Removing a rootkit that prevents Windows Update from starting

A rootkit operates at a privileged level, allowing malware to hide files, processes, registry entries and drivers. If it interferes with Windows Update, the service may fail to start, updates may disappear from history, and antivirus may report nothing. Treat this as an operating-system compromise rather than a routine update fault.

Clues include Windows Update being disabled or reverting changes, unknown devices in Device Manager, altered firewall or proxy settings, disabled security tools, unexplained traffic, and system files that reappear. Similar symptoms can follow a damaged update cache, conflicting software or a failed upgrade, so diagnose before deleting files.

Australian households often use one Windows laptop for banking, work and family files, making isolation urgent. Devices in Sydney, Melbourne or Brisbane may be infected after cracked utilities or fake installers are downloaded over café or airport Wi-Fi. Follow Australian Cyber Security Centre guidance, and align business controls with the ASD Essential Eight.

Recognise the symptoms and contain the risk

Disconnect Ethernet, turn off Wi-Fi and stop using the PC for email, banking or password entry. From a clean device, record error messages and take screenshots if safe. Email-delivered malware is another route into Windows; the Stydco scam removal guide shows why suspicious attachments should be handled from a clean machine rather than opened on the infected one.

Change important passwords and enable multi-factor authentication from the clean device, revoke active sessions and contact the bank if transactions look unfamiliar. If an Australian organisation’s data may have been accessed, assess obligations under the Privacy Act 1988 and the Notifiable Data Breaches scheme. Scamwatch and relevant law-enforcement channels can receive reports, while affected clients should be notified according to the applicable rules.

Create a clean rescue environment

On the clean device, download current Microsoft installation media and create a bootable rescue USB with a reputable tool. Update Defender and any trusted offline scanner, then copy them to the USB. A local computer shop or managed service provider can prepare this media if the affected machine is the only available computer.

Boot the infected PC from the rescue environment and run a Microsoft Defender Offline scan or a reputable offline rootkit scanner. Avoid random “free rootkit remover” downloads, which can add malware. Record detections before making changes, and do not reconnect networking until the scan and cleanup are complete.

Remove the rootkit beyond normal cleanup

Remove the payload that installed the rootkit first. Uninstall only software you can positively identify as malicious, then use a trusted startup manager to review startup items, services, scheduled tasks and drivers. Revoke unfamiliar entries and remove the associated driver or service. Safe Mode alone is rarely sufficient because a rootkit may load before the scan begins.

Next, restore the Update-related components. In an elevated Command Prompt, DISM /Online /Cleanup-Image /RestoreHealth and sfc /scannow can repair protected system files, although these commands do not prove a rootkit is gone. Re-run the offline scan because a repair can expose persistence that was hidden before.

If Windows Update still cannot start, check services.msc for Windows Update, Background Intelligent Transfer Service and Cryptographic Services. Their startup settings should normally remain automatic or manual, not disabled. Avoid deleting service registry keys blindly; a rootkit can restore them, and the wrong change can prevent updates system-wide.

Compare recovery paths before deleting data

The cleanest choice depends on how much of Windows is untrusted and whether sensitive data must be recovered. A targeted cleanup is quicker, while a clean installation provides the strongest confidence that kernel persistence has been removed.

Use the following comparison when deciding how far to take the recovery:

Recovery option	When it fits	Main benefit	Main limitation
Targeted offline cleanup	One identified malicious package and no signs of kernel tampering	Preserves applications and settings	A hidden driver may survive
Windows repair	Update files or servicing components are damaged	Repairs system dependencies	Does not remove every rootkit
Clean Windows installation	Persistence is deep, unknown or repeatedly returns	Establishes a trusted baseline	Requires careful backup and reinstallation
Specialist examination	Business data, firmware concerns or repeated compromise	Provides deeper forensics	Higher cost and possible downtime

Back up documents, photos and browser bookmarks, but exclude executables, scripts, unknown archives and copied system folders. Cloud files should be saved to a clean account or storage location before the old installation is discarded.

Repair the Windows Update service

With the malware removed, repair the update path. Run the Windows Update troubleshooter or reset the update cache by stopping Windows Update and BITS, renaming the SoftwareDistribution folder, then restarting the services. Check services.msc and set Windows Update to start manually if it remains disabled, then start it and watch for error codes.

Pc Malware Expert’s malware cleanup guidance contains related advice for different threat types. After each change, test one update and inspect Event Viewer; repeated failures suggest the rootkit remains. If a clean reinstall still produces hidden drivers or altered security settings, suspect boot-level or firmware tampering and seek specialist analysis rather than repeating cleanup tools.

Confirm cleanup and prevent reinfection

Confirm the result with a full offline scan, a normal full scan and a restart test. Windows Update should download and install an update, Event Viewer should show normal service activity, and Defender, the firewall and System Restore should remain enabled. Remove temporary rescue media only after recovery is stable.

Update the operating system, browser, router firmware and applications from their official sources. Avoid cracked software, store extensions and installers sent through unexpected messages. Use separate administrator and everyday accounts where practical, and keep automatic patching, multi-factor authentication and tested offline backups enabled.

For Australian organisations, document the incident, map affected systems to the Essential Eight and review access logs. If personal information was involved, complete the relevant Privacy Act assessment and notification process. Recurrence after a trusted rebuild warrants a broader compromise investigation, not another isolated malware deletion.