RE: Windows Update Error (0x80070002) - SOLUTION FOUND

SOLUTION FOUND:
In my registry, the virus had replaced "%systemroot%" with "%fystemroot%"
in several spots, so the correct files could not be found. I did a search
for "fystemroot" in regedit, and replaced with "systemroot". (I did have to
click "Edit" / "Permissions" and allow full control in each of the folders
first. Evidently the virus disabled the permissions first.) I hope this
helps anyone else who has a similar issue.

"xwing" wrote:

> When trying to update my computer (Windows XP, SP2) with Windows Update, I
> recieve the "[Error number: 0x80070002] The website has encountered a
> problem and cannot display the page you are trying to view. The options
> provided below might help you solve the problem. " error.
>
> I believe this was a result of a virus I contracted last weekend. The virus
> brought many hitchhikers with it (Win32/Blarul, Win32/Koebface.gen!D,
> Win32/NewDotNet, W32.IRCBot, Trojan.Win32.Agent2.iwh,
> Backdoor.Win32.Agen.tzl, and more...) I was finally able to remove the virus
> from my computer using several scanners, including Windows Live OneCare,
> Symantec 9 (which I already had on my computer when it was infected),
> AdAware, Malwarebytes Anti-Malware, Windows Malicios Software Removal Tool,
> and several other one-off fixes. Now with several scans (both in "safe" mode
> and in Normal mode), I cannot find any trace of a virus. However,
> significant damage to my registry remains.
>
> I have already fixed several registry problems by comparing with a "known
> good" computer that had the same OS and hotfixes. I found that I could not
> open regedit (w/o renaming it) or many other programs b/c one of the viruses
> had added the "Debugger = ntsd -d" key to a large number of .exe files. I
> also found several virus-related entries in my "Run" section of the registry
> and removed them.
>
> Right now, the only problem I still have is that I cannot run WindowsUpdate.
> When I try to start Automatic Updates service manually, I receive “Error 2:
> The system cannot find the file specified.� My associated system log entries
> are � DCOM got error "The system cannot find the file specified. " attempting
> to start the service wuauserv with arguments "" in order to run the server:
> {E60687F7-01A1-40AA-86AC-DB1CBF673334}� and “The Automatic Updates service
> failed to start due to the following error:
> The system cannot find the file specified.�
>
> I have searched this forum and others, and tried all the fixes that were
> previously suggested.
> 1. Confirmed that my hardware profile is enabled
> (http://support.microsoft.com/kb/241584)
> 2. Ran Symantec's "FixVundo.exe"
> 3. Ran "WUFix.bat"
> 4. Checked "Group Policy" to confirm that Automatic Updates are not disable
> or restricted via policy. (http://support.microsoft.com/kb/896224)
> 5. Renamed all associated files in system32
> (http://support.microsoft.com/kb/931852)
> 6. Deleted software distribution directory
> (http://support.microsoft.com/kb/919749 and
> http://support.microsoft.com/kb/956698)
> 7. Set auto configuration (http://support.microsoft.com/kb/958043)
> 8. IE Browser changes (http://support.microsoft.com/kb/900936)
> 9. Re-register dll files (http://support.microsoft.com/kb/910359)
> 10. Clear BITS queue (http://support.microsoft.com/kb/958047)
>

Uh-huh...

xwing wrote:
> SOLUTION FOUND:
> In my registry, the virus had replaced "%systemroot%" with "%fystemroot%"
> in several spots, so the correct files could not be found. I did a search
> for "fystemroot" in regedit, and replaced with "systemroot". (I did have
> to
> click "Edit" / "Permissions" and allow full control in each of the folders
> first. Evidently the virus disabled the permissions first.) I hope this
> helps anyone else who has a similar issue.
>
> "xwing" wrote:
>
>> When trying to update my computer (Windows XP, SP2) with Windows Update,
>> I
>> recieve the "[Error number: 0x80070002] The website has encountered a
>> problem and cannot display the page you are trying to view. The options
>> provided below might help you solve the problem. " error.
>>
>> I believe this was a result of a virus I contracted last weekend. The
>> virus brought many hitchhikers with it (Win32/Blarul,
>> Win32/Koebface.gen!D,
>> Win32/NewDotNet, W32.IRCBot, Trojan.Win32.Agent2.iwh,
>> Backdoor.Win32.Agen.tzl, and more...) I was finally able to remove the
>> virus from my computer using several scanners, including Windows Live
>> OneCare, Symantec 9 (which I already had on my computer when it was
>> infected), AdAware, Malwarebytes Anti-Malware, Windows Malicios Software
>> Removal Tool, and several other one-off fixes. Now with several scans
>> (both in "safe" mode and in Normal mode), I cannot find any trace of a
>> virus. However, significant damage to my registry remains.
>>
>> I have already fixed several registry problems by comparing with a "known
>> good" computer that had the same OS and hotfixes. I found that I could
>> not
>> open regedit (w/o renaming it) or many other programs b/c one of the
>> viruses had added the "Debugger = ntsd -d" key to a large number of .exe
>> files. I also found several virus-related entries in my "Run" section of
>> the registry and removed them.
>>
>> Right now, the only problem I still have is that I cannot run
>> WindowsUpdate. When I try to start Automatic Updates service manually, I
>> receive “Error 2: The system cannot find the file specified.� My
>> associated system log entries are � DCOM got error "The system cannot
>> find
>> the file specified. " attempting to start the service wuauserv with
>> arguments "" in order to run the server:
>> {E60687F7-01A1-40AA-86AC-DB1CBF673334}� and “The Automatic Updates
>> service
>> failed to start due to the following error:
>> The system cannot find the file specified.�
>>
>> I have searched this forum and others, and tried all the fixes that were
>> previously suggested.
>> 1. Confirmed that my hardware profile is enabled
>> (http://support.microsoft.com/kb/241584)
>> 2. Ran Symantec's "FixVundo.exe"
>> 3. Ran "WUFix.bat"
>> 4. Checked "Group Policy" to confirm that Automatic Updates are not
>> disable or restricted via policy.
>> (http://support.microsoft.com/kb/896224)
>> 5. Renamed all associated files in system32
>> (http://support.microsoft.com/kb/931852)
>> 6. Deleted software distribution directory
>> (http://support.microsoft.com/kb/919749 and
>> http://support.microsoft.com/kb/956698)
>> 7. Set auto configuration (http://support.microsoft.com/kb/958043)
>> 8. IE Browser changes (http://support.microsoft.com/kb/900936)
>> 9. Re-register dll files (http://support.microsoft.com/kb/910359)
>> 10. Clear BITS queue (http://support.microsoft.com/kb/958047)

Thank You. This was what was exactly wrong with my computer. Great Work

Me too!
Had the ol' Microsoft cryptic error: "Contact your Administrator" (well.. I AM the Administrator), "0x8024D007", "0x80070002", etc. nothing worked not even the microsoft "FixIt" crap.

This did! Thanks!

More food for the widespread theory that Microsoft is actually a dark conspiracy to destroy the productivity of america...

Great work xwing that worked for XP too! I would like to note that to fix the permissions that were modified by the virus would suggest to click Advanced in the Permissions window, Remove any permission entries that show "<not inherited>", click the first check box labeled "Inherit from parent the permission entries...", click Apply then Ok and finally click Ok.

This should return the default windows permissions for this registry key instead of just adding Full Control to the Administrators group. The virus removed the following security groups from my permissions: Creator Owner, Power Users, System, Users

This worked on XPpro
Two weeks of losing my mind..Thank you Thank You