I recently had a client’s laptop in here to troubleshoot some problems they were having. It was infested with viruses so I wasn’t surprised that it was acting up on them. Using Malwarebytes’ Anti-Malware and ComboFix I was able to successfully clean the system, but what do you do after the viruses have been removed and the system still isn’t working right? They may be gone, but they already did their damage!
After removing the viruses I wanted to run a Windows Update to make sure it was all up-to-date. As soon as it came up though I knew there was a problem. It had the red shield there it had a message reading something like “You should run Windows Update regularly to keep the system updated.” As soon as I clicked the “Check for Updates” button it came back with error 0x80096001, and a pop-up came on the screen reading “Windows Update cannot currently check for updates because the service is not running. You may need to restart your computer.” I checked to make sure that the Background Intelligent Transfer Service (BITS) and Windows Update services were both started, and they were.
Consequently, I had also just downloaded and installed the Microsoft Security Essentials anti-virus program, and although that installed without a problem, checking for definition updates manually also gave an error and wasn’t able to complete. It was able to download a definition update automatically on its own though, but wouldn’t work when clicking the “Update Now” button.
I had seen a problem very similar to this before, but that was after re-imaging a failing hard drive onto a new hard drive. For that there was a quick and simple fix of installing the Intel® Rapid Storage Technology driver. After that Windows Update was working again. Unfortunately that didn’t work this time around. I guess that would have been too simple.
The next thing I did was to run Microsoft’s Fixit program for Windows Update. I figured Windows Update is a Microsoft program, so who else but Microsoft would know the best way to Fixit. This is supposed to fix the most common problems with Windows Update, but apparently this problem isn’t that common because that didn’t help either. It did say that Windows Update needed to be repaired, and at the end of the wizard it said that it fixed it, but trying Windows Update again just gave the same 80096001 error message. There are steps on the Fixit page (link above) that you can follow if you want to try repairing it manually too. So I followed those steps and did everything manually (was unable to rename the %systemroot%\system32\catroot2 folder though), and that didn’t help either.
After doing much research online about this error I finally ran across a forum post on the BleepingComputer.com website that solved the problem for me. It’s basically updating an entry in the Windows registry for the automatic update service. It looks like he exported this registry entry from a working Vista computer (oh, and by the way, the laptop I was working on was also a Vista). To apply it you need to copy the following lines of code into Notepad and save the file as “WindowsUpdateFix.reg”.
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv] "PreshutdownTimeout"=dword:036ee800 "DisplayName"="Windows Update" "ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\ 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ 6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00 "Description"="Enables the detection, download, and installation of updates for Windows and other programs. If this service is disabled, users of this computer will not be able to use Windows Update or its automatic updating feature, and programs will not be able to use the Windows Update Agent (WUA) API." "ObjectName"="LocalSystem" "ErrorControl"=dword:00000001 "Start"=dword:00000002 "DelayedAutoStart"=dword:00000001 "Type"=dword:00000020 "DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00 "ServiceSidType"=dword:00000001 "RequiredPrivileges"=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,\ 00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,\ 65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,\ 00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,\ 61,00,74,00,65,00,50,00,61,00,67,00,65,00,46,00,69,00,6c,00,65,00,50,00,72,\ 00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,63,00,\ 62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\ 00,41,00,73,00,73,00,69,00,67,00,6e,00,50,00,72,00,69,00,6d,00,61,00,72,00,\ 79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\ 00,67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,\ 6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\ 00,00,00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,\ 75,00,6f,00,74,00,61,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\ 00,00,00,00,00 "FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters] "ServiceDll"=hex(2):43,00,3a,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\ 00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,75,00,\ 61,00,75,00,65,00,6e,00,67,00,2e,00,64,00,6c,00,6c,00,00,00 "ServiceMain"="WUServiceMain" "ServiceDllUnloadOnStop"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security] "Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00,14,00,00,00,30,00,00,00,02,\ 00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01,00,00,00,00,00,01,00,00,\ 00,00,02,00,48,00,03,00,00,00,00,00,14,00,9d,00,02,00,01,01,00,00,00,00,00,\ 05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ 20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,05,12,00,00,00,01,\ 01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum] "0"="Root\\LEGACY_WUAUSERV\\0000" "Count"=dword:00000001 "NextInstance"=dword:00000001
Now before you actually merge this with your existing registry, I highly recommend that you create a system restore point so you have a backup of your registry. There’s absolutely nothing wrong with this registry entry that I see, but it’s just standard practice to be safe rather than sorry when you’re about to make registry updates. After you’ve created your system restore point then you can right-click on the “WindowsUpdateFix.reg” file and select Merge. You’ll be prompted asking you if you’re sure you want to merge this with the registry. Accept it and then reboot your computer. Consequently, after Windows Update was working again then the manual update in Microsoft Security Essentials started working again too.
If by chance repairing the registry entry doesn’t help solve the 80096001 Windows Update problem, then there’s also an excellent Windows Repair tool at Tweaking.com. It’s currently at version 1.7.3 as I write this and works for Windows XP, 2003, Vista, 2008 & 7 (both 32 & 64-bit). Simply download, install and then run it. Go through the 4 steps (some basic information to make sure that your system is free of viruses, the file system is intact, the system files are ok, and creating a restore point/backing up the registry). The last tab will let you start repairing the system. I would just leave everything checked and let it start repairing the system. It repairs/resets a lot of Windows functions (including Windows Updates) and is very useful in making sure your system will still work fine after a virus infection. These are the steps from my own notes when I run this on client computers to repair their problems.
- Step 1 – Make sure you’ve ran Malwarebyes, ComboFix and TDSS Rootkit Remover at the least.
- Step 2 – Allow it to run a Disk Check. (It will reboot the PC immediately and run the disk check.)
- Step 3 – When the PC comes back on, run Windows Repair 1.7.3 again and go to step 3 and allow it to run SFC.
- Step 4 – Create a System Restore Point and also Backup the registry. (Can’t be too safe here).
- Start Repairs – On the Start Repairs tab click the Start button.
- Select the items you want repaired then run it. (By default they’ll all be selected in v1.7.3)
- Reboot the PC.
- Check to see if Windows Update works
A problematic Windows Update can sometimes be a very tricky problem to solve. Hopefully some of the ideas in this post will help anyone else having similar issues. Please let me know your experiences in the comments below and if there’s anything else you’ve done that’s helped you solve this problem too.