure that you are not infected and in
particular with the win32/Vundo.gen!H virus. That will turn off
automatic updates for microsoft and probably your antivirus package. If
you av shows no infection, download, install and run the free Onecare
scanner from Microsoft. If that shows you are infected, then report back
here for further instructions or use Onecare 90 day trial to eliminate
virus. If you have no virus, report here for further instructions to
reset or redownload auto


--
cliveg
Posted via http://www.vistaheads.com
 
Back
Top