Re: Automatic Update: Access is Denied

> This seems to happen after I got some spywares, which I removed through
> scouring registries and cleaning offensive DLLs in system32 directory.

You've got (much) more work to do:

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/ma...e/default.mspx

2. Run this online scan (in safe mode w/networking, if need be):
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/...moving_Malware

**Post your logs to
http://spywarehammer.com/simplemachi...php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or another appropriate forum for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/de...spx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/


James wrote:
> (Windows XP Professional SP3)
> Apologize in advance for a long message.
>
> My Automatic Update is not running, even though "Automatic (recommended)"
> checkbox is selected in System Properties - Automatic Updates tab.
>
> After opening Services (services.msc), Automatic Updates's Description,
> Status and Startup Type columns are empty. "Log On As" value is Local
> System.
>
> When double clicking or right click -> select Properties on Automatic
> Updates in Services, I get this message,
> "Unable to open service Automatic Updates for reading on Local Computer.
> Error 5: Access is denied."
>
> When I go to Windows Update site and try installing updates manually
> (http://www.update.microsoft.com/wind....aspx?ln=en-us),
> I
> get "Error number: 0x80070005" during installation after download is
> complete.
>
> This seems to happen after I got some spywares, which I removed through
> scouring registries and cleaning offensive DLLs in system32 directory.
>
> According to many articles indicated, this is a permission problems with
> potential errors in registry. I tried a number of suggested fixes with no
> successful result,
>
> - Verified BITS is running
> - Verified I'm in Administrator group
> - Added Trace Flag in Windows registry
> - Stopped AdAware daemon. Cannot stop Norton however. But I was able to
> run Auto Updates before with Norton running
> - Run 2 commands as suggested in this article,
> http://www.eggheadcafe.com/software/...ll-record.aspx
> a) "sc sdset bits ..." returned SUCCESS
> b) "sc sdset wuauserv ..." returned "OpenService FAILED 5: Access is
> denied" - Install and run SubInACL tool to repair file and registry
> permissions
> (http://blogs.msdn.com/astebner/archi...04/739820.aspx)
> * finish successfully, but same Access error afterwards
> - Munually re-install Automatic Update client
> (http://msmvps.com/blogs/athif/pages/49608.aspx)
> * Browse C:\windows\ServicePackFiles\i386 where wuapi.dll is located.
> Restart the system. Same Access is Denied error
> - Any attempt to "net stop/start wuauserv" returns Access is Denied
>
> Random clues:
>
> %windir%\inf\wuau.adm
> ======================
> I notice in this file it uses,
> KEYNAME "Software\Policies\Microsoft\Windows\WindowsUpdate \AU"
> which is a path I don't have under HKLM, does this indicate a problem?
>
> %windir%\setupapi.log
> =====================
> #-290 Processing REGISTERDLLS section [AU_dlls]. Binary:
> "%11%\wuaueng.dll",
> flags: 0x0001, timeout: 60s.
> #E127 Calling "DllRegisterServer" in OLE Control
> "C:\WINDOWS\system32\wuaueng.dll" failed. Error 0x80070005: Access is
> denied. #E291 Failed to register OLE server
> "C:\WINDOWS\system32\wuaueng.dll". Error 0x80070005: Access is denied.
>
> %windir%\WindowsUpdate.log
> ==========================
> - I added a Trace flag in registry for WindowsUpdate
> (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wi ndowsUpdate\Trace,
> Flags=7, Level=4). Below is the log it generates during reboot.
> ------------------ 8< -----------------------
> 2009-02-06 11:52:47-0800 4708 16f4 OpenService failed with error
> 0x80070005
> 2009-02-06 11:52:47-0800 4708 16f4 WU client fail to create WU service
> with
> error 0x80070005
> 2009-02-06 11:53:20-0800 4080 248 OpenNamedService failed (0x80070005) for
> service "wuauserv", permissions = 0x00000004
> 2009-02-06 11:53:20-0800 4080 248 AU service is not running.
> 2009-02-06 11:53:20-0800 4080 248 WUCheckForUpdatesAtShutdown failed,
> hr=8024000C
> 2009-02-06 11:54:03-0800 1104 af8 AU service is not running.
> 2009-02-06 11:54:03-0800 1104 af8 WUAutoUpdateAtShutdown failed,
> hr=8024000C
<snip>