Windows Updata is being disabled

Every time I turn on my PC, windows update is disabled. I Enable it, but
within 5 minutes it is again disabled. I have searched the Microsoft and
mcAfee KB's and can't find anything. McAfee virus scan scan shows clean
system, and Microsoft Malicious Software Removal Program removed 4 files, but
that did not fix the problem.
--
M

Check the registry value for "UpdatesDisableNotify"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify"=dword:00000000


How to back up, edit, and restore the registry in Windows XP and Windows Server 2003
http://support.microsoft.com/kb/322756

Disclaimer: Modifying the registry can cause serious problems that may require you to
reinstall your operating system. Use the information provided at your own risk.



--

==================================
TaurArian [MS-MVP] 2005-2007 - Australia
==================================
http://www.dts-l.org/goodpost.htm
Need more help? http://support.microsoft.com/?scid=ph;en-us;6527
(Links to web pages and MSKB Articles are posted for the purposes of keeping the
information current)


"MFitz" <> wrote in message
news:1DCF28E7-A648-4A02-B076-...
| Every time I turn on my PC, windows update is disabled. I Enable it, but
| within 5 minutes it is again disabled. I have searched the Microsoft and
| mcAfee KB's and can't find anything. McAfee virus scan scan shows clean
| system, and Microsoft Malicious Software Removal Program removed 4 files, but
| that did not fix the problem.
| --
| M

Open the mrt.log located in the WINDOWS\debug folder.
Copy&paste the *last* entry, please. It will look something like:
------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v1.21, October 2006
Started On Wed Oct 11 09:14:27 2006

Results Summary:
----------------
No infection found.

Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Wed Oct 11
09:14:51 2006
-------------------------------------------------------------------------------------

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============


MFitz wrote:

> Every time I turn on my PC, windows update is disabled. I Enable it, but
> within 5 minutes it is again disabled. I have searched the Microsoft and
> mcAfee KB's and can't find anything. McAfee virus scan scan shows clean
> system, and Microsoft Malicious Software Removal Program removed 4 files, but
> that did not fix the problem.

My last entry was an extended scan which deleted 4 files, got a return code
of 6. Should I still do this copy and paste?
--
M


"MowGreen [MVP]" wrote:

> Open the mrt.log located in the WINDOWS\debug folder.
> Copy&paste the *last* entry, please. It will look something like:
> ------------------------------------------------------------------------------------
> Microsoft Windows Malicious Software Removal Tool v1.21, October 2006
> Started On Wed Oct 11 09:14:27 2006
>
> Results Summary:
> ----------------
> No infection found.
>
> Return code: 0
> Microsoft Windows Malicious Software Removal Tool Finished On Wed Oct 11
> 09:14:51 2006
> -------------------------------------------------------------------------------------
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
> MFitz wrote:
>
> > Every time I turn on my PC, windows update is disabled. I Enable it, but
> > within 5 minutes it is again disabled. I have searched the Microsoft and
> > mcAfee KB's and can't find anything. McAfee virus scan scan shows clean
> > system, and Microsoft Malicious Software Removal Program removed 4 files, but
> > that did not fix the problem.
>

My registry entry for "UpdatesDisableNotify" shows Reg_dword 0x000001 Is this
what it should be set to?
--
M


"TaurArian [MS-MVP]" wrote:

> Check the registry value for "UpdatesDisableNotify"
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
> "UpdatesDisableNotify"=dword:00000000
>
>
> How to back up, edit, and restore the registry in Windows XP and Windows Server 2003
> http://support.microsoft.com/kb/322756
>
> Disclaimer: Modifying the registry can cause serious problems that may require you to
> reinstall your operating system. Use the information provided at your own risk.
>
>
>
> --
>
> ==================================
> TaurArian [MS-MVP] 2005-2007 - Australia
> ==================================
> http://www.dts-l.org/goodpost.htm
> Need more help? http://support.microsoft.com/?scid=ph;en-us;6527
> (Links to web pages and MSKB Articles are posted for the purposes of keeping the
> information current)
>
>
> "MFitz" <> wrote in message
> news:1DCF28E7-A648-4A02-B076-...
> | Every time I turn on my PC, windows update is disabled. I Enable it, but
> | within 5 minutes it is again disabled. I have searched the Microsoft and
> | mcAfee KB's and can't find anything. McAfee virus scan scan shows clean
> | system, and Microsoft Malicious Software Removal Program removed 4 files, but
> | that did not fix the problem.
> | --
> | M
>
>
>

Change the 1 to a 0 (zero).
Exit registry, reboot if necessary.
Turn on WU and see if it stays on.

As always, make a back up of the key in case it gets mucked up for some unknown
reason.



--

==================================
TaurArian [MS-MVP] 2005-2007 - Australia
==================================
http://www.dts-l.org/goodpost.htm
Need more help? http://support.microsoft.com/?scid=ph;en-us;6527
(Links to web pages and MSKB Articles are posted for the purposes of keeping the
information current)


"MFitz" <> wrote in message
news:FF7AF871-1BAD-41EA-9698-...
| My registry entry for "UpdatesDisableNotify" shows Reg_dword 0x000001 Is this
| what it should be set to?
| --
| M
|
|
| "TaurArian [MS-MVP]" wrote:
|
| > Check the registry value for "UpdatesDisableNotify"
| >
| > [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
| > "UpdatesDisableNotify"=dword:00000000
| >
| >
| > How to back up, edit, and restore the registry in Windows XP and Windows Server
2003
| > http://support.microsoft.com/kb/322756
| >
| > Disclaimer: Modifying the registry can cause serious problems that may require
you to
| > reinstall your operating system. Use the information provided at your own risk.
| >
| >
| >
| > --
| >
| > ==================================
| > TaurArian [MS-MVP] 2005-2007 - Australia
| > ==================================
| > http://www.dts-l.org/goodpost.htm
| > Need more help? http://support.microsoft.com/?scid=ph;en-us;6527
| > (Links to web pages and MSKB Articles are posted for the purposes of keeping the
| > information current)
| >
| >
| > "MFitz" <> wrote in message
| > news:1DCF28E7-A648-4A02-B076-...
| > | Every time I turn on my PC, windows update is disabled. I Enable it, but
| > | within 5 minutes it is again disabled. I have searched the Microsoft and
| > | mcAfee KB's and can't find anything. McAfee virus scan scan shows clean
| > | system, and Microsoft Malicious Software Removal Program removed 4 files, but
| > | that did not fix the problem.
| > | --
| > | M
| >
| >
| >

If you've changed the registry setting that Taurarian posted and it does
NOT stay enabled, then please do. There's a strong chance that all of
the malicious files have *not* been removed. If I can see what files
were removed, hopefully, we can identify what infected the system.


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============


MFitz wrote:

> My last entry was an extended scan which deleted 4 files, got a return code
> of 6. Should I still do this copy and paste?

Does the log show text that contains the following ? -

> SE_UNCHANGED (-6)
>



MowGreen [MVP] wrote:
> If you've changed the registry setting that Taurarian posted and it does
> NOT stay enabled, then please do. There's a strong chance that all of
> the malicious files have *not* been removed. If I can see what files
> were removed, hopefully, we can identify what infected the system.
>
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
> MFitz wrote:
>
>> My last entry was an extended scan which deleted 4 files, got a return
>> code of 6. Should I still do this copy and paste?

No, here is what the log shows and thank you so much for trying to help :
__________________________________________________ _______________
Microsoft Windows Malicious Software Removal Tool v1.21, October 2006
Started On Wed Oct 11 09:16:50 2006

Extended Scan Results
----------------
Found virus: Backdoor:Win32/Hackdef!9932 in file "C:\ntp.exe"
Found virus: Backdoor:Win32/Hackdef!9932 in file "C:\Documents and
Settings\LocalService\Local Settings\Temporary Internet
Files\Content.IE5\NVH2GLZC\dtest1[1].exe"
Found virus: Backdoor:Win32/Hackdef!9932 in file "C:\System Volume
Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP167\A0038903.exe"
Found virus: Backdoor:Win32/Hackdef!9932 in file "C:\System Volume
Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP195\A0042053.exe"

Extended Scan Removal Results
----------------
Deleting file "C:\ntp.exe"
Operation succeeded !

Deleting file "C:\Documents and Settings\LocalService\Local
Settings\Temporary Internet Files\Content.IE5\NVH2GLZC\dtest1[1].exe"
Operation succeeded !

Deleting file "C:\System Volume
Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP167\A0038903.exe"
Operation succeeded !

Deleting file "C:\System Volume
Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP195\A0042053.exe"
Operation succeeded !


Results Summary:
----------------
Found Backdoor:Win32/Hackdef!9932 and Removed!

Return code: 6
Microsoft Windows Malicious Software Removal Tool Finished On Wed Oct 11
09:51:28 2006
--
M


"MowGreen [MVP]" wrote:

> Does the log show text that contains the following ? -
>
> > SE_UNCHANGED (-6)
> >
>
>
>
> MowGreen [MVP] wrote:
> > If you've changed the registry setting that Taurarian posted and it does
> > NOT stay enabled, then please do. There's a strong chance that all of
> > the malicious files have *not* been removed. If I can see what files
> > were removed, hopefully, we can identify what infected the system.
> >
> >
> > MowGreen [MVP 2003-2007]
> > ===============
> > *-343-* FDNY
> > Never Forgotten
> > ===============
> >
> >
> > MFitz wrote:
> >
> >> My last entry was an extended scan which deleted 4 files, got a return
> >> code of 6. Should I still do this copy and paste?
>

Thank you, I have done this and will keep checking on it.
--
M


"TaurArian [MS-MVP]" wrote:

> Change the 1 to a 0 (zero).
> Exit registry, reboot if necessary.
> Turn on WU and see if it stays on.
>
> As always, make a back up of the key in case it gets mucked up for some unknown
> reason.
>
>
>
> --
>
> ==================================
> TaurArian [MS-MVP] 2005-2007 - Australia
> ==================================
> http://www.dts-l.org/goodpost.htm
> Need more help? http://support.microsoft.com/?scid=ph;en-us;6527
> (Links to web pages and MSKB Articles are posted for the purposes of keeping the
> information current)
>
>
> "MFitz" <> wrote in message
> news:FF7AF871-1BAD-41EA-9698-...
> | My registry entry for "UpdatesDisableNotify" shows Reg_dword 0x000001 Is this
> | what it should be set to?
> | --
> | M
> |
> |
> | "TaurArian [MS-MVP]" wrote:
> |
> | > Check the registry value for "UpdatesDisableNotify"
> | >
> | > [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
> | > "UpdatesDisableNotify"=dword:00000000
> | >
> | >
> | > How to back up, edit, and restore the registry in Windows XP and Windows Server
> 2003
> | > http://support.microsoft.com/kb/322756
> | >
> | > Disclaimer: Modifying the registry can cause serious problems that may require
> you to
> | > reinstall your operating system. Use the information provided at your own risk.
> | >
> | >
> | >
> | > --
> | >
> | > ==================================
> | > TaurArian [MS-MVP] 2005-2007 - Australia
> | > ==================================
> | > http://www.dts-l.org/goodpost.htm
> | > Need more help? http://support.microsoft.com/?scid=ph;en-us;6527
> | > (Links to web pages and MSKB Articles are posted for the purposes of keeping the
> | > information current)
> | >
> | >
> | > "MFitz" <> wrote in message
> | > news:1DCF28E7-A648-4A02-B076-...
> | > | Every time I turn on my PC, windows update is disabled. I Enable it, but
> | > | within 5 minutes it is again disabled. I have searched the Microsoft and
> | > | mcAfee KB's and can't find anything. McAfee virus scan scan shows clean
> | > | system, and Microsoft Malicious Software Removal Program removed 4 files, but
> | > | that did not fix the problem.
> | > | --
> | > | M
> | >
> | >
> | >
>
>
>