Windows Update Service Disabled - Error 80070422

Question

Hi,
On Windows Vista Ultimate SP1, when I go to Windows Update I see a "Check For Updates" button. When I click it I get an 80070422 error and "Try Again" button which does not work.
I have tried all that is explained in Help on this error, but it's still not working. Let me write in more detail: I opened "Administrative Tools", went to "Services", "Windows Update" service is disabled. I set the "Startup Type" to "Automatic", click on Apply and then I click the "Start" button to start the service. I get an error: 1058: "Windows could not start the Windows Update service on Local Computer", "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it".
I downloaded "WindowsUpdateAgent30-x86.exe" and installed it, hoping that the problem will be fixed, but no luck.
I read somewhere on this forum that a user faced a similar problem and searched in "Windows\System32" for "wu*.*" files and changed the security settings for all of them to allow SYSTEM and Administrators full control and re-registered through "regsvr32" all of the .dll files, but, after doing all of these I still had no luck.
My Windows Update still displays the error 80070422 and when I try to start the Windows Update service I get the error that the service cannot be started and it always sets itself on "Disabled", no matter what I do.
Could someone please help me with this problem? I really don't know what else to do.

Answer 1

Wow, great!
I ran the tool that you mentioned and the virus in question was detected as: Trojan.Vundo
Maybe the logs will help some others, too: Here's the log on the first scan:
Malwarebytes' Anti-Malware 1.14
Database version: 808
8:40:22 PM 5/31/2008
mbam-log-5-31-2008 (20-40-22).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 169731
Time elapsed: 42 minute(s), 47 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 9
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 8
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\Windows\System32\byXOHaBU.dll (Trojan.Vundo) -> Unloaded module successfully.
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{1449fa3b-f8a5-40ec-87da-707e80637ddd} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1449fa3b-f8a5-40ec-87da-707e80637ddd} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{663656df-6bae-460c-a612-8133df519346} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{663656df-6bae-460c-a612-8133df519346} (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\byxohabu  -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Windows\System32\byXOHaBU.dll (Trojan.Vundo) -> Delete on reboot.
C:\Users\Shere Khan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LK0KREDB\kb516107[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\fccywwts.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\gEwtTLFy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\yayvSiHb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\_Shere_Quarantine\fmsnvygd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\byXnMghG.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\byXPfgfe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
Here's the log on the second scan, after a restart:
Malwarebytes' Anti-Malware 1.14
Database version: 808
9:48:01 PM 5/31/2008
mbam-log-5-31-2008 (21-48-01).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 168808
Time elapsed: 56 minute(s), 31 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Windows\System32\byXOHaBU.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\dqhreobq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
On the third scan, no other infections were found. The files and locations and one or two registry entries are similar to what I suspected was not allright, so I guess the (right) virus has been found and eliminated. Have enabled Java in FireFox and everything seems fine, haven't touched Internet Explorer just to be on the safe side so I can't say anything about that, but everything looks allright. Seems this was the problem. Thanks again, mate, your post was a life saver.