Question

Automatic Update Service will not start

Asked by: CCHSC

Hello,

I have a windows XP Home addition box (Bosses wife's) that became infected with the Vundo virus.  I was able to remove the virus however, there is one annoying problem.  I am unable to start the Automatic Update Service.  When I open the services console, the AU service is disabled.  I set it to automatic and apply it. I then try to start the service and receive the following error:

Error 1058:  The service could not be started, either because it is disabled or it has no enabled devices associated with it.

The service then reverts back to disabled.  I have confirmed that BITS is up and running normally, I can also stop and restart it with no problems.  
I have attempted to delete the AU service and reinstall.  I have used the following command to reinstall:
rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %systemroot%\inf\au.inf

I have tried reregistering the following files:
wuapi.dll
wuaueng.dll
wuaueng1.dll
wucltui.dll
wups.dll
wuweb.dll

As a last resort, I booted to the XP CD and ran a repair, nothing has corrected the problem.  I cannot begin to tell you how much I DO NOT want to wipe this computer out and start fresh.  Any help you can lend would be greatly appreciated.

Thank you,

Rich

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

  • Plus...
  • 30 Day FREE access, no risk, no obligation
  • Collaborate with the world's top tech experts
  • Unlimited access to our exclusive solution database
  • Never be left without tech help again

Subscribe Now

Asked On
2008-05-13 at 13:54:20ID23399444
Tags

Microsoft

,

Automatic Updates

,

Windows XP SP3

,

Error 1058

Topic

Windows XP Operating System

Participating Experts
13
Points
500
Comments
25

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

  • "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
  • "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
  • "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Screenshot of Experts Exchange Knowledgebase

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Screenshot of an Article

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Screenshot of Experts Exchange Knowledgebase

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Related Solutions

  1. rundll32.exe
    I had this problem with rundll32.exe, where everytime i logged off or shut down the computer, it would say that runndll32.exe wasn't resoponding and that i should end the program to shut down. I tried many ways to correct this, including getting a new copy of the rundll32.ex...
  2. How to Fix Trojan.Brisv.A!inf virus infected files?
    some of the file (*.wmv) affected with Trojan.Brisv.A!inf but Norton ask me to remove manually .Is the any way i can fix infected files using any technics? Pls let me know ............... thanks for consideration
  3. Display Properties DESKTOP Tab does not work - End Pro…
    XP Media Center, SP3 - when I click on the DESKTOP tab in Display Properties, it does not open, get Ebd Program - rundll32.exe program not responding error, I click on End Now, Run a DLL as an APP, you chose to end the nonresponsive programs, Run a DLL as an APP, tell Microso...

Free Tech Articles

  1. WARNING: 5 Reasons why you should NEVER fix a computer for free.
    It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
  2. SCCM OSD Basic troubleshooting
    SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
  3. Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
    This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
  4. Create a Win7 Gadget
    This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
  5. Outlook continually prompting for username and password
    There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
  6. Backup Exchange 2010 Information Store using Windows Backup
    There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

  1. Avoiding Bugs in Microsoft Access
    Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
  2. Top 10 Best New Features in Visio 2010
    Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
  3. IT Consultant Business Secrets Revealed
    Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
  4. Disaster Recovery and Business Continuity
    Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
  5. Organize Your Visio Diagrams with Containers and Lists
    Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
  6. How to Us Objects, Properties, Events and Methods in Microsoft Access
    Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

 

by: David-HowardPosted on 2008-05-13 at 14:02:42ID: 21559262

Maybe you could give this a try.
http://support.microsoft.com/kb/896224
I would also recommend running SFC SCANNOW. It won't take long and it might just correct the issue. You'll need your OS CD.
To do this simply go to the Run box on the Start Menu and type in:
sfc /scannow
This command will initiate the Windows File Protection service  to scan all protected files and verify their integrity, replacing any files with which it finds a problem.
David

 

by: paulop1975Posted on 2008-05-13 at 14:04:47ID: 21559286

Try one of these two solutions: (I believe you already tried the first one, but no completely)

#### 1st Option - Repair Automatic Updates System ####
Copy the text below in to a new notepad document and save it as repair.cmd. Double click on the file to run it.

net stop bits
net stop /s wuauserv
%windir%\system32\regsvr32.exe /s %windir%\system32\atl.dll
%windir%\system32\regsvr32.exe /s %windir%\system32\jscript.dll
%windir%\system32\regsvr32.exe /s %windir%\system32\msxml3.dll
%windir%\system32\regsvr32.exe /s %windir%\system32\softpub.dll
%windir%\system32\regsvr32.exe /s %windir%\system32\wuapi.dll
%windir%\system32\regsvr32.exe /s %windir%\system32\wuaueng.dll
%windir%\system32\regsvr32.exe /s %windir%\system32\wuaueng1.dll
%windir%\system32\regsvr32.exe /s %windir%\system32\wucltui.dll
%windir%\system32\regsvr32.exe /s %windir%\system32\wups.dll
%windir%\system32\regsvr32.exe /s %windir%\system32\wuweb.dll
net start bits
net start wuauserv
wuauclt /resetauthorization /detectnow

#### 2nd Option - Remove and Reinstall of Automatic Updates ####
Copy the text below in to a new notepad document and save it as reinstall.cmd. Double click on the file to run it.

net stop bits
net stop /s wuauserv
regsvr32 /u wuaueng.dll /s
del /f /s /q %windir%\SoftwareDistribution\*.*
del /f /s /q %windir%\windowsupdate.log
regsvr32 wuaueng.dll /s
net start bits
net start wuauserv
wuauclt.exe /resetauthorization /detectnow

Hope this works.
Cheers,
PP

 

by: orangutangPosted on 2008-05-13 at 14:24:14ID: 21559406

Also, have you checked your event viewer for any related errors? If you don't know how, open your start menu, click "Run...", type "eventvwr.msc", press Enter, go to the "System" section, look for events with a red circle and a white X in the middle, double-click them, and check their descriptions for anything that might have to do with your problem.

 

by: CCHSCPosted on 2008-05-13 at 14:57:11ID: 21559661

I have run the sfc.exe /scannow command as Dave suggested and as far as I can tell it did not find any errors.  I ran option 1  that Paul suggested and it gave the same error in the cmd screen as i noted in the original message.  It them came up and said: "Configuration Manager: A required entry in the Registry is missing or an attempt to write to the Registry failed".  Then, "The system cannot find the file specified".  I ran option 2 with the same results.

 

by: CCHSCPosted on 2008-05-13 at 14:59:17ID: 21559680

I checked the error logs and found the following DCOM errors:

Event Type:      Error
Event Source:      DCOM
Event Category:      None
Event ID:      10005
Date:            5/13/2008
Time:            3:52:51 PM
User:            ********
Computer:      *******
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service wuauserv with arguments "" in order to run the server:
{9B1F122C-2982-4E91-AA8B-E071D54F2A4D}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I am also now receiving a BITS error:

Event Type:      Error
Event Source:      BITS
Event Category:      None
Event ID:      16391
Date:            5/13/2008
Time:            5:58:31 PM
User:            N/A
Computer:      **********
Description:
The BITS job list is not in a recognized format.  It may have been created by a different version of BITS.  The job list has been cleared.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

by: David-HowardPosted on 2008-05-13 at 15:17:14ID: 21559786

Thanks for the great update. I'm wondering if you have attempted any type of OS repair?
It appears from your last post that there is an issue with a required Registry file.
If you choose the Repair option, this link can help walk you through the procedure. Note: A Repair does NOT overwrite/reformat your hard drive. However, you should take all precautions as it relates to any data that you deem important.
http://www.michaelstevenstech.com/XPrepairinstall.htm

 

by: orangutangPosted on 2008-05-13 at 17:14:52ID: 21560326

You can also try running:
rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\WINDOWS\inf\qmgr.inf

 

by: CCHSCPosted on 2008-05-14 at 06:24:56ID: 21563854

I did try to repair windows earlier with no luck.  I also tried the running the qmgr.inf command line as suggested by orangutang, no luck.

 

by: David-HowardPosted on 2008-05-14 at 10:45:36ID: 21566747

At this point I would either attempt a parallel installation (with screen shots)
http://www.windowsxphome.windowsreinstall.com/installxpcdparallell/index.htm
or copy the user data to CD/DVD and perform a new installation. I know that you dread that later. But, if it is my system and I've had a virus issue and now this issue and none of the suggestions are working I'm starting from scratch.
Reinstall:
http://www.michaelstevenstech.com/cleanxpinstall.html
Again, if you can copy her data off you should have the system up and running better than ever in under four hours. That would include the OS load, XPSP2 installation, profile load, etc. You can save some time if you have SP2 on CD.
David

 

by: ryanarakPosted on 2008-05-14 at 21:09:54ID: 21570613

I'm currently fixing a client's computer with the same exact problem.  Looking at the date of this post, it seems to be an issue with a recently released version of Vundo or something similar.  This is definitely not good news.  I'm glad I found this and will definitely keep this post updated if and when I find a fix.

 

by: ryanarakPosted on 2008-05-15 at 13:02:18ID: 21577460

Nobody has any updates?  This is really bugging me.  I'm about to just perform a re-install.  I would like to get to the bottom of this but I cannot let this computer sit while I search for days on end.  Here's to a fix!

 

by: CCHSCPosted on 2008-05-15 at 13:12:02ID: 21577536

Sorry Ryan, got tied up with other things at work.  The boss became inpatient and I had to perform a fresh install.  I could not get anything to work.  

 

by: CCHSCPosted on 2008-05-15 at 13:14:05ID: 31457623

Hope this can problem can be rectified in the future without having to do a fresh install.  Thanks for you help though!

 

by: ryanarakPosted on 2008-05-15 at 13:32:24ID: 21577712

No problem.  I guess I'll do the same.  It sucks that we can't figure it out.  I'm sure it's a registry key or something of that sort that has been deleted due to the spyware removal.  Thanks though!

 

by: raindavePosted on 2008-05-15 at 14:14:17ID: 21578030

Same issue on coworker machine, all started with the malwarrior trojan/virus

 

by: pctechiePosted on 2008-05-21 at 08:07:15ID: 21615856

FIXED
I have just spent about 14 hours fixing this problem on a client computer that had been infected with a lot of spyware, including virtumonde. I tried every fix on the net and ran sweeps with AVG 8.0, Spysweeper, Superantispyware and Counterspy. I was about to give up until i discovered an internet explorer plugin that i could not disable or remove because it would just re.enable or reinstall itself. The file is pmnKHYQh.dll in the Windows\system32 folder. I tried to remove it with Killbox but to no avail, even with the kill on reboot option. I got rid of it by booting with Erd Commander and deleting it. I'm sure you could do the same with the revovery console.
After i did this i enabled Automatic updates, started the service and immediately started updates.
Hope this helps someone.
Will

 

by: jsmidPosted on 2008-05-22 at 09:57:17ID: 21625595

To Will:
Just want to say a huge THANKS!! Your info helped save me a reload and lots of frustration! I checked IE add-ons and found a dll file that could not be disabled. My file was named rqRLcYPF.dll and after booting with ERD and deleting it, I too was then able to start automatic update service!
Thanks again for your info!
Jamie

 

by: MMarlin7Posted on 2008-06-04 at 10:05:31ID: 21711993

My issues started with an install and subsequent attempts to uninstall Zango. I then, thanks to this thread, also found a IE addin that can't be disabled. It's name is ygnfnvhw.dll. But i can't find ERD Commander in the sysinternals suite i just now downloaded from
http://technet.microsoft.com/en-us/sysinternals/0e18b180-9b7a-4c49-8120-c47c5a693683.aspx
Where can i get "ERD"?

 

by: RAMCITPosted on 2008-06-24 at 10:46:40ID: 21858320

Please excuse me for not understanding your technical jargon but can someone please tell me what is ERD Commander?

 

by: bidittPosted on 2008-07-07 at 20:58:45ID: 21950772

Thank you all...you saved me a ton of time trying to figure this one out.  For the record, my problem file was "rqRJBUVT.dll".  Solved with the ERD trick.

 

by: bidittPosted on 2008-07-07 at 20:59:11ID: 21950776

Thank you all...you saved me a ton of time trying to figure this one out.  For the record, my problem file was "rqRJBUVT.dll".  Solved with the ERD trick.

 

by: bidittPosted on 2008-07-07 at 20:59:13ID: 21950777

Thank you all...you saved me a ton of time trying to figure this one out.  For the record, my problem file was "rqRJBUVT.dll".  Solved with the ERD trick.

 

by: kadluongPosted on 2009-05-30 at 15:27:16ID: 24510572

Virtumonde is a nasty, nasty trojan/spyware.  How it got there may have been because of a foolish click on a malicious website.  
To ceck and see if your computers are infected by Virtumonde, go to regedit and search for the Run dir under these places:
-HKCU\Software\Microsoft\Windows\CurrentVersion
-HKLM\Software\Mcrosoft\Windows\CurrentVersion
-HKUsers\Default (and other users, e.g. S-1-5-18....)\Software\Microsoft\Windows\CurrentVersion

In these Run directories, you will find strange dlls and exe file names that start strange services that cause these problems everyone has been describing.  These names morph, so you most likely will not have the same dll names as mentioned earlier.  As you try to remove these entries from the registry, some will reappear if you hit F5 (refresh).
You can try to remove them in safe mode and they will do the same.  The trick is to break up their hooks, then delete them.  Two products have done this for me in the past, Windows Defender and MalwareBytes.  Both are free from their respective websites.  Once these spyware remover utilities find and delete as many files as they could, you may have to do some manual clean up.  Scanning more than once (after rebooting) is always a good thing.  Also, disable system restore so these files wont come back after you've deleted and rebooted the system.  

To manually clean out these files, go to the System32 folder and make sure hidden files are visible and their extensions are displayed.  Sort by filetypes, and pay attention to .exe files and dll files.  hidden exe and dll files are greyed-out (or at least the icons appear lighter in color than non-hidden files when you view using the details style).  THese files are the "hooks"  and services that cause problems.  make s list of these files, move them somewhere else, then search the registry for these files.  I've deleted them all, but I made notes of the dates of these files to clue in on the infection date(s).  
After mannual deletion, you'll find that deleting suspicious entries in the registry is now possible without reappearance. After a successful cleaning, reenable system restore if you wish.

Hope this helps also!!!
 

 

by: tongPosted on 2009-10-10 at 05:16:33ID: 25541997

In my registry, the virus had replaced "%systemroot%" with "%fystemroot%"
in several spots, so the correct files could not be found. I did a search
for "fystemroot" in regedit, and replaced with "systemroot". (I did have to
click "Edit" / "Permissions" and allow full control in each of the folders
first. Evidently the virus disabled the permissions first.) I hope this
helps anyone else who has a similar issue.

 

by: AngloPosted on 2010-06-11 at 08:06:06ID: 32970955

Just had a similar problem as a result of conficker.c infection.  MS msrt removed it and applied 958644 which then fixed the problem.

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...